Pilot Readiness — Scope A

Shadow / parallel-run checklist for the two pilot pharmacies — track tasks, owners and the Go/No-Go gate

Knowledge Base
Ask Copilot:
Pilot posture
1QRx runs alongside each pharmacy's existing system. It is not the legal system of record or batch record during the pilot — no prescription leaves the building solely on 1QRx until each module is validated.
Pilot mode preview

Scopes the left nav to the real (Postgres-backed) modules and shows a “parallel run — not the legal record” banner across the app. Mock modules are hidden (revealable as “Preview”).

Overall progress
11%
4/38 tasks done
In progress
0
actively being worked
To-do
34
not started
Go / No-Go
Not yet
0/5 exit criteria met
In scope (real backend)
  • Compounding Lab MES — formulas · lots · worksheets · BUD/USP gates · QA
  • Patients-360
  • Catalog & Pricing
  • Compliance — PDMP documentation + audit trail
  • 503A facility model
  • Agentic safety gates running over real lab data
Out of scope (Preview / absent)
  • eRx intake · live claims adjudication · EPCS
  • PDMP gateway submission · carriers · payments · messaging
  • Mock front-of-house (Rx Entry / Verify / Pipeline / Dispensing) · CRM · Portal — "Preview"
Duration: ≈12 weeks — 4 prep · 6 parallel run · 2 evaluate
Recommended — start now

Buildable in-app today, no external dependency:

  • 2.3Import each pharmacy's master formulary → lab_formulas / ingredients (stability/BUD, station mapping)
  • 2.4Import active patients (demographics / insurance / allergies)
  • 6.3Metrics baseline + dashboard (time-to-release, first-pass yield, gate catches, discrepancies, NPS)
Who's responsible? — the shared model

Compliance is split, not one-sided. 1QRx secures the platform; the pharmacy owns its operation. The BAA is signed by both — and no patient data flows until it is.

1QRx — the platformBusiness Associate · Satya
  • Provide & sign the BAA — plus BAAs with our subprocessors (DB host, etc.)
  • Platform safeguards: encryption, tenant isolation (RLS), audit trail, backups
  • Our own Security Risk Assessment + the SOC 2 / HITRUST path
  • Build the features that enable your compliance (USP rules, EPCS/PDMP hooks, RBAC)
Pharmacy — the operationCovered Entity · Savan
  • Your own HIPAA program: SRA, policies, workforce training, minimum-necessary
  • State board license, DEA, and physical USP <795>/<797>/<800> + your SOPs
  • EPCS identity-proofing + the PDMP reporting duty (we provide the tooling)
  • Execute the BAA, sign off the USP rules, and the clinical practice of pharmacy
The BAA is bilateral. 1QRx provides & signs it; the pharmacy reviews & countersigns. Go-live needs both sides' lists complete — then prescribers are onboarded. (Not legal advice — have counsel review the BAA + a customer-responsibilities clause.)
WS1

Infrastructure & Security

1/9
  • 1.1Provision HIPAA-eligible managed Postgres (encryption at rest, TLS, automated backups + PITR) to replace the dev VPS Docker DB
    Acceptance: DB reachable only over TLS; encryption-at-rest on; daily backup + a tested restore
    INFRA
    LP0
  • 1.2Sign a BAA with the DB / host provider and any PHI subprocessor
    Acceptance: Countersigned BAA on file
    LEGALSEC
    MP0
  • 1.3Set a strong production SESSION_SECRET — fail-closed on the insecure dev fallbackBuild-ready
    Acceptance: App refuses to run with the dev fallback in production; secret in a manager, not the repo
    Shipped — lib/auth.ts now throws in production rather than signing with the dev key (prod secret verified set).
    ENG
    SP0
  • 1.4Enforce MFA + password policy + lockout + idle timeout for PIC/admin
    Acceptance: MFA required for privileged roles; lockout after N fails; idle timeout ≤15 min
    ENG
    MP0
  • 1.5Re-verify tenant isolation under RLS (app runs as a non-owner DB role)
    Acceptance: Documented test: tenant A cannot read tenant B via any action/route
    ENGSEC
    MP0
  • 1.6Network lockdown — DB not publicly exposed; private app↔DB; least-privilege roles
    Acceptance: Port scan clean; DB rejects public connections
    INFRA
    MP0
  • 1.7Monitoring / alerting / error tracking / log aggregation / uptime
    Acceptance: Alert on error-rate + downtime; centralized logs
    INFRA
    MP0
  • 1.8Backup / restore drill + documented RTO/RPO
    Acceptance: Restore rehearsed; RTO/RPO written
    INFRA
    SP0
  • 1.9TLS/HTTPS + HSTS on the pilot domain
    Acceptance: A-grade TLS; HSTS on
    INFRA
    SP0
WS2

