Who should own the policies and procedures manual?

One named person. The HHS Office of Inspector General's guidance puts policy upkeep under a compliance officer, who makes sure policies are created, coordinated, and maintained. In a small company that can be the owner, as long as the job has a name next to it and a date on the calendar.

Does the law require NEMT companies to have a written manual?

No rule uses the word "manual," but many written policies are required. Federal Medicaid law has states confirm that every NEMT provider can show two processes: one covering violations of state drug law and another for giving the Medicaid program each driver's record behind the wheel. Broker contracts add more: MTM Health's Pennsylvania provider agreement makes a Substance Free Workplace Policy mandatory and lets MTM ask for a copy. The manual is where those policies live.

How often should a NEMT policy manual be reviewed?

Plan a full review every year, plus a targeted update whenever a law, contract, or broker manual changes. Compliance guidance from the HHS Office of Inspector General says health care policies should be reviewed at least annually, and Louisiana's Medi Trans holds its own operations manual to the same yearly review. Reopen a section after a serious incident, too, or when an audit turns up a problem.

Can I buy a policy template instead of writing my own?

A template is a fine starting point, but it has to be rewritten to match how your company actually works and the deadlines in your broker manuals. Auditors compare the manual with your records. A procedure you do not follow, or a deadline that differs from your broker's, is a finding waiting to happen.

How long do old policies and signed acknowledgments need to be kept?

Use the longest period required by any rule you work under. HIPAA sets six years for covered entities, running from the later of two dates: when a document was created or when it last applied. Modivcare's 2025 attestation calls for training records to be held 10 years or more, and Louisiana's Medi Trans manual sets 10 years for driver training records.

Do drivers have to sign every policy?

Drivers should acknowledge every policy that applies to their work, such as incidents, privacy, drug and alcohol testing, and rider conduct. Office-only policies can be signed by office staff. Modivcare's attestation lists employee acknowledgments and training rosters as the kind of records that prove owners and drivers completed required training.

NEMT Policies and Procedures Manual: How to Write One

What a reviewer checks in your manual

A broker or auditor reads your manual to settle three points: whether each rule exists in writing, whether your people know it, and whether your records show you follow it. A thick binder that fails the third point is worse than a thin one that passes all three, because it documents promises you did not keep.

The HHS Office of Inspector General sees it the same way. Its compliance guidance warns that out-of-date or unreliable policies cost a program credibility with regulators, and it wants every person a policy covers to be able to reach it and follow it, with translations and appropriate reading levels where needed.

So write the manual to be used, not filed. Every section below should point to a record you keep: a signed form, a training roster, a log, or a trip record.

Where the required sections come from

Most of the manual is dictated by someone else. Federal law, HIPAA if it applies to you, and each broker you contract with all name policies you must have. Start by listing every contract and manual you work under, then build the sections from them. Here is what current sources ask for:

Section	Where the requirement comes from
Driver screening and exclusion checks	Federal Medicaid law has states confirm that none of the NEMT providers or drivers they pay is excluded and that each driver is licensed. OIG guidance says to name the person who runs exclusion checks on staff and contractors. Medi Trans in Louisiana wants owner and driver screenings rerun monthly
Drug law violations and driving records	The same provision requires two processes: one for how the provider handles a violation of state drug law, the other for reporting every driver’s record behind the wheel, traffic violations and all, to the state Medicaid program
Drug and alcohol testing	MTM Health’s Pennsylvania agreement has drivers and attendants tested before hire and at random under a Substance Free Workplace Policy. Medi Trans wants a drug-free workplace policy statement plus a testing program
Rider privacy	HIPAA covered entities must keep written privacy policies. CareOregon tells staff to confirm a caller’s identity before sharing trip details
Fraud, waste, and abuse	An entity paid $5 million or more per year through a state Medicaid plan has to put False Claims Act policies in writing. New York’s threshold for a full compliance program is $1 million in Medicaid claims or payments within any 12 consecutive months
Emergencies and incidents	CareOregon requires written procedures for rider emergencies and a written collision and incident investigation procedure
Harassment and discrimination	CareOregon requires policies on harassment, sexual assault, and discrimination, communicated to drivers
Vehicle maintenance	Medi Trans requires a preventive maintenance policy and a schedule that meets at least the manufacturer’s
Smoke-free vehicles	MAS in New York requires policies that keep every vehicle smoke-free
Training	ADA rules require transportation staff trained to proficiency. Broker manuals list the courses, such as the 14 modules in MTM Health’s Virginia handbook
Complaints	MTM Health’s Pennsylvania agreement requires providers to follow complaint resolution policies and respond to forwarded complaints
Conflicts of interest	Modivcare’s 2025 attestation accepts either your own conflict of interest policy or the one in its code of conduct
Records and audits	Under MTM Health’s Pennsylvania agreement, operating records stay on file 10 years, and trip logs and billing reports are open to inspection, including visits that come without notice

Add the policies your operation needs even when no contract names them: late cancellations and no-shows, rider behavior and when a driver may decline a ride, and bad weather. For free starting points, use the no-show policy template or the template for drug and alcohol testing. Two sections have guides of their own: fraud prevention and HIPAA.

