HIPAA for NEMT providers: what applies to you and what to put in place

How HIPAA reaches an NEMT company

HIPAA applies to covered entities and their business associates. An NEMT company can land in either group, and brokers write HIPAA duties into their contracts either way. Knowing which role you hold tells you who you report to when something goes wrong.

HHS OCR links to a question-and-answer decision tool for covered entity status. If your answer is unclear, use it and ask a health care attorney. In practice the contract settles most of it. Virginia’s NEMT standards require drivers and attendants to comply with HIPAA, MTM’s provider handbook says it mandates that all transportation providers remain HIPAA compliant, and Modivcare’s annual attestation includes HIPAA privacy and security training.

What counts as protected health information in NEMT

Protected health information is individually identifiable health information, in any form. It includes demographic details tied to a person’s health, the care they receive, or payment for that care. In a transportation company, that covers a lot:

• Manifests with rider names, addresses, and phone numbers
• Destinations, because a dialysis center or a treatment clinic reveals a condition
• Mobility needs, oxygen, attendants, and notes about behavior
• Medicaid or member ID numbers and trip authorization numbers
• Signatures, trip logs, and billing records

A paper manifest on a dashboard is PHI. So is a driver’s phone showing tomorrow’s schedule.

The Privacy Rule in daily operations

The Privacy Rule’s minimum necessary standard is the one you apply most. When you use or share PHI, you must make reasonable efforts to limit it to the minimum needed for the purpose. A driver needs a pickup address, a time, and mobility needs. A driver does not need a diagnosis.

Broker manuals turn this into concrete driver rules. CareOregon’s provider manual tells drivers to leave no papers or devices with member information where others can see them, and not to discuss member information over the phone or radio in front of others. Virginia bars the words “Medicaid” or “FAMIS” from vehicles and business names, and requires that member identifying information not be visible to other passengers.

Good habits to write into policy:

1. Keep manifests face down or on a locked phone, never on the dash.
2. Confirm pickups with the rider by name only, not by appointment type.
3. Use the rider’s first name and a pickup location on the radio, never a diagnosis.
4. Shred printed manifests before the driver goes home.

The Security Rule starts with a risk analysis

If you are a covered entity or business associate and keep rider data electronically, the Security Rule applies to that data. Its first required step is a risk analysis: an accurate and thorough assessment of the risks and vulnerabilities to the confidentiality, integrity, and availability of the electronic PHI you hold. Risk management follows, meaning security measures that bring those risks down to a reasonable and appropriate level.

HHS OCR’s guidance says the risk analysis should be ongoing, and that small organizations usually have fewer systems and people to account for. The rule does not set a frequency. HHS notes that some organizations repeat it every year and others as needed, such as every two or three years. The Security Risk Assessment Tool from ONC and OCR is designed to help small and medium-sized practices and business associates.

For an NEMT company, the list of places PHI lives is usually short:

• Dispatch and billing software
• Driver phones and tablets
• Office computers and shared email inboxes
• Broker portals and downloaded trip files
• Paper files and the filing cabinet

The technical safeguards in 45 CFR 164.312 turn into a few concrete settings:

• Unique logins. Every user gets their own login. This one is required, so no shared dispatch passwords.
• Automatic logoff and encryption. Both are addressable. You adopt them, or you document why they are not reasonable and put an equivalent measure in place.
• Audit controls. Systems that hold rider data must record activity so you can review who opened or changed a record.

HHS proposed an update to the Security Rule on January 6, 2025. As of September 2026 it remains a proposal, so today’s rule is the one you must meet.

Business associate agreements with your vendors

Any vendor that creates, receives, maintains, or transmits PHI for you needs a business associate agreement. For an NEMT company that usually means dispatch software, a billing service, an answering service, and file storage.

Under 45 CFR 164.504(e), the agreement must:

• Limit how the vendor may use and disclose the information
• Require appropriate safeguards and compliance with the Security Rule
• Require the vendor to report misuse and breaches to you
• Bind the vendor’s own subcontractors to the same terms
• Require return or destruction of the data when the contract ends, if feasible

Ask for the agreement before you sign the order. Our guide to choosing NEMT software covers what else to check in a vendor. Modivcare’s 2025 attestation also has providers certify they do not receive, view, process, or store PHI outside the United States, so ask vendors where your data sits.

Training and documentation

Training duties depend on your role. A covered entity must train every workforce member on its privacy policies, as needed for their job. New staff must be trained within a reasonable time after they start, and everyone affected must be retrained when a policy changes materially. The training must be documented. Covered entities and business associates alike must also run a security awareness and training program for the whole workforce, management included.

Keep your HIPAA policies and required records for six years from creation or from the date they were last in effect, whichever is later. Broker contracts can go further. Modivcare’s 2025 attestation has providers certify that owners and drivers completed its compliance training, HIPAA included, for the calendar year. New employees must finish it within 30 days of hire, and training records must be kept for at least 10 years. MTM’s handbook lists fraud, waste and abuse and HIPAA training among its required courses. Our NEMT driver training guide puts these on one schedule.

When something goes wrong: breach notification

Any use or disclosure the Privacy Rule does not permit is presumed to be a breach unless a documented risk assessment shows a low probability the information was compromised. A lost, unlocked phone holding a day of manifests would likely qualify. Notice duties apply to unsecured PHI, and data encrypted to the standard in HHS guidance does not count as unsecured. That is one more reason to encrypt every phone and laptop. The clock starts on the day the breach is known, or would have been known with reasonable diligence.

Your broker contract may set its own, shorter deadline for telling the broker. Check it before you need it.

HIPAA penalty amounts after the 2025 adjustment

HHS adjusts civil penalties for inflation every year. These are the 2025 figures in 45 CFR 102.3 for violations on or after February 18, 2009.

A HIPAA checklist for NEMT owners

1. Decide your role for each line of business: covered entity, business associate, or subcontractor.
2. Name a privacy and security officer, even if it is the owner.
3. Complete and date a risk analysis, then fix the top risks first.
4. Write short policies for manifests, phones, radio talk, texting, and records disposal.
5. Sign business associate agreements with every vendor that touches rider data.
6. Train every driver and dispatcher before their first shift, and keep sign-in sheets.
7. Lock every device with a passcode and set screens to lock automatically.
8. Write a breach response plan with the contacts and deadlines above.
9. Review everything once a year and after any incident.

Protecting rider data in HealthRide

In HealthRide, patient information is encrypted and protected, and each person on your team only sees what their role allows. We sign business associate agreements with our providers. Drivers see their trips in the driver app instead of on printed manifests, and dispatch conversations stay in team chat instead of personal text threads.