Data Onboarding & Tenant Provisioning

0/6
  • 2.1Confirm both tenants (503A patient-specific compounding)
    Acceptance: Both tenants exist; facility set to 503A
    Already seeded — just verify in the DB.
    ENG
    SP0
  • 2.2Create real user accounts per site (PIC, techs) with RBAC; remove demo credentials
    Acceptance: Each user has a least-privilege role; demo logins disabled
    ENGOPS
    MP1
  • 2.3Import each pharmacy's master formulary → lab_formulas / ingredients (stability/BUD, station mapping)Build-ready
    Acceptance: Top-N formulas loaded and PIC-verified per site
    I can build a CSV importer for formulary + ingredients.
    ENGPIC
    LP1
  • 2.4Import active patients (demographics / insurance / allergies) — minimum-necessaryBuild-ready
    Acceptance: Import tool + reconciliation spot-check
    Reuse the same CSV-import tool for patients.
    ENGOPS
    LP1
  • 2.5Import ingredient inventory + reorder thresholds → lab_ingredients
    Acceptance: On-hand / thresholds match a physical count
    ENGOPS
    MP1
  • 2.6Load provider pricing into pharmacy_pricing for in-scope SKUs
    Acceptance: Prices set; prescriber markup demoed
    OPS
    MP1
WS3

Application Readiness

3/6
  • 3.1Pilot-scope the navigation — surface only the real modules; hide/label mock modules "Preview"Build-ready
    Acceptance: Pilot users see Lab / Patients / Pricing / Compliance / Standards; mock front-of-house hidden or labeled
    Shipped — Pilot mode toggle (top of this page) scopes the sidebar to real modules; mock ones hide or show a "Preview" badge.
    ENG
    MP1
  • 3.2Add a "Pilot — parallel run; not the legal record" banner in-appBuild-ready
    Acceptance: Banner visible on every page for pilot tenants
    Shipped — amber banner appears app-wide when Pilot mode is on.
    ENG
    SP1
  • 3.3PHI guard on address autocomplete — the geocoder proxy must not receive patient address fragmentsBuild-ready
    Acceptance: No patient address text leaves to a non-BAA endpoint (verified in a network trace)
    Shipped — patient intake + order ship-to now use external={false} (no third-party lookup); pharmacy/prescriber addresses still autocomplete.
    ENGSEC
    MP1
  • 3.4Confirm NPI lookup sends only a provider NPI (public data, no PHI)
    Acceptance: Documented in the PHI data-flow inventory
    SEC
    SP1
  • 3.5Finalize daily-use polish on the in-scope modules from PIC dry-run feedback
    Acceptance: PIC sign-off that each in-scope screen is usable for real work
    ENGPIC
    MP1
  • 3.6Verify append-only audit trail + inspector CSV export
    Acceptance: Tamper-evident log; export works
    Already built on /compliance — verify retention.
    ENG
    SP1
WS4

HIPAA & Administrative Compliance

0/7
  • 4.1Execute a BAA between each pharmacy (covered entity) and 1QRx (business associate)
    Acceptance: Signed BAA per site
    LEGAL
    MP0
  • 4.2Security Risk Assessment (HIPAA §164.308(a)(1))
    Acceptance: SRA complete; critical findings remediated or risk-accepted
    SEC
    LP0
  • 4.3Policy set — access control, audit, incident response, breach notification, contingency/backup, sanction, retention/disposal
    Acceptance: Policy set approved and acknowledged
    SEC
    LP1
  • 4.4Workforce training + signed confidentiality for pilot users
    Acceptance: Training log + signatures on file
    OPSSEC
    MP1
  • 4.5Minimum-necessary + RBAC review per role
    Acceptance: Role↔permission matrix signed off
    SEC
    SP1
  • 4.6PHI data-flow inventory (where PHI lives, every subprocessor, what leaves the system)
    Acceptance: Diagram + subprocessor list; matches the geocoder/NPI findings
    SEC
    MP1
  • 4.7Incident / breach runbook + contacts (60-day notification path)
    Acceptance: Runbook approved
    SEC
    SP1
WS5