Write procedures people will follow

A policy is the rule. A procedure is the steps. Keep them apart, and keep each procedure to about one page. A driver who has to hunt through three paragraphs to find a reporting deadline will guess instead.

Brokers show the format in their own documents. Louisiana’s Medi Trans operations manual opens with a policy number, the original effective date, the date of last revision, the next review date, and the approver’s name and signature. Put the same header on every policy you write. Under it, use the same six parts every time:

Purpose. One sentence on why the rule exists.
Applies to. The roles that must follow it.
Owner. The one person who keeps it current.
Steps. Numbered actions, each with who does it and by when.
Records. What the procedure produces and where it is kept.
References. The contract section, manual page, or rule behind it.

Write the steps the way you would say them on the radio. Use verbs, name the role, and put deadlines in hours or days, never “promptly” when the broker gave a number.

Example: a rider is injured during a trip

This example is written for a provider working under MTM Health in Rhode Island, whose handbook treats any injury as a Tier 1 incident. Replace the deadlines with your own broker’s.

Driver: stop safely, call 911 if anyone needs medical help, and stay with the rider.
Driver: call dispatch as soon as the scene is safe.
Dispatcher: phone MTM Health right away with the rider, location, and what happened. The handbook requires Tier 1 events to be reported by phone immediately.
Driver: complete the incident form before the end of the shift.
Operations manager: email or fax MTM Health a written report no later than 24 hours after the event.
Operations manager: send the police report, when there is one, within five business days.
Records: file the driver’s form, the report sent to MTM Health, and any police report together in the incident folder.

Missed reporting steps cost $500 in liquidated damages under that handbook, which is why the deadline belongs inside the procedure. The incident report template gives drivers the form for step 4.

Mistakes that cost you in an audit

Copying a template word for word. It names practices you do not have.
Deadlines that disagree with the broker. The manual says 48 hours, the broker says 24.
Policies without records. A training policy with no rosters proves nothing.
One policy for every broker. Where brokers differ, say so in the step: “MTM Health trips: 24 hours. Other brokers: see the table.”

Review on a schedule and track every version

Review the whole manual every year. OIG guidance calls for a yearly review so policies keep pace with new statutes, regulations, and program rules, and Medi Trans holds its own operations policies to the same yearly cycle. HIPAA adds a standing duty for covered entities to change their policies when the law changes.

Between annual reviews, reopen a section whenever one of these happens:

A broker updates its manual or you sign a new contract.
You add a service level, such as wheelchair or stretcher.
A serious incident or complaint shows a gap.
An audit, a site visit, or a corrective action plan points to a section.
A law or state program rule changes.

Rules do change that often. Georgia’s own NEMT policy manual carries a revision record at the front, and its July 2026 version logs changes quarter by quarter, including an April 1, 2026 entry recording the switch to one statewide broker, Verida, for all five regions. Copy that idea: a revision table at the front of your manual listing the date, the section, and what changed.

When the approval process is too slow for an urgent change, the OIG suggests a way to communicate and document an interim policy for the people it affects. Fold that interim policy into the next full revision. Finalize and share any change before staff are expected to act on it.

Keep every superseded version. Under HIPAA, a covered entity holds its policy documents for six years, counted from creation or from the last day the version applied, whichever comes later. Old versions also prove which rule governed the day of any trip an auditor pulls.

Staff sign-off that stands up

A signature proves someone received the rule. A training record proves they learned it. Keep both.

Set the timing from your strictest broker:

Before any rides. A Virginia driver may not carry MTM Health members until the required courses are done, and Medi Trans makes the provider’s entire staff finish its course list before the provider takes trips.
Within 30 days of hire. Modivcare’s attestation gives new employees 30 days to complete its listed training.
Every year after. Medi Trans repeats its staff training annually, and Modivcare’s attestation covers training for the calendar year.
After a material change. When a HIPAA covered entity makes a material change to its privacy policies, it must train the workforce members whose jobs the change touches within a reasonable time.

Each acknowledgment should show the person’s name, the policy or manual version, the date, a line stating they read and understood it, and their signature. For group sessions, a roster with the course, date, and each attendee’s signature works. Modivcare’s attestation names employee acknowledgments, training rosters, and certificates as acceptable proof, and it expects them kept at least 10 years.

The OIG also recommends making compliance with policies part of every employee’s performance review. That turns the manual from a hiring-day form into a standard people are measured against. The driver training guide and the training log template help you track the courses themselves.

Keep it where people work

A manual in the office does nothing for a driver at a curb. Put the procedures drivers need during a trip, like incidents, emergencies, and no-shows, on a short card or on the phone they already carry. The Modivcare attestation requires drivers on Modivcare trips to carry its accident and incident report form. Keep the full manual somewhere every employee can reach, and tell staff who to ask when a rule is unclear. The broker audit guide shows how reviewers test whether the manual and the records match.

Where software helps

Policies are easier to prove when the records keep themselves. In HealthRide, drivers check their van in the app at the start of every shift. Reminders arrive before a license or certification expires, assignment checks flag a driver whose credential has lapsed, and every change is recorded. Those records sit behind your inspection, driver qualification, and privacy policies, as shown on the fleet page.

Writing a NEMT policies and procedures manual brokers and auditors accept