For agencies
Data governance
What the program touches, where it comes from, who can see it, and how long it is kept — in enough detail for your counsel to work with.
This page describes what IntellaRx does. It is not legal advice and it does not state which confidentiality regimes apply to your agency. That determination depends on your organization, your population and the arrangement, and it belongs to your counsel. What we owe you is a description precise enough for them to make it.
The design rules
- Minimization by default. Every data element in the program has to justify itself against a specific decision somebody makes. If nothing changes as a result of an element, it is not collected. This is why ProviderSynch is a pull API returning a scoped summary rather than a record feed.
- Separation of clinical and aggregate. Clinical detail is available to clinicians treating the patient. Agencies receive aggregate outcomes. These are separate paths, not the same path with a permission setting.
- Purpose limitation, written down. Each data flow is documented with the purpose it exists for. Reuse for a different purpose is a change to the agreement, not an operational decision.
- Retention has an end. Every category has a defined retention period agreed in design, and deletion actually happens.
- Access is logged and reviewable, including by the agency.
- Consent is real. Where a component depends on consent, declining it does not remove anyone from care. A consent that cannot be refused is not one.
What your counsel will want, and should ask for
- A data inventory: every element, its source, its purpose, its recipients and its retention period.
- The flow diagrams — which system originates each element and which systems receive it.
- The distinction between what clinicians see and what the agency sees, demonstrated rather than asserted.
- The consent instruments, in the language the population actually reads.
- The subcontractor list, including the pharmacy and laboratory partners.
- The breach notification path and its timings.
- The deletion procedure and how it is evidenced.
- What happens to data if the engagement ends.
If any of those is not available on request, that is itself an answer about the program.
Categories the program touches
| Category | Where it comes from | Who sees detail | Agency sees |
|---|---|---|---|
| Prescription and dispensing records | Pharmacy partner, prescriber | Treating clinicians, dispensing pharmacist | Aggregate only |
| Diagnosis and treatment plan | Electronic medical record, with authorization | Treating clinicians, dispensing pharmacist (scoped summary) | Aggregate only |
| Toxicology results | Laboratory partner | Treating clinicians | Aggregate only |
| Behavioral health screening | Patient, via MedimetRx | Treating clinicians | Aggregate only |
| Social determinants assessment | Patient, with participation | Treating clinicians and care coordination | Aggregate only |
| Identity confirmation | Patient, at enrollment and transfer | Verification system only | Whether verification occurred, in aggregate |
| Delivery events | Delivery partner | Care coordination | Aggregate only |
| Overdose events | Contributing services | Registry, aggregated | Aggregate patterns |
| Drug-supply signals | Public, aggregate sources | Analysis team | Aggregate warnings |
Things we will raise with you
There are arrangements an agency may lawfully be able to construct that we would still question, and we would rather say so at design than discover it later:
- Any flow in which individual-level clinical information reaches a function with an enforcement or benefits-eligibility role.
- Any deployment where declining a component has a consequence for someone’s treatment.
- Retention periods with no articulated purpose.
- Analyses at individual level that were agreed as aggregate.
Questions this raises
Does IntellaRx hold a copy of the medical record?
No. ProviderSynch retrieves a scoped summary against a specific transaction rather than replicating records, and EMR integration reads rather than accumulates. The larger the pool, the worse a breach and the weaker the justification for holding it. See data minimization in practice.
What does the agency actually see?
Aggregate outcomes — whether components are being delivered, what they are finding at population level, and the measures agreed in design. Individual behavioral health, social determinants and monitoring data are not reported to agencies. See what an agency should and should not see.