HIPAA for NEMT drivers: what drivers can say, show, and leave in the van

The rule behind every driver habit

HIPAA treats drivers as part of the company’s workforce. The federal definition reaches paid staff, volunteers, and trainees, plus anyone whose work the company directly controls. Which HIPAA role the company itself holds (its own covered entity, or a subcontractor under a broker) is a question for the owner, answered in HIPAA for NEMT providers. Either way, every broker contract puts the duty in the driver’s seat:

• Virginia. MTM Health’s handbook (approved August 2026) tells drivers to keep member information private and not to show or discuss it with anyone unauthorized, other members in the van included.
• Rhode Island. The MTM Health handbook for the state, last updated in July 2026, says health information should not be visible to other passengers, and drivers should not discuss it with anyone outside the member’s treatment or care, other riders included.
• MTM’s standard agreement. Section 21 lets the provider share member information only with staff who need it for their duties, only in the portions their jobs require, and requires telling those staff not to disclose it.

The legal idea underneath is the incidental disclosure. Under 45 CFR 164.502(a)(1)(iii), a disclosure that happens as a by-product of a permitted one is allowed, as long as the company has applied the minimum necessary standard and reasonable safeguards. HHS guidance describes an incidental disclosure as secondary, limited, and impossible to reasonably prevent. It adds the part drivers need to hear: a disclosure that happens because someone skipped a safeguard is not incidental, and it is not permitted.

So the test for every habit below is the same. Did the driver do the reasonable thing to keep the information to the people who need it? If yes, a stranger overhearing a first name is incidental. If no, it is a violation. The minimum necessary standard decides how much a driver should see in the first place.

The manifest: what stays out of sight

A manifest is a list of names, addresses, phone numbers, and destinations that reveal conditions. Treat it like cash. Five habits close the obvious gaps:

1. Never on the dash. A paper manifest on the dashboard or passenger seat is readable through the windshield and by every rider who climbs in. Keep it in a closed folder or face down in a door pocket.
2. Never in an empty, unlocked van. Modivcare’s 2025 provider training lists not storing health information in unlocked vehicles among its safeguards. A driver walking a rider inside for two minutes locks the van.
3. Phone screens dark. Lock the phone between trips and keep the screen turned away from passengers. Modivcare’s training suggests privacy screens on devices, and CareOregon tells drivers to avoid viewing a member’s information when other passengers can see it.
4. No screenshots. A screenshot of tomorrow’s runs lives on in the phone’s photo roll and its cloud backup long after the driver leaves.
5. Shredded, not tossed. Modivcare’s Mississippi manual tells providers to shred trip logs and manifests before throwing them out. Retention periods and shredding methods are in the record disposal guide.

Saying it out loud: lobbies, phones, and the next rider

Spoken slips are the hardest to take back. Three situations come up on almost every shift.

In the lobby

A driver often has to find a rider in a crowded clinic or a nursing home lobby. HHS gives avoiding patients’ names in public hallways and elevators, and speaking quietly in waiting areas, as examples of reasonable safeguards. In practice: ask the front desk quietly, or say the rider’s first name and your company name. Do not announce the destination. “Maria, your ride is here” is fine. “Maria, your ride home from chemo” tells the whole room something nobody needed to know.

On the phone or radio

CareOregon’s manual asks drivers to keep a member’s details off any call or radio exchange that others can overhear. When dispatch calls about a pickup change with a rider aboard, the driver keeps answers short and takes the speaker off. Headsets are not always allowed: MTM’s standard agreement permits an earpiece on duty only when it belongs to the provider’s own radio or phone setup, and Modivcare’s Mississippi manual allows only hands-free phone headsets. Check your contracts before buying any. Dispatchers carry half of this: they read out the next pickup’s address and time, never a diagnosis or another rider’s story.