USP & Clinical Validation (pharmacist sign-off)

0/5
  • 5.1PIC validates the USP rule tables (<795>/<797>/<800> BUD, weight tol, assay ±10%, station env) vs current USP + site SOPs
    Acceptance: Signed validation per chapter; site-specific overrides captured in config
    PICENG
    LP1
  • 5.2Run the pharmacist-review-loop per in-scope module (MoSCoW × severity; safety = Must)
    Acceptance: Each module reaches sign-off; Must-issues closed
    PIC
    LP2
  • 5.3Parallel-run concordance — for N lots, compare 1QRx lab record vs the official record; reconcile
    Acceptance: ≥ target concordance; zero unresolved safety discrepancies
    PICENG
    LP2
  • 5.4Document that 1QRx is NOT the legal batch record during the pilot
    Acceptance: Statement signed by both PICs
    PICPM
    SP1
  • 5.5Confirm 503A patient-specific workflow fit at each site
    Acceptance: 503A rules behave correctly per site
    PIC
    MP1
WS6

Pilot Operations

0/5
  • 6.1Training sessions per site (PIC + techs)
    Acceptance: Users complete the core lab/patient/pricing flows unaided
    PMOPS
    MP1
  • 6.2Real support channel + SLA (helpdesk module is mock — use email/Slack + on-call)
    Acceptance: Channel live; response SLA defined
    PM
    SP1
  • 6.3Metrics baseline + dashboard (time-to-release, first-pass yield, gate catches, discrepancies, NPS)Build-ready
    Acceptance: Baseline captured before go-live; weekly snapshot
    I can build an in-app pilot-metrics view over the real lab/compliance data.
    PMENG
    MP1
  • 6.4Weekly review cadence (review → triage → build → re-review)
    Acceptance: Standing weekly; tracked backlog
    PM
    SP2
  • 6.5Rollback / exit plan — pharmacy can revert to incumbent with no data loss
    Acceptance: Documented; data export available
    PM
    SP1
Go / No-Go to Scope B

Each criterion turns green when its gating tasks are Done.

  • Zero unresolved safety discrepancies; record concordance ≥ target (5.3)
  • USP rule tables validated & signed by both PICs (5.1)
  • HIPAA: BAAs signed + SRA complete, no open criticals (1.2, 4.1, 4.2)
  • No PHI leakage — geocoder guard verified; data-flow clean (3.3, 4.6)
  • Demonstrated value + adoption (6.3)
Gate not yet open — complete the gating tasks above
Top risks & mitigations
  • PHI sent to a non-BAA geocoder on patient intake
    Task 3.3 — guard/replace before any patient data is entered
  • DB still on the dev VPS (no BAA, no encryption-at-rest)
    Tasks 1.1 + 1.2 — managed HIPAA-eligible DB + BAA
  • Dev SESSION_SECRET fallback in production
    Task 1.3 — fail-closed
  • Pharmacist validation time is the critical path
    Front-load WS5 in Phase 0/1; keep scope tight
  • Scope creep into mock modules
    Task 3.1 — hide/label "Preview"; pilot banner 3.2
Phase 0 — Foundations
Weeks 1–2

Infra + security + BAAs + SRA kickoff + tenant provisioning

Phase 1 — Load & validate
Weeks 2–4

Data import + app pilot-scoping + PHI guard + USP validation + training

Phase 2 — Parallel run
Weeks 4–10

Live shadow operation; metrics + weekly reviews + concordance

Phase 3 — Evaluate
Weeks 10–12

Measure vs exit criteria → Go/No-Go for Scope B

Internal pilot planning. Your progress is saved in this browser only. Full detail: docs/PILOT-SCOPE-A-READINESS.md.