HIPAA-compliant NEMT software: the safeguards to require from any vendor

What “HIPAA compliant” means when a vendor says it

“HIPAA compliant” on a software website is a claim, not a license. HHS says no HIPAA standard requires anyone to certify compliance, and it gives no official standing to the certifications private firms sell for the Security Rule. A vendor with a certificate can still be found in violation. The badge tells you little, so look at the contract and the product instead.

Two facts frame the rest of this guide:

• The vendor is your business associate. HHS guidance on cloud services says a company that creates, receives, or maintains electronic health information for you counts as your business associate, even if it cannot read the data because it is encrypted and the vendor holds no key.
• The work is split. The vendor secures its system. You decide who gets an account, which phones they use, and how they are trained. Your own side (the risk analysis, written policies, and breach plan) is in HIPAA for NEMT providers.

So when a NEMT software vendor says “HIPAA compliant,” it should mean two things. It puts a business associate agreement in writing, and its product gives you the safeguards below. Ask to see each one working.

The business associate agreement comes first

Sign the agreement first, and import riders after. Under 45 CFR 164.504(e) and 164.314(a), the agreement has to:

1. List what the vendor may do with the data, and forbid everything else
2. Commit the vendor to appropriate safeguards and to the Security Rule for electronic records
3. Oblige the vendor to tell you about misuse, breaches, and security incidents
4. Hold the vendor’s subcontractors, such as its hosting company, to the same terms
5. Require the vendor, once the contract ends, to return or destroy your data and keep no copies, where that is feasible

The HHS cloud guidance adds the items a service agreement should settle: how reliable the system must be, how backups and data recovery work (including after a ransomware attack), how your data comes back to you after termination, who is responsible for which security tasks, and limits on use and retention. The service terms must never block your access to your own data.

Ask where the data lives. HIPAA allows storage outside the United States under a business associate agreement, though HHS notes the risks change with location. Broker contracts can close that door. Modivcare’s 2025 attestation, for example, asks each transportation company to confirm it does not handle rider health information offshore, whether that means viewing, processing, or storing it.

Access limited by role

Each person should see what the job calls for, and no more. The minimum necessary rules require you to identify which people or job classes need access to health information, which categories each one needs, and to limit access to match (45 CFR 164.514(d)). Software makes that practical only if it has real roles.

Removing access matters as much as granting it. The Security Rule lists procedures for ending access when someone leaves (45 CFR 164.308(a)(3)). Ask the vendor how quickly a deactivated user is signed out of phones and browsers that are already open.

To test roles in a demo, sign in as a driver and try to open another driver’s trip. Then sign in as a dispatcher and try to open billing.

Sign-in: unique logins, two-step codes, and passkeys

Every person needs their own login. The Security Rule makes unique user identification a required specification, and it requires procedures to confirm that the person signing in is the one claimed (45 CFR 164.312). A shared “dispatch” login fails the first test and makes the activity history useless.

Two-step sign-in is the next layer, and methods differ. CISA’s fact sheet on phishing-resistant multifactor authentication (October 2022) lists the attacks on weaker methods:

• Phishing: a fake sign-in page collects the password and the six-digit code
• Push fatigue: repeated approval prompts until someone taps Accept
• Phone-network attacks and SIM swaps: codes sent by text or voice are intercepted or redirected

CISA calls FIDO and WebAuthn sign-in the only widely available phishing-resistant option. Passkeys are FIDO credentials: the person signs in with the same fingerprint, face, PIN, or pattern that opens their phone or computer. NIST’s updated authentication guideline, SP 800-63B-4 (July 2025), says systems at its middle assurance level must offer at least one phishing-resistant option. It also accepts passkeys that sync across a person’s devices at that level, and it restricts codes sent over the phone network.

HHS has proposed making multifactor authentication a requirement. Its January 2025 proposed rule would require it for access to the systems that hold health information, but the rule was still not final in September 2026. The government’s Unified Agenda of regulations puts it among long-term actions and targets a final rule for July 2027. Brokers already expect it: MTM’s Rhode Island handbook (July 1, 2026 update) has providers confirm a six-digit code, sent by text or email, to sign in to MTM Link, with an option to remember a device for 30 days.

What to require: two-step sign-in for every office account, passkeys as an option, automatic sign-out after a period of inactivity (an addressable specification in 45 CFR 164.312(a)), and an owner view showing who has turned two-step sign-in on.

