Replying to a bad review without breaking HIPAA: what a NEMT company can and cannot say

A bad review deserves an answer, but the answer cannot confirm that the reviewer rides with you, and it cannot mention a single detail of a trip. If HIPAA covers your company, either directly or through a broker contract, your rider records fall under the same rules as a clinic’s, and federal regulators have penalized health care providers for exactly this kind of reply. The fix is simple: answer the complaint in general terms in public, and handle the facts in a private call.

This guide covers why a reply discloses more than it seems to, the cases OCR has brought, what broker contracts add, replies that work, and how to get a review removed. Whether your company falls under HIPAA is covered in our HIPAA guide for NEMT providers. Asking customers for reviews is a marketing question, covered in how to market a NEMT business.

Why confirming the ride is already a disclosure

Saying “we picked you up” tells the public that this person receives medical care. A NEMT rider list is a list of people on the way to treatment, so even the bare fact of the relationship is health information once it sits in the records of a covered entity or business associate. Under 45 CFR 164.502(a), those companies can use or share rider information only in the ways the rule allows, and a business associate only as its agreement allows. Answering a critic in public is not on the list.

The reviewer going first does not change that. HIPAA has no exception for responding to what a patient posted about themselves. OCR’s director put it plainly when announcing the New Vision Dental settlement in December 2022: providers cannot disclose patient information when responding to negative online reviews.

In a transportation reply, the details that give riders away look harmless:

• Schedules. “Your 5:30 a.m. pickup on Mondays, Wednesdays and Fridays” points to dialysis without naming it.
• Equipment. “Our wheelchair van” or “the stretcher crew” reveals a mobility need.
• Destinations. Naming the clinic, the hospital, or even the building tells readers why the person goes there.
• Your own records. “Our GPS shows the driver waited 12 minutes at your door” confirms the ride, the date, and a missed pickup in one sentence.
• Other people. “Your daughter called us twice” brings a family member and the call history into public view.

What OCR has collected over review replies

OCR has taken money from health care providers in at least four cases built on review replies. None involved a transportation company, but the rule they broke applies to any covered entity or business associate in the same way.

Three patterns run through these cases. At least two began with a complaint from the patient who had written the review. Three of the practices had no adequate privacy policies either, so the reply exposed a second problem. And the North Carolina practice, which ended up with the largest amount, did not respond to OCR’s data request or to an administrative subpoena and did not contest the findings before OCR imposed the penalty. If OCR ever writes to your company, answer it; our guide to how OCR investigates a HIPAA complaint walks through the process.

Broker riders: the contract reaches further than HIPAA

For Medicaid trips, your broker contract usually forbids more than HIPAA does. The MTM transportation provider agreement that Pennsylvania posts (January 1, 2023 version) says information about members stays with the provider: nothing goes to anyone outside the company unless MTM consents in writing, other than what the provider’s own staff need to perform the contract. The same agreement says complaints MTM receives are forwarded to the provider for immediate attention and that providers follow the complaint resolution policies.

Modivcare’s 2025 provider compliance training names social media posts of a member’s trip records as one example of an improper disclosure. The same training asks that every breach, big or small, go right away to the provider relations contact or to Modivcare’s privacy officer. WellTrans’s in-network agreement for providers, revised October 16, 2025, carries a business associate addendum that gives providers one business day to report an unpermitted use or disclosure.

The practical result: when a broker’s member posts a public complaint, answer with the neutral reply below and handle the substance through the broker’s grievance process. Our guide to rider complaints a broker sends you covers response times and the evidence brokers want. Some states add privacy laws stricter than HIPAA, covered in state privacy laws that reach NEMT companies.

Replies that answer the complaint and disclose nothing

A safe reply has three parts: thanks, a commitment to look into it, and a direct way to reach a manager. It confirms nothing, so it fits a reviewer who rides with you, a relative, or someone who has never been in your vans. Keep a few approved versions on file so nobody writes one in a hurry at night.

