Talking to riders' families under HIPAA: what staff can share and when

Check your role before you check the rule

The HIPAA rule on family members is written for covered entities, so the first question is which hat your company wears. A NEMT company that bills a health plan electronically for its own trips can be a covered entity. A company doing broker trips is usually bound by the broker’s business associate agreement, and a business associate may use or disclose health information only as its contract allows or as law requires (45 CFR 164.502(a)(3)). A company can be both, depending on the trip.

Broker contracts are often tighter than HIPAA itself. MTM’s standard Transportation Provider Services Agreement makes the provider sign MTM’s business associate agreement, and section 21.B bars the provider and its staff from disclosing information about members to any person or business without MTM’s written consent, apart from internal use needed to perform the agreement. MTM’s Rhode Island handbook (updated July 1, 2026) adds two driver rules:

• Drivers contact a member’s family, guardian, attendant, or escort only when the assigned trip needs it.
• Drivers keep health information out of view of other passengers and do not discuss it with anyone outside the member’s treatment or health care services.

Medicaid adds its own layer. Under federal rules, each state Medicaid agency must safeguard information about applicants and beneficiaries, and the protected list starts with names and addresses and includes the medical services a person receives (42 CFR 431.305). MTM’s standard agreement (section 2.U) makes its providers comply with those rules too. Confirming to a stranger that someone rides Medicaid transportation to a clinic is a disclosure.

So read your broker contract first. Where it says less than HIPAA, HIPAA’s family rule is the ceiling. Where it says more, the contract wins for those trips. The broader rules for NEMT companies are in HIPAA for NEMT providers.

What 164.510(b) allows

For a covered provider, 45 CFR 164.510(b) permits two kinds of sharing without a written authorization:

1. Involvement in care. Information that bears on a person’s role in the rider’s care, or in paying for it, can go to a relative, a close friend, or anyone the rider has named.
2. Notification. Staff may tell family, a personal representative, or someone responsible for the rider’s care where the rider is, how they are doing in general terms, or that they have died.

How you get there depends on whether the rider can weigh in:

HHS’s guide for providers says the same permission works face to face, by phone, or in writing. It also says HIPAA does not require sharing when the patient is absent or incapacitated. Staff can wait until the rider can agree.

The limit is relevance. HHS’s example is a nurse who may not tell a patient’s friend about a past medical problem unrelated to the current condition. For a ride, relevant usually means the pickup time, the pickup spot, a delay, the driver’s arrival, the drop-off, and what the rider needs to bring. It rarely means why the rider sees that doctor.

Callers: HIPAA does not require ID, but you need a routine

For family and friends, HIPAA does not make staff prove a caller’s identity. HHS’s guide says that if a caller states they are a family member or friend, or involved in the patient’s care, no proof is required, though a provider may set its own verification rules. The regulation matches: the general duty to verify identity in 45 CFR 164.514(h) excludes 164.510 disclosures, and using professional judgment satisfies verification for them.

The bar is higher for people who are not family or friends, such as a neighbor or an agency worker. HHS says the provider must be reasonably sure the patient asked that person to be involved.

Broker manuals can ask for more. CareOregon’s provider manual (February 2024) tells dispatchers and other staff to confirm a caller’s identity before giving out member or trip information, and it allows disclosure only to three parties: the member, the member’s caregiver or representative, and the member’s health care provider.

A caller routine that fits a dispatch office:

1. Check the rider’s profile first. If the caller’s name and number are listed as a contact, go ahead within the rider’s stated wishes.
2. Ask what they already know. A caregiver who arranges the rides knows the address and the usual appointment day. Let them say it rather than reading it to them.
3. Call back when in doubt. Offer to call back on the number already on file for the rider or caregiver.
4. Do not confirm that someone is a rider to an unknown caller. Take a message and pass it to the rider.
5. Share the trip, not the chart. Times, places, and status only.

