State privacy laws stricter than HIPAA that reach NEMT companies

HIPAA sets the minimum for rider privacy, not the maximum. A state law that protects health information more strictly keeps working alongside it, so a NEMT company answers to both. Four kinds of state law go furthest past HIPAA for transportation companies: Texas’s medical records privacy chapter, California’s Confidentiality of Medical Information Act, Washington’s law on consumer health data, and state breach notice laws with deadlines shorter than HIPAA’s 60 days.

This guide covers each one and how to fold them into a single privacy program. The federal baseline (who HIPAA covers, risk analysis, business associate agreements) is in our HIPAA guide for NEMT providers, and handling an actual incident is covered in cybersecurity for NEMT companies. Nothing here replaces advice from a lawyer licensed in your state.

How HIPAA decides which law wins

A state law survives when it is about the privacy of health information and is more stringent than HIPAA’s Privacy Rule. That is the exception in 45 CFR 160.203(b). Any other state law that conflicts with HIPAA gives way.

45 CFR 160.202 spells out what “more stringent” means. A state law qualifies if it does any of these:

• Restricts a use or disclosure that HIPAA would allow.
• Gives patients broader rights to see or amend their records.
• Requires more information to be given to patients about uses, disclosures, and their rights.
• Narrows or shortens what a patient’s permission covers, or makes it harder to pressure someone into giving it.
• Requires longer or more detailed records of disclosures.
• Otherwise gives patients greater privacy protection.

Brokers teach the same rule. Modivcare’s 2025 provider compliance training tells transportation providers that HIPAA gives way to state law offering greater protection, and that providers must follow whichever law is stricter. Breach notice laws work the same way in practice. Colorado’s attorney general, answering businesses regulated by HIPAA, says that when two laws set different notice timeframes, the shorter one applies.

Texas: a wider net, a training clock, and Medicaid at stake

Texas reaches almost every NEMT company in the state, whether or not HIPAA does. Health and Safety Code 181.001 defines a covered entity as anyone who, for gain or on a nonprofit basis, collects, uses, stores, or transmits protected health information. The definition also names business associates, any person who simply ends up holding that information, and the employees, agents, and contractors of all of them. A company holding manifests and trip logs is inside it.

The chapter then adds duties HIPAA does not have:

• Training within 90 days. Every employee must be trained on state and federal privacy law as their job requires, within 90 days of hire (181.101). Each one signs a statement, written or electronic, confirming completion, and you keep it until the sixth anniversary of the signature. A material change in privacy law that affects someone’s duties triggers new training within one year. HIPAA itself sets no deadline beyond “a reasonable period.”
• A posted notice about electronic disclosure. If rider information can be disclosed electronically, you must give notice, for example by posting it at your place of business or on your website (181.154(a)).
• Authorization for each electronic disclosure. Electronic disclosure needs the person’s separate authorization each time, unless it goes to another covered entity for treatment, payment, or health care operations, or another law allows or requires it (181.154(b) and (c)). Sending trip confirmations and claims to a broker or health plan normally fits that exception. Emailing a rider’s details anywhere else needs a closer look.
• Marketing and sale. Marketing with rider information requires clear permission, written or electronic (181.152), and selling it is prohibited outside narrow exceptions (181.153).

The penalties are what make Texas different. Under 181.201 the attorney general can seek up to $5,000 per violation in a year when it was negligent, up to $25,000 when it was knowing or intentional, and up to $250,000 when rider information was used for financial gain. A court that finds a pattern or practice can assess as much as $1.5 million annually. A company licensed by a Texas agency also faces discipline (181.202). And under 181.203, a court finding of a pattern or practice of violations excludes the company from every state-funded health care program, Medicaid included. Licensing, broker regions, and Medicaid enrollment are in our Texas NEMT guide.

California: the CMIA and its $1,000 claims

California’s Confidentiality of Medical Information Act puts a price on carelessness. Civil Code 56.10 bars providers of health care, health plans, and certain contractors from disclosing a patient’s medical information without authorization, apart from listed exceptions. When one of them shares information with your company under an authorization or under the exceptions in 56.10(c), section 56.13 says you may not pass it on without a new authorization, unless the act or another law permits it.