With the next rider

Regular riders ask about each other. “Where’s Mr. Lee today?” is friendly, and still a question about someone else’s health care. Modivcare’s training gives talking about one member’s trip with a different rider as an example of improper disclosure, and both MTM handbooks name other riders in the van as people drivers may not share information with. Give drivers one line to use: “I only talk about your ride.” The same goes for small talk about the last rider’s mood, mobility, or family.

Photos, posts, and curiosity

The driver’s own phone and social media accounts are where a slip turns public. Three rules cover it:

• No riders in photos. Faces sit on HIPAA’s identifier list: the de-identification rule names “full face photographic images and any comparable images” among 18 items to strip out. A selfie in the van, a picture of a wheelchair being secured, or a video of the dashboard can all capture a rider.
• No posts about riders. Modivcare’s Mississippi manual asks providers not to post member information in any public forum such as a website, and its 2025 training gives social media posts of members’ trip records as an example of improper disclosure. That includes a funny story with the name left out but the clinic and the time left in. Replying to reviews is the company’s job, not the driver’s; replying to reviews under HIPAA covers what the company can say.
• No looking up riders for curiosity. The same training names accessing member trip records “just for fun” as improper. A driver who checks when a neighbor rides next has used rider data for no work reason.

Cabin cameras raise their own privacy questions, covered in dash cameras in NEMT vans.

Questions from neighbors, family, and facility staff

Drivers get asked about riders all day, and the right answer depends on who is asking:

• Neighbors, building staff, and strangers. Nothing. “I’m sorry, I can’t talk about the people I drive.” Even confirming that someone rides with you reveals that they receive medical care.
• Family members and caregivers. Often fine, within limits the rider sets. The rules are in talking to riders’ families under HIPAA. A driver who is unsure says the office will call back.
• The facility receiving the rider. CareOregon tells drivers not to reveal a member’s appointment details or diagnosis to anyone outside the member’s care team or health care providers. The nurse at the destination is part of that. The security guard at the door is not.
• Callers to the office. CareOregon also has dispatchers confirm a caller’s identity before discussing any trip, and shares trip details only with the rider, a caregiver or representative the rider has, or the rider’s health care provider.

When a driver slips

Drivers need to know that reporting a mistake fast is the expected move, not a confession. Put it in writing: a lost manifest, a misdirected text, a conversation someone overheard, or a post gets reported to the office before the shift ends.

The company then has three jobs:

1. Limit the harm. Under 45 CFR 164.530(f), a covered entity must reduce any known harmful effect as far as practicable, which can mean retrieving a manifest, getting a post deleted, or calling the rider.
2. Decide what it was. Some slips are reportable breaches, and some are not. The breach section of HIPAA for NEMT providers walks through the test. Broker clocks run in parallel: CareOregon wants word of a suspected breach at once and within 24 hours at most, MTM’s agreement requires providers to report breaches to MTM, and Modivcare asks for an immediate report to its provider relations contact or privacy officer.
3. Apply the sanction policy. A covered entity has to apply, and write down, sanctions against staff who break its privacy policies under 45 CFR 164.530(e). The Security Rule separately requires every covered entity and business associate to keep a sanction policy, in 45 CFR 164.308(a)(1)(ii)(C). A first, honest mistake might mean retraining. A deliberate post or a lookup for personal reasons belongs on the removal track in disciplining NEMT drivers.

The stakes for the driver personally are real. Since a 2009 amendment, 42 U.S.C. 1320d-6 applies to employees who knowingly obtain or disclose health information held by a covered entity without authorization, with penalties up to $250,000 and ten years in prison when the intent is to sell the information or use it for personal gain or malicious harm. Say so in training, and have each driver sign a confidentiality agreement at hire. Messaging rules for driver phones are in HIPAA texting for NEMT.

Keeping rider details off lock screens in HealthRide

HealthRide is HIPAA compliant. Access follows each person’s role, and every change leaves a record. In the driver app, rider details stay off phone lock screens, so a trip alert on a locked phone shows nothing about a rider to whoever is in the passenger seat.