An activity history you can read

The Security Rule requires audit controls: mechanisms that record and examine what happens in any system containing electronic health information (45 CFR 164.312(b)). It also requires you to review those records regularly, such as audit logs and access reports (45 CFR 164.308(a)(1)). A log only an engineer can read does not meet the second part in practice.

A useful history shows, for each change:

• Who did it, under their own name
• Which trip, rider, invoice, or setting changed
• The value before and after
• When it happened
• Exports and bulk downloads, not just edits
• Actions taken by an AI assistant, with the person who approved them

The same record settles everyday disputes: who moved a pickup time, who cancelled the trip a broker says you missed, who changed a rate. In a demo, change a trip’s pickup time, then ask the vendor to show you the entry.

Encryption in transit, at rest, and on phones

Encryption is an addressable specification under today’s rule, both for stored data and for data sent over a network (45 CFR 164.312). Addressable does not mean optional. Under 45 CFR 164.306(d), you adopt it when it is reasonable and appropriate. If it is not, you write down why and use an alternative that does the same job, where one is reasonable.

The strongest reason to insist on it is breach notification. HHS guidance treats health information encrypted to NIST standards as secured, provided nobody has obtained the decryption key. Examples it names are NIST SP 800-111 for stored data and SP 800-52 (TLS) for data in transit. HHS also advises keeping keys on a separate device or in a separate location from the data they protect. Breach notice duties apply to unsecured information, so a stolen encrypted laptop is a very different event from a stolen unencrypted one.

The January 2025 proposal would go further, making encryption mandatory for nearly all stored and transmitted health information, with a short list of exceptions. Ask the vendor, in writing, how data is encrypted:

1. Between browsers or phones and its servers
2. In its database and backups
3. On the driver’s phone, including trips saved for use without signal
4. In exports and reports it emails or lets users download

Driver phones and lock-screen privacy

A driver’s phone is where rider information is most exposed. HIPAA defines a workstation as a computer or any other device that performs similar functions (45 CFR 164.304). The physical safeguards require you to restrict workstations that access health information to authorized users (45 CFR 164.310).

Notifications are the easy leak. A phone left on a dashboard can show the next pickup to anyone who glances at it. Both phone makers let users hide previews:

• iPhone: Settings, then Notifications, then Show Previews, with the choices Always, When Unlocked, and Never
• Android: Settings, then Notifications, then Notifications on lock screen, with an option to show no notifications or to hide sensitive content (menus vary by phone)

Do not rely on every driver changing a setting. The app itself should keep names, addresses, and destinations out of notification text. For example, “New trip assigned for 9:40 AM” works where “Pick up M. Lopez at the dialysis center” does not.

Also check what the app stores. Trips saved for offline use should be encrypted, limited to that driver’s own trips, and cleared when the driver signs out or is deactivated. When a phone is lost, the office should be able to sign it out remotely so its saved trips can no longer be opened. Pair that with a company rule that every phone uses a passcode and locks automatically. Our driver training guide covers phone habits.

Backups and getting your data out

Backups are a required specification. Under 45 CFR 164.308(a)(7), you need a way to make exact copies of rider records that can actually be restored. Ask how often backups run, where copies are kept, and when a restore was last tested.

Leaving a vendor is where contracts get tested. HHS answered this directly in FAQ 2074. A business associate that blocks a covered entity’s access to its records, such as a software company that triggers a “kill switch” during a payment dispute, is making a use of the information the Privacy Rule forbids. When the agreement ends, the vendor must return the data as the agreement provides, in a reasonable format you can still open and use.

Before you sign, confirm you can export:

• Riders, drivers, vehicles, and facilities
• Trips with times, status changes, and assigned drivers
• Rider signatures, recorded GPS miles, and no-show wait times
• Invoices and payments
• The activity history

Run one export during your trial and open it. Before a move, read our guide to switching NEMT software so no records are lost.

A vendor checklist

For the rest of a software evaluation, from features to pricing, read how to choose NEMT software.

How HealthRide handles these safeguards

HealthRide is HIPAA compliant, and every provider receives a signed business associate agreement. What each person can open depends on their role, passkeys or two-step codes can protect every sign-in, and HealthRide keeps a record of each change. In the driver app, rider details stay off the phone’s lock screen, and the provider portal has separate accounts for owners, dispatchers, billers, and the rest of your team.