Example reply to a late-pickup complaint:

Thank you for telling us about this. Being on time matters to us, and we want to look into what happened. Please call our operations manager at (555) 010-0142 or email service@example.com so we can follow up with you directly.

Example reply to a complaint about a driver:

We expect every driver to treat passengers with courtesy and respect, and we take reports like this seriously. We do not discuss anyone’s transportation in public posts, so please contact our office at (555) 010-0142 and a manager will follow up personally.

Example reply to a review that seems fake:

We could not find enough here to look into, and we do not discuss anyone’s transportation in public. If you would like to talk about your experience, please call us at (555) 010-0142.

The phone number and email in these examples are placeholders. Replies that fail look like this:

• “Our records show you weren’t ready when the driver arrived.” It confirms the trip and blames the rider in public.
• “We’re sorry your treatment ran long that day.” It names a medical visit.
• “As a Medicaid member you can always call the broker.” It reveals the payer.

Taking it offline the right way

The private conversation is where the complaint gets solved. When the reviewer calls or writes, check that the caller is the rider, or someone with authority over the rider’s trips, before you open the record. 45 CFR 164.514(h) requires a covered entity to verify identity and authority before most disclosures when it does not already know the person.

Then pull the trip record, find what went wrong, and tell the person what you are changing. Log the complaint like any other so it shows up in your trend reports; a complaint log keeps that consistent. Google notifies the reviewer when you reply, and the reviewer can still change the review after reading it. Never offer anything for that change: Google’s content policy forbids incentives such as payment, discounts, or free services for revising or removing a negative review.

When Google will take a review down

Google removes reviews only when they break its content policies, and its help pages say not to report a review just because you disagree with it. The policies most likely to apply to a transportation company:

• Conflict of interest. Reviews from current or former employees, competitors, or others with a professional or personal stake.
• Harassment and offensive content. Specific threats against people, doxxing, and unsubstantiated allegations of criminal wrongdoing.
• Personal information. Posts sharing someone else’s personal details without consent, such as a driver’s full name or face.

To report one, open your Business Profile, select Read reviews, choose Report next to the review, and pick the reason. Google says evaluation typically takes several days, and the Reviews Management Tool shows the status. If a report comes back as “no policy violation,” the same tool allows a one-time appeal, covering up to 10 reviews at once.

Stay away from threats. The FTC’s consumer review rule, 16 CFR 465.7, makes it unfair or deceptive to try to get a review removed through groundless threats of legal action, through intimidation, or with public claims you know are false.

When a reply has already disclosed too much

1. Edit or delete the reply now. Google lets you change or remove a reply from the same Read reviews screen. Write down what it said and how long it was up.
2. Assess it as a breach. 45 CFR 164.402 treats a disclosure the rule does not allow as a breach unless your written review of four factors (what was shown, who could see it, whether anyone did, and how far you limited the damage) finds little chance of compromise. A post anyone could read seldom passes that test.
3. Notify on time. For riders you serve as a covered entity, send each affected rider a notice as soon as you can. 45 CFR 164.404 sets 60 calendar days from discovery as the latest date. In Manasa’s case OCR required notices within 30 days to every patient whose information had been posted on Google Reviews or any other site.
4. Tell the broker if it was their member. As the broker’s business associate, you report to the broker, which decides how riders are told. Use the deadline in your agreement, such as WellTrans’s one business day.
5. Fix the cause. Name one person who answers reviews, give them approved replies, and train everyone else not to answer at all. Manasa’s corrective plan required training for every workforce member, owners and managers included.

Driver and dispatcher posts on their own accounts raise the same issue from a different direction. Our guide to HIPAA for NEMT drivers covers what staff can post. Putting a rider’s praise or photo in an ad or on your website requires a signed authorization.

Checking the facts behind a review in HealthRide

When a review says a driver never showed up, HealthRide’s trip records show the arrival time, any recorded wait, and the GPS-recorded miles for that ride, so a manager can see what happened before calling the person back. The trip log report exports those records, and every change in HealthRide is recorded, which keeps the private follow-up accurate while the public reply stays general.