Police, subpoenas, and lawyers asking for rider records: what HIPAA lets a NEMT company release

The document decides what you can release

Under HIPAA, the document behind a request decides what a NEMT company may release, not the badge or letterhead of the person asking. A detective, a process server, and a rider’s attorney can all want the same trip log, and HIPAA treats each of them differently. These rules bind your company when it is a covered entity or a broker’s business associate, which the HIPAA guide for NEMT companies explains. Calls from relatives and caregivers follow a separate rule, covered in talking to riders’ families.

Sort every request into one of these before anyone opens a rider’s file:

• A court order or court-ordered warrant. Release what the order names, and nothing beyond it.
• A subpoena or summons a judge issued, or a grand jury subpoena. Release what it calls for (45 CFR 164.512(f)(1)(ii)).
• An administrative subpoena or civil investigative demand. Release what it asks for when the information is relevant and material to a legitimate inquiry, the request is specific and limited, and de-identified data would not do. The demand itself can show all three.
• A subpoena from a lawyer in a lawsuit, with no court order. Wait for written proof that the rider was notified and did not object, or that a protective order was requested (164.512(e)).
• A phone call, an email, or a visit with no paperwork. Only the narrow exceptions in the next section apply.
• The rider, or someone with the rider’s signed authorization. These are access and authorization requests, covered further down.

What can police get without a warrant?

Without legal process, an officer can get only a few things, and each has its own limits.

Identifying or locating someone. When the person sought is a missing person, a suspect, a fugitive, or a material witness, the allowed details are the person’s name and address, Social Security number, birth date and birthplace, ABO blood type and Rh factor, the kind of injury, when treatment happened, when death occurred if it did, and visible features like height, weight, gender, race, hair and eye color, facial hair, scars, and tattoos (164.512(f)(2)). Nothing else is on the list. Trip history, pickup times, and where the driver took the rider are not on it, so a request for those needs a warrant, an order, or a qualifying subpoena.

A crime victim. You may disclose with the rider’s agreement. If the rider cannot agree because of incapacity or an emergency, the officer must say the information is needed to find out whether someone else broke the law and will not be used against the rider, and that waiting would materially hurt the investigation. Then you decide whether releasing it is in the rider’s best interest (164.512(f)(3)).

A death you suspect was criminal, and evidence you believe in good faith shows a crime on your own premises, may also be reported (164.512(f)(4) and (5)).

A serious and imminent threat. When a person’s safety or health, or the public’s, faces a serious and imminent threat, you may disclose what is needed to prevent or lessen it to someone able to do that, police included (164.512(j)). Your good faith is presumed when it rests on actual knowledge or a credible statement from someone with apparent knowledge or authority.

As an example, a family reports that a rider with dementia never came home after a dialysis run, and an officer calls asking where your driver dropped her off. If you believe in good faith that she is in danger, telling the officer the drop-off address and time can fit the threat exception. Write down who called, what you said, and why.

Verify the officer and the authority

HIPAA requires you to confirm both the identity and the authority of anyone you do not already know before releasing records (164.514(h)). For public officials it spells out what you may rely on, if reliance is reasonable:

• Identity. A badge or other official credentials in person, government letterhead in writing, or for someone acting for an agency, a letter on its letterhead or a contract showing the relationship.
• Authority. A written statement of the legal authority, or an oral one if writing is impractical. Legal process such as a warrant, an order, or a subpoena counts as authority on its face.
• Scope. When an official says the records requested are the minimum needed for the stated purpose, you may rely on that statement if reliance is reasonable (164.514(d)(3)(iii)(A)).

A badge photo sent by text proves little. Calling back through the department’s published main number before releasing anything is a sensible habit for phone requests.

Subpoenas and court orders in a lawsuit

Civil cases run on a different rule, 164.512(e), and the difference between an order and a subpoena matters most here. An order signed by a judge or an administrative tribunal lets you release exactly what it expressly authorizes.

A subpoena or discovery request without a court order is not enough by itself. You need a written statement and supporting documents from the party asking that show one of two things:

1. Notice to the rider. The party made a good faith attempt to give the rider written notice with enough detail about the case to object, the time to object has run out, and either no objection was filed or the court resolved it.
2. A qualified protective order. The parties agreed to one and gave it to the court, or the party asked the court for one. The order must bar using the records outside the case and require their return or destruction when it ends.

You may also give the notice or seek the protective order yourself instead of waiting on the requester. A crash or injury claim can bring a preservation letter before any subpoena, so keep the trip records, GPS history, and messages for that ride intact, and read handling a NEMT incident for what the file should hold. Given what is at stake in litigation, have a lawyer review any subpoena your company did not expect.

Lawyers: authorization or legal process

A lawyer’s letter, however official it looks, is not a reason to release records. There are two ways forward.

