In general it is possible to make a stream cipher from a secure hash function yes. But to fully evaluate it you should post your full protocol and have it evaluated by the academic community (i.e. not on this site, even though there are a few professors active, it's considered off topic).
One thing that may not be secure is the hashing of the password. For starters you are missing a random salt, so if you use this scheme with the same password then it will fail catastrophically as the key stream will be identical for each encryption.
Furthermore your stream is not authenticated. Authentication of the ciphertext is required to protect it from man-in-the-middle / active attacks (as Codes has already mentioned).
On top of that it is relatively inefficient; there is no need to keep hashing the password, for instance (some other schemes have the same inefficiency, but still it can be avoided e.g. by pre-hashing the password and making sure that the input of the hash fits in a single block).
To create a better scheme, you could use a Password Based Key Derivation Function (PBKDF2, bcrypt, scrypt or Argon2) and an authenticated cipher such as GCM using the result of the PBKDF as key.
If you're dead-bound on using a hash based scheme you could also look at Keyak, which is based on the underlying construction of Keccak / SHA-3. You'd still need a PBKDF of course.