How SourceRX handles compliance
A label tells you little. These are the specific controls in the system, and the server enforces each one, so nobody can click past them.
Prescriptions are records
A prescription on SourceRX has an identified prescriber, one patient, one preparation, a quantity and an expiry. A compounded order must quote a prescription that resolves to that record. The patient, the prescriber and the NPI come from the record, so nothing a buyer types can override them. Each fill draws down the quantity.
Prescribers are verified before they can sign in
SourceRX creates each prescriber account, confirms the NPI against the federal NPPES registry as a recorded attestation by a staff member, and records licenses state by state. Sign-in is refused until both are done.
A shop cannot write what it sells
Prescriber and partner are separate account types with no overlap. A partner has no way to write a prescription that its own store then fills.
A person reviews every compounded order
A compounded order starts on hold. The system refuses to dispatch it until a staff member records a decision. The rule is an allowlist: a verified status ships and everything else holds, including a status the system does not recognize.
Patient details are sealed
Names and dates of birth are encrypted at rest and left out of every read by default. Inside SourceRX, only the owner account can open them, after proving an authenticator code in the last 15 minutes, and each read writes a log entry. The one outbound path is the dispatch to the pharmacy compounding the order.
Card numbers stay off our servers
Customers pay on the processor’s hosted page. A signed notification confirms settlement, and only settlement releases an order to the next step. A form submission cannot do it.
Customers are told who does what
The legal documents on a 503A storefront tell customers that the shop does not compound or hold the stock, and that a compounding pharmacy prepares, labels and ships each order for the named patient.
What SourceRX does not claim
- SourceRX is not a pharmacy and does not practice medicine.
- Compounded medications are not FDA-approved, and FDA does not verify their safety, effectiveness or quality before marketing.
- No government body certifies HIPAA compliance. Ask us about any control you need detail on.
- These controls do not replace your own counsel. Your legal structure and your marketing claims remain yours to clear.
Common questions
Can a compounded order ship without a prescription on SourceRX?
No. A compounded order must resolve to a recorded prescription, and a staff member must record a review decision before it goes to a pharmacy. Any other status holds the order.
Who can read a patient’s name and date of birth?
They are encrypted at rest and left out of default reads. Inside SourceRX, only the owner account can open them, and only after proving an authenticator code in the last 15 minutes. Each read is logged. The dispatch to the compounding pharmacy also carries them, because the pharmacy needs them to fill the prescription.
Does SourceRX see card numbers?
No. Customers pay on the processor’s hosted page, so card details never touch SourceRX servers.
Questions about a control? Email support@sourcerx.us.
Bring the brand. We run what sits underneath it.
SourceRX is approval only. Tell us about your business and the states you plan to ship to, and we review it before anyone gets access.