Retail pharmacy drivers hand over behavioral health prescriptions every day on the strength of a name, an address and a knock. For patients on controlled substances such as buprenorphine for opioid use disorder or stimulants for ADHD, that routine hands a stranger at the door the medication list itself, plus the fact that this person is a patient.
What a delivery window exposes
Packaging on prescription deliveries routinely carries pharmacy branding, and a patient identifier on a label is protected health information because it links a package to a specific person receiving a specific treatment. Delivery apps and courier platforms also store route data, drop-off photos and recipient names for months, and a breached account exposes an entire medication schedule.
The compliance layer is looser than most clinic leaders assume. HHS has been clear that the conduit exception does not cover medical couriers, which makes every driver a business associate owing a signed agreement before the first package moves. A pharmacy that dispatches without one is outside HIPAA on every delivery.
Controls that fit a delivery desk
Pharmacists and clinic managers can tighten this without building a new system. Ship in sealed, tamper-evident packaging with nothing visible through the material, require a signature plus date-of-birth confirmation rather than leaving a parcel on a step, and keep route data inside systems that carry business associate terms and a defined retention limit. Give drivers an escalation path for a misdelivery that does not involve asking a neighbor to hold medicine.
Discretion at the doorstep is a clinical safety issue, not a courtesy. For someone whose street knows them by their front door, a single misdirected package can undo months of treatment.
