A prescription leaves a pharmacy on Wisconsin Avenue for an apartment in Cleveland Park. A sealed cooler leaves a home in Silver Spring for a reference laboratory. A clinic in Arlington sends copies of records to a patient who moved to Alexandria. The person at the far end of each of those runs is not an office with a front desk; it is someone's home, and someone's name. This article is about how a courier should handle delivery to a patient at home in Washington DC, Maryland and Virginia — what the pharmacy rules say about it, what the federal privacy rule allows, what the driver should and should not know, and how our private recipient option is built so that a patient's name does not end up in a dispatcher's inbox.
Home delivery is a pharmacy act with a courier's hands
The first thing to understand is who is responsible. When a pharmacy delivers, the pharmacist is still dispensing; the courier is the delivery system. Each jurisdiction in our area says that in its own way.
Virginia's regulation on delivery of dispensed prescriptions names, "in addition to direct hand delivery to a patient or patient's agent," delivery to a patient's residence, and then sets the limits: orders for Schedule II through V drugs may not be delivered to an alternate location unless federal law and the Board's rules allow it, and a pharmacy may not deliver to a residence drugs that require special storage, reconstitution or compounding before administration, with an exception for patients with bleeding disorders. Virginia's Department of Health Professions counted 1,744 licensed pharmacies and 16,147 pharmacists in its third-quarter 2024 tally, and a good share of them deliver.
Maryland's delivery-of-prescriptions regulation defines delivery as sending medication by the United States Postal Service, a common carrier or a delivery system to an address in the state, and defines a depot as the place where prescriptions are held before delivery to the intended patient or that patient's authorized agent. The operative sections of the chapter set the pharmacy's duties; the definitions alone tell you the Board expects couriers in the picture and expects the patient or the patient's agent to be the one who receives.
The District's pharmacy rules, in Title 22-B of the DC Municipal Regulations, mention prescription deliveries in the counselling provision: the pharmacist must ensure that, as in the case of deliveries, the patient receives written notice of the right to a consultation and a telephone number to reach the pharmacist. In other words, a delivered prescription still comes with the pharmacist's offer to talk.
For the courier, all three say the same practical things. The receiver is the patient or someone the patient has authorized. Controlled substances need the pharmacy's own rules followed to the letter. Drugs with storage requirements travel at temperature or do not travel by courier at all. And the pharmacist's leaflet, label and consultation notice go in the bag before it is sealed, because none of that is the driver's job. Our pharmacy courier page and the post on prescription delivery across Montgomery County describe the identity-verification and signature side.
What HIPAA allows, and what it asks of you
Health information in the package — the label, the leaflet, the records — is protected health information, and the pharmacy or clinic sending it is a covered entity. The courier's place in HIPAA is narrow and well defined: a courier that only transports sealed packages is a conduit, like the postal service, and HHS says no business associate contract is required for conduits. We explained that rule in full in what "HIPAA-compliant courier" really means. The part that matters for home delivery is this: the conduit exception holds only while the courier's exposure to the information stays transient. The moment a courier's booking system is asked to hold the patient's name, the diagnosis, or the drug, the courier is maintaining protected health information and the picture changes.
That is why a home delivery should be booked the way a lab run is booked: by reference. The pharmacy's prescription number or the clinic's file reference identifies the delivery; the patient's name is needed only so the driver can hand the bag to the right person at the door. HIPAA's minimum necessary standard asks covered entities to limit protected health information to the minimum needed for the purpose, and a courier that is designed to take less helps you meet it.
HHS has also answered the everyday question of who may receive. Its guidance says a provider may allow another person — a family member, a friend — to pick up a filled prescription, medical supplies or X-rays, and that HIPAA allows providers such as pharmacists to use professional judgment and experience in deciding whether to do so. For a delivery, that judgment belongs to you, exercised at booking: tell us whether the package may be handed to a named alternate, and we follow the instruction; the driver never decides it on the doorstep.
What the driver sees: the private recipient option
Every courier has to give the driver a name and a phone number, or the delivery cannot happen. The question is what else the courier's system does with them. Here is what ours does when you tick "The receiver is a private individual" on a confidential booking.
The full name, phone and email are visible in two places only: the dispatcher's order page and the assigned driver's task. On the driver's task the name itself is shortened to a first name, a last initial and the order number — enough to ask for the right person at the door, not enough to say much about them — and the recipient's email address is not sent to our dispatch platform at all, so its automatic emails to the recipient are switched off. Our own confirmation email to you contains no receiver block. The recipient is never added to our customer database, never appears in a marketing export, and does not show in our order lists, which say "Private recipient" instead.
Ninety days after delivery, the name, phone and email are removed from our records. The address stays, because billing and proof of delivery need it, and the handoff record stays — pickup time, package count, each transfer, delivery time and the name of the person who signed. Inside our admin system, opening a private recipient's full details is itself logged, so the answer to "who looked at this" is available on request.