Personal representatives stand in the rider’s shoes

A personal representative is different from a helpful relative. Under 45 CFR 164.502(g), a person with legal authority to make health care decisions for an adult must be treated as that adult for the information relevant to that authority. HHS’s guidance lists the usual forms:

• A health care power of attorney
• A court-appointed guardian
• A general or durable power of attorney that includes the power to make health care decisions

For minors, the personal representative is generally a parent, guardian, or other person acting in place of a parent, with state-law exceptions. After a death, it is the executor, administrator, or another person with legal authority to act for the estate.

Scope matters. HHS gives the example of a health care power of attorney limited to one decision, such as life support. That agent is a personal representative only for information about that decision. Keep a copy of the document on the rider’s file and note what it covers.

There is one safety valve. A covered entity may refuse to treat someone as a personal representative if it reasonably believes the rider has been or may be abused or neglected by that person, or that treating them as the representative could endanger the rider, and it judges that refusing is in the rider’s best interest. If a rider tells a driver they fear a relative, dispatch should hear about it the same day. Preventing rider abuse covers the reporting side.

Facility staff and home aides

Aides, group home staff, and nursing home staff who help the rider fall into HHS’s “other persons involved in care” group. HHS’s guide gives the example of a patient’s health aide calling a provider about a prescription and getting an answer. For a ride, a nursing home nurse checking on a resident’s pickup time, or a group home manager asking whether a resident made it to the clinic, fits the same pattern.

Because these people are not family, the “reasonably sure” standard applies. The facility that booked the trip is easy: it arranged the ride. An unfamiliar caller claiming to be from a facility can be handled with a call back to the facility’s main number. Facilities that book often are covered in nursing home pickups.

When the rider says no

A rider’s objection ends the permission. HHS’s example is a nurse who may not discuss a patient’s condition with her brother after she has said she does not want her family to know. Record the objection on the rider’s profile so every dispatcher sees it.

Riders have two more tools under 45 CFR 164.522:

• A restriction request. A rider may ask you to limit what you share with family under 164.510(b). You do not have to agree. If you do agree, you must follow it, with an exception for emergency treatment.
• A confidential communications request. A covered provider has to go along with a reasonable request to reach the rider by a different method or at a different place, such as a cell phone instead of the home line. You may require the request in writing, but you may not ask why.

Some destinations reveal a diagnosis on their own. A dialysis unit, a cancer center, or an opioid treatment program tells a listener a great deal, so treat “where she went” as health information.

Texts and calls to family

Texting a caregiver follows the same rule as a phone call: share what relates to their role, and nothing more. A pickup reminder with a time, a place, and a vehicle description does the job without naming a clinic or a condition. Channel choices, consent, and wrong-number mistakes are covered in HIPAA and texting for NEMT. Consent rules for automated texts sit under a separate federal law, covered in TCPA rules for NEMT texts.

Emergencies and deaths

If a rider ends up in a hospital during a trip, the notification part of 164.510(b) lets staff tell family which hospital has the rider and give a general word on their condition. If an emergency leaves the rider unable to agree, staff decide what serves the rider’s best interest. Call the broker first if the trip came from one. The driver’s side of that day is in medical emergency during a NEMT ride.

After a death, sharing with involved family remains allowed unless it goes against a preference the rider expressed that you know about. Keep it to what the family needs, such as when the trip ended and who has the rider’s belongings.

A one-minute call script for dispatchers

1. “Who am I speaking with, and how are you connected to [rider’s first name]?”
2. Check the rider’s profile for contacts, objections, and any personal representative on file.
3. If listed and no objection: answer the trip question only.
4. If not listed: take a message, or call back on the number on file.
5. If the caller asks about health, past trips, or billing: refer them to the rider, or to the broker for broker trips.
6. Note the call on the rider’s profile.

Add the script to your written policies and procedures and train every new dispatcher on it.

Fewer family calls in HealthRide

Some family calls only ask where the driver is. In HealthRide, riders and families book online, and they can follow their driver live from a text link instead of phoning the office. HealthRide is HIPAA compliant. People on your team see only what their role allows, and every change is recorded. See the live map.