If the lawyer represents the rider, ask for a HIPAA authorization the rider signed. To be valid it must spell out which records, the company releasing them, the person or firm receiving them, and why (“at the request of the individual” is enough when the rider starts it). It also needs an end date or ending event, and the rider must sign and date it (164.508(c)). A personal representative who signs must describe their authority. Copy fees for these requests are not limited by HIPAA’s access fee rule. HHS confirmed after the 2020 Ciox Health v. Azar decision that the access fee limit applies only when individuals ask for their own records, not when they direct records to someone else.

If the lawyer represents the other side, the request goes through the subpoena and court order rules above.

Broker trips: the contract can be stricter

On broker trips you often hold rider information as the broker’s business associate, and a business associate may use or disclose it only as its business associate contract allows or as required by law (164.502(a)(3)). HIPAA’s definition of required by law includes court orders, court-ordered warrants, and subpoenas or summons issued by a court, grand jury, government inspector general, or an agency authorized to demand records (164.103).

Broker agreements add their own limits. Under MTM’s provider agreement (version 01.01.2023, posted by Pennsylvania’s Department of Human Services), the provider signs MTM’s business associate agreement and agrees not to disclose information about members to anyone without MTM’s written consent, apart from internal use needed to do the work (sections 2.I and 21.B). Send every outside request about a broker rider to the broker’s compliance contact the day it arrives.

When the rider asks for their own records

Riders may inspect and copy what you hold about them in a designated record set, and that set includes billing records (164.501 and 164.524). For a transportation company that means trip and billing history. The deadlines and fees are set by rule:

• Timing. Act within 30 calendar days of receiving the request. A single extension of no more than 30 days is allowed, and only if you send the rider a written reason and a completion date before the first 30 days run out.
• How they ask. You may require written requests if you tell riders so. HHS says you may not require them to come in person or use a portal.
• Format. Provide the format they ask for if you can readily produce it, including an electronic copy of electronic records.
• Fees. Charge only for copying labor, supplies, postage, and an agreed summary. For electronic copies of electronic records, HHS treats a $6.50 flat charge as one option, not a cap.
• What is excluded. Information compiled in reasonable anticipation of a lawsuit or other proceeding is outside the right of access. Denials must be in writing.

Missing the deadline draws enforcement. HHS’s Office for Civil Rights announced its 55th Right of Access Initiative action on August 27, 2026: Azul Vision paid $50,000 and agreed to two years of monitoring after a patient who asked for records in January 2023 did not receive them until January 2025. What happens after a rider complains is in the guide to a HIPAA complaint investigation.

Riders in addiction treatment: Part 2 records

Records protected by 42 CFR Part 2, the federal rule for substance use disorder treatment programs, cannot be released on a subpoena alone. If you hold records that reached you from a treatment program with Part 2’s redisclosure notice, a court must first enter a special order under Part 2, and that order does not itself compel anything. A subpoena or similar mandate must also be issued (42 CFR 2.61).

The court’s bar is high. For a case that is not a criminal investigation of the patient, it must find good cause, including that other ways of getting the information are unavailable or would not work, after the patient and the record holder get notice and a chance to respond (2.64). To use the records to investigate or prosecute the patient, the crime must be extremely serious, such as one that causes or directly threatens loss of life or serious bodily injury (2.65). The opioid treatment program guide explains when Part 2 reaches a transportation company in the first place.

Log every release

Every disclosure to police, a court, or a lawyer under these rules belongs in a log, because riders can ask for an accounting of disclosures that reaches back as far as six years (164.528). Each entry needs the date, the recipient’s name and address if known, a brief description of what went out, and the purpose or a copy of the request.

An agency may ask you in writing to hold off listing a disclosure for a stated time when telling the rider would impede its work. An oral request must be written down with the official’s identity and lasts no more than 30 days unless a written one follows. Keep the log and the requests for six years (164.530(j)). Some state laws are stricter than HIPAA and stay in force alongside it (160.203(b)); state privacy laws beyond HIPAA covers the ones that reach NEMT companies.

A front-desk script for records requests

Dispatchers and office staff take most of these calls. A short routine keeps everyone consistent:

1. Do not confirm anything yet, not even whether the person rides with you. Take the requester’s name, agency or firm, phone, and what they want.
2. Ask for the document. “Please email or fax the warrant, order, subpoena, or signed authorization to our privacy officer.”
3. Route it to one person, the privacy officer, the same day.
4. Check the paper against the rules above: who issued it, what it covers, and whether it is a broker rider.
5. Pull only what the document names. Trip dates, times, and addresses for the stated period, not the rider’s whole history.
6. Log the release with the date, recipient, description, and purpose, and file a copy of the request.
7. Call a lawyer when a subpoena or order seems overbroad, involves Part 2 records, or names your company or a driver as a party.

Pulling the right trip records in HealthRide

When a request checks out, HealthRide’s trip log exports that rider’s trips for the dates in the document as a spreadsheet or PDF, with scheduled and actual times, addresses, and GPS-verified miles. Each person sees only what their role allows, so the privacy officer can pull records that a driver cannot, and every change is recorded. The reports page shows the exports.