Eligibility and client responsibilities
The client identifies authorized senders and recipients, item classification, lawful release authority, custody reference, temperature range, packaging method, required equipment, delivery deadline, incident contacts, and failed-delivery instructions before service.
The submitting facility classifies, seals, labels, and packages specimens and regulated items. Peyelis drivers do not open, repackage, relabel, classify, or correct medical shipments. Controlled substances and higher-risk infectious materials require separate written compliance approval and may be declined.
Custody and qualified personnel
Medical assignments are limited to approved drivers with current license, insurance, MVR status, assigned training, and any client-required qualification. Pickup and handoff record timestamps, seal condition, responsible parties, recipient verification, and approved proof that avoids unnecessary PHI.
Temperature-controlled work requires a confirmed range, validated packaging or monitoring method, excursion procedure, and direct handoff. A missing recipient, compromised seal, excursion, spill, exposure, loss, or privacy incident is immediately escalated under the client’s written procedure.
HIPAA relationship and BAA
The parties must document whether Peyelis acts only as a courier conduit with random or infrequent access to PHI or performs a function involving creation, receipt, maintenance, or transmission of PHI on behalf of a covered entity. The actual service—not the document title—controls.
When a business associate relationship exists, the parties must execute a separate BAA satisfying 45 CFR 164.504(e) before Peyelis receives PHI. The BAA must address permitted uses, safeguards, incidents and breaches, subcontractors, access and amendment support where applicable, return or destruction, termination, and required government access. The standard courier agreement alone is not a BAA and does not claim automatic HIPAA compliance.