Company phones or personal phones for NEMT drivers: cost, privacy, and reimbursement laws

The phone is part of the job now

An NEMT driver’s phone is a work tool, not a convenience. It runs the driver app, records the trip’s times and route, captures signatures, and carries messages from dispatch. Some brokers make it mandatory. MTM Health’s handbook for Virginia Medicaid fee-for-service transportation (May 2026), which covers trips scheduled on or after October 1, 2026, requires automated vehicle location to run from pickup to drop-off on all trips, and requires that drivers can reach dispatch and MTM on a working phone or similar device whenever they are in service. Its provider scorecard sets a GPS compliance target above 90.01 percent.

That has two consequences. A phone the job requires raises the question of who pays for it, which several states answer in statute. And a phone full of rider names and addresses is covered by HIPAA whoever owns it. The choice between company phones and drivers’ own comes down to cost, control, and those two rules.

Three ways to equip drivers

NIST, the federal standards agency, treats the second and third setups as distinct security models and publishes a separate guide for each (SP 1800-21 for company-owned, personally enabled phones and SP 1800-22 for bring-your-own-device).

To compare costs, add up everything each setup costs per driver per month. For company phones: the line, the phone’s price spread over the months you expect it to last, a case and dash mount, any device management tool, and a share of the spare phones kept for breakage. For personal phones: the reimbursement you owe or choose to pay, plus the time spent on driver phones that cannot run the app or keep failing mid-shift. As an example, a 12-driver fleet on company phones buys 13 or 14 devices, since a broken phone on a Monday morning otherwise takes a van off the road.

When the law says you pay for a personal phone

Several states require employers to reimburse work expenses, and required phone use falls inside those rules.

Federal wage law adds a floor that applies in every state. Under 29 CFR 531.35, wages must be paid free and clear. If a job requires workers to buy their own tools of the trade, a violation occurs in any week the cost eats into the minimum wage or overtime due. For a driver paid close to the minimum wage, an unreimbursed required phone plan can create a violation on its own.

These rules protect employees. How you classify drivers changes the analysis, which the 1099 or W-2 guide covers.

A written phone policy settles most disputes before they start. Say whether a personal phone is required or optional, what the reimbursement is and how it is paid, what minimum phone and plan the work app needs, and what happens to work data when the driver leaves.

Taxes on company phones

A phone you provide for business reasons is generally not taxable to the driver. IRS Notice 2011-72 says that when an employer provides a cell phone primarily for noncompensatory business reasons, the business use is excluded from income as a working condition fringe, and personal use is excluded as a de minimis fringe. The notice gives examples of qualifying reasons, including the employer’s need to reach the employee at all times for work emergencies. Being reachable by dispatch during every shift fits that description.

The exclusion has limits. A phone given to boost morale, attract a hire, or add to pay does not qualify. The notice also applies only to phones the employer provides, and it points out that cash fringe benefits generally cannot be excluded as de minimis. Run any flat phone allowance past your payroll provider or accountant.

Privacy and HIPAA on driver phones

HIPAA applies to rider information on any phone your drivers use for work, whoever bought it. Section 164.310(d) of the Security Rule asks for policies governing devices and media that store electronic health information, from the day they arrive to disposal and reuse. The practical difference between company and personal phones is how much control you have when something goes wrong.

Set the same baseline for every work phone:

• A passcode or biometric lock, with the screen locking itself after a short idle period. NIST’s mobile device guidelines give 45 seconds to 5 minutes as example settings.
• Encryption on. NIST notes that on most modern mobile platforms, data an app stores in its own folder is encrypted by default. HHS breach guidance treats properly encrypted data, with the key kept safe, as secured.
• Remote lock and wipe ready before the phone is ever lost.
• Rider details kept inside the work app, not in text threads, screenshots, notes, or personal cloud backups. The HIPAA texting guide explains why.
• No rider details on the lock screen, so a phone face-up on the dashboard shows nothing.
• Hands-free while driving. MTM’s Virginia handbook allows no mobile device use behind the wheel except a Bluetooth headset. The dispatcher and driver communication guide covers state hands-free laws.

Device management software enforces these settings instead of trusting each driver to set them. NIST SP 800-124 Rev. 2 describes the main tools. On company phones, full device management can require a passcode, lock the device remotely, and wipe it. On personal phones, app-level management that controls only work apps and their data is the approach bring-your-own-device users prefer, according to the same guidelines. It lets you remove work data without touching the driver’s photos and messages.

Monitoring needs notice. Delaware bars employers from monitoring employee phone calls, email, or internet use unless they give daily electronic notice or a one-time notice the employee acknowledges (19 Del. C. 705). Connecticut’s law covers electronic monitoring at the workplace and requires advance written notice to the employees affected (Conn. Gen. Stat. 31-48d). New Jersey makes an employer give written notice before using a device designed solely to track a vehicle an employee drives, with civil penalties of up to $1,000, then up to $2,500 for repeat violations (N.J.S.A. 34:6B-22). That law reaches dedicated vehicle trackers more than phone apps. Wherever you operate, tell drivers in writing what the phone and app record, keep location tracking to working hours, and keep the signed acknowledgment in the driver file.

When a phone is lost or stolen

Speed limits the damage. Put these steps in the phone policy and practice them once:

1. The driver calls dispatch immediately from any phone, with the time and place the phone was last seen.
2. Dispatch locks the phone remotely and signs it out of the driver app and any work email.
3. If it is not found quickly, wipe it. NIST’s guidelines describe remote wipe for exactly this case, a device that may have fallen into untrusted hands. A wipe only reaches a phone that is powered on and connected, which is why NIST warns against relying on it alone and why the passcode and encryption matter more.
4. Decide whether it is a breach. Under 45 CFR 164.402, an impermissible disclosure counts as a breach unless a documented risk assessment finds only a low probability of compromise. Data encrypted to the NIST standards HHS names, with the key not compromised, counts as secured, and its loss is not a reportable breach. On a phone the passcode guards that key, so a locked, encrypted phone whose passcode was never written down or shared is the case this protects. An unlocked phone with rider details on screen is not.
5. If it is a breach, notify on time. If your company is the covered entity, riders must hear from you without unreasonable delay and in any case within 60 calendar days of the day the breach was discovered (45 CFR 164.404). A breach affecting 500 or more people is reported to HHS at the same time. Smaller ones are logged and sent to HHS in the first 60 days of the following year (45 CFR 164.408). If you run the trips as a broker’s business associate, you notify the broker instead, within the same 60 days at most (45 CFR 164.410).
6. Check your broker agreement, which can set a shorter deadline and its own incident notice steps.
7. Record what happened, then issue the spare phone so the van can keep running.

When a driver leaves

Collect company phones on the last day. For personal phones, remove work access that day. The HHS Office for Civil Rights, in its November 2017 guidance on termination procedures, says that when personal devices are allowed to hold electronic health information, they should be cleared of it and their access ended when the person leaves. In practice: sign the driver out of the app, disable their account, remove them from any group chats, and confirm the work app’s data is gone from the phone. The user roles guide has the full exit checklist.

Driver phones and the HealthRide app

The HealthRide driver app works on iPhone and Android, so it runs on company phones or drivers’ own. Rider details never show on the lock screen, and the app keeps working without cell service, saving what the driver does until coverage returns. See the driver app for how drivers run their day from it.