Everything else is the standard confidential handling described on our confidential and medical deliveries page: the booking is by reference only and you confirm the package is sealed; if the description field looks like it contains a patient name, a date of birth or an account number, the form warns you before you continue; the task carries one instruction — sealed package, do not open, signature required; and our drivers are bonded, background-checked and trained to carry sealed packages without opening or photographing them. The why bonded drivers matter post explains the first part of that sentence.
The three common home runs, and how to book each
Pharmacy to patient. Seal the bag with the label, leaflet and consultation notice inside. Book by prescription number, tick Confidential and Private individual, give the patient's phone, and say whether the bag may be left with a named alternate. If the drug is refrigerated, say so: CDC's storage guidance puts refrigerated items between 2 and 8 degrees Celsius and says to transport in the passenger cabin rather than a trunk, and we send a driver with an insulated carrier and cold packs. Controlled substances follow your Board's rules and your own policy on signature; tell us at booking and the driver will not release the package without the signature you specify. The temperature-controlled delivery page covers the cold-chain side.
Home to laboratory. A mobile phlebotomist, a home-health nurse or the patient has collected the specimen into the lab's kit, after an at-home blood draw for example. The kit does the packaging: a closed, leakproof primary container, a secondary packaging with absorbent, a rigid outer box — what the federal transport rules require for Category B substances and what OSHA's bloodborne pathogens standard requires for any specimen during transport, a leakproof, labelled container closed before it moves. CDC's laboratory guidance says specimens should already be at 2 to 8 degrees before they leave and should travel with cold packs around the sealed secondary packaging. The sender is the home address; the receiver is the lab's accessioning desk; the booking is by requisition number and the home-side person is the private individual. For urgent samples, see the STAT medical courier page and the post on STAT specimen pickup. There are, by our count of CMS's September 2026 certificate table, roughly thirteen thousand CLIA-registered laboratories in the District, Maryland and Virginia; a home specimen can be going to any of them, and the kit, not the courier, is what makes it safe to carry.
Clinic to a patient's home. Records, imaging on disc, a device, a sealed result letter. Book by file reference, tick Private individual, and describe the item by type. Nothing about the condition or the test goes in the booking. If the patient must sign personally, say so.
What we never need, and what to leave out of the booking
A patient's name beyond what is needed to hand over the package. Date of birth, medical record number, diagnosis, test name, drug name. Case numbers tied to a person. Card or account numbers. If any of these is on the paperwork inside the sealed bag, that is between the pharmacy or clinic and the patient; it is not the courier's to see. If any of it is typed into the booking by mistake, our form warns you, and our dispatcher never copies it onto the driver's task.
When a home delivery goes wrong
Nobody answers; the building has no doorman; the patient has moved. The driver calls dispatch, dispatch calls you, and you choose: wait, retry later in the day, deliver to the named alternate you authorized, or bring it back. A refrigerated bag that cannot be delivered comes back in the cold carrier. A package that is lost, delayed or misdelivered is reported to you by phone the same day and noted on the order, and the handoff record shows every step. We do not leave sealed medical packages with neighbours or on steps unless you told us to.
Booking
Open the booking form, tick "Confidential delivery," confirm the sealed-and-reference-only line, then tick "The receiver is a private individual." The medical courier page covers scheduled lab routes and daily runs for practices that send every day; the medical practices page covers accounts; the privacy policy has the short version of everything above. If your compliance team wants the handling in writing, we sign a courier handling attestation; we operate as a conduit and keep patient information out of our systems, so we do not sign business associate agreements — the HIPAA article explains why that is the honest answer rather than the evasive one.
Sources used in this article. Pharmacy rules: 18 VAC 110-20-275, "Delivery of dispensed prescriptions" (Virginia Board of Pharmacy, via the Virginia Law Portal); COMAR 10.34.25, "Delivery of Prescriptions," scope and definitions (Maryland Board of Pharmacy); 22 DCMR-B Chapter 19, Pharmacies, § 1919.5 (DC Health). Pharmacy counts: Virginia Department of Health Professions, Current License Count, Q3 FY2024. HIPAA: HHS Office for Civil Rights, FAQ 245 (conduits), FAQ 535 and FAQ 527 (another person picking up a prescription); 45 CFR 164.502(b) (minimum necessary). Packaging and specimens: 49 CFR 173.199 and 173.134; OSHA, 29 CFR 1910.1030. Temperature: CDC, Vaccine Storage and Handling Toolkit (July 2026); CDC Infectious Diseases Laboratories, "Specimen Storage and Shipping Guidance." Laboratories: CMS, "Laboratories by Certification Types" (September 2026; our sum of the certificate columns for DC, Maryland and Virginia). Rules are quoted as published by those sources; this article is general information, not legal or pharmacy-practice advice.