Text-to-Order Process Flow

Narration

Integration Handoffs

AKS FIREWALL

Blocks OMS Reporting & MSC data from flowing to KnipperRx, Eagle, or CaryHealth (42 C.F.R. § 1001.952(d))

Key Business Rules (Updated)

Respect Do Not Communicate, Opt-Out, and Global - Text Outbound Opt Out rules (BU-wide, cross-client).
Validate Prior Express Written Consent (PEWC) per number before any send — DNC scrub alone is not PEWC.
OMS initiates and manages all outbound SMS campaigns; A2P 10DLC campaign registration required.
Pharma MLR clearance and Form FDA-2253 submission required before first send.
Secure link must contain encrypted HCP identification details AND require separate MFA/Part 11 authentication at MSC.
State license must be verified in real time as its own step with its own audit record, separate from eligibility.
MSC validates eligibility and sample limits; shipping destination may never be a retail pharmacy, including CareTria affiliates.
Orders must capture PDMA disclosures and electronic signature.
AKS firewall: OMS Reporting / MSC data must never flow to KnipperRx, Eagle, or CaryHealth.
Reassigned Numbers Database (RND) scrub required alongside DNC/opt-out exclusions.
Text-to-Order orders are tracked as a separate source for reporting.
All events, responses, authentications, and removals must be auditable.

Legend

Process Step

Decision Point

Compliance-driven step (new/changed)

End / Exception

Process Flow

YES Path

NO Path

STOP / HELP Path

Unrecognized / No-Response Path

Notes

If the HCP responds NO or does not respond, the process ends with no follow-up and no message is sent for an unrecognized reply.
STOP/HELP is checked before YES/NO classification and takes precedence over any other keyword present in the same reply.
The Global DNH list (Reason: Global - Text Outbound Opt Out) is checked twice per campaign — once when the target file is loaded, and again immediately before send — so an opt-out recorded after the file was built still blocks delivery.
The secure link gives the HCP mobile-friendly access to MSC, but opening it is not itself authentication — a separate MFA/Part 11 step is required before any order action.
Every communication, response, authentication, and DNH addition/removal is captured for audit and campaign performance tracking.

Compliance Remediation Crosswalk

Each compliance-review callout (A–M) and where it is now addressed in the remediated flow above. Select a row to jump to the step.