Section 56.36 sets the cost of getting it wrong, and it reaches any “person or entity”:

• Private lawsuits. Someone whose information was negligently released in violation of the act can sue for $1,000 in nominal damages without proving any harm, plus actual damages.
• Negligent disclosure. An administrative fine or civil penalty capped at $2,500 for each violation, whatever the harm.
• Knowing and willful misuse. Up to $25,000 per violation for anyone other than a licensed health care professional, and up to $250,000 per violation when the purpose was financial gain.
• Criminal exposure. A violation that causes a patient economic loss or personal injury is a misdemeanor.

California also tightened its breach law. Since January 1, 2026, Civil Code 1798.82 requires notice to affected residents within 30 calendar days of discovering or being told of a breach, with delays allowed for law enforcement or to find the scope. A HIPAA covered entity that follows the federal content rules satisfies the state’s rules on what the letter must say, but the statute says nothing else is waived, so the 30 days still apply. The California NEMT guide covers the state’s licensing and Medi-Cal rules.

Washington: health data that HIPAA does not cover

Washington’s My Health My Data Act (RCW 19.373) protects “consumer health data,” and its definition fits transportation records closely. It includes precise location information that could reasonably indicate someone’s attempt to get health services, and data that identifies a person seeking health care. Precise location means GPS-level data that places a person within a radius of 1,750 feet. A pickup at a rider’s home and a drop-off at a clinic, recorded by a driver’s phone, fits.

The act does not apply to information that is protected health information under HIPAA (RCW 19.373.100), so trips you run as a broker’s business associate stay under HIPAA alone. It matters for the rest of your book. If your company is not itself a HIPAA covered entity, rides that families and private-pay riders book directly are usually not HIPAA-protected, and the act can reach them. For those riders it requires:

1. A consumer health data privacy policy, with a prominent link on your homepage (19.373.020).
2. Collection only with the rider’s consent for a stated purpose, or as far as needed to provide the ride they asked for (19.373.030).
3. Separate consent before sharing their health data, again unless sharing is needed for the requested ride.
4. Answers to requests to confirm, access, or delete their data, including from backups (19.373.040).
5. A signed authorization before any sale of their data (19.373.070).

One rule applies to everyone, not just regulated businesses: no geofence within 2,000 feet of a place providing in-person health care to track people, collect their health data, or send them health-related ads (19.373.080). Keep that in mind before buying location-targeted ads around dialysis centers or hospitals. Violations are unfair or deceptive acts under the Consumer Protection Act (19.373.090), which lets a person injured in their business or property sue for damages and attorney’s fees (RCW 19.86.090). Washington’s Medicaid transportation setup is covered in our Washington NEMT guide.

Breach deadlines shorter than HIPAA’s 60 days

Several states give you 30 days to notify people about a breach, half of HIPAA’s outer limit. Most state breach laws cover computerized personal information (Washington’s covers data in any form), and most list medical information and health insurance ID numbers as personal information alongside Social Security and driver’s license numbers. Here are the main deadlines in six states.

How each state treats a HIPAA covered entity differs, and the differences decide which clock you are on:

• Colorado. The attorney general’s guidance says the shorter deadline wins, so a HIPAA covered entity still has 30 days for Colorado residents and still owes the attorney general notice at 500.
• California. Following HIPAA’s content rules covers what the letter says, but not the 30-day timing.
• Washington. A covered entity that complies with the federal HITECH breach rules is treated as compliant for health information, but must still notify the attorney general for more than 500 residents, on the federal timeline (RCW 19.255.030).
• New York. A notice sent under HIPAA counts for the individuals, but the state agencies still get theirs, and a covered entity that reports to HHS must also tell the attorney general within five business days of doing so (GBL 899-aa).
• Florida. A notice that follows the breach rules of the company’s “primary or functional federal regulator” is accepted, provided the Department of Legal Affairs receives a copy on time (501.171(4)(g)).
• Texas. Section 521.053 has no HIPAA exception, and a company can notify residents of other states under their own state’s law.

Two more points catch transportation companies. First, driver files are not rider health information, so HIPAA’s breach rule does not cover them, but every one of these states treats a name with a Social Security or driver’s license number as personal information. A stolen, unencrypted laptop holding driver applications can be a state-law breach with a 30-day clock in most of them. Second, a company that only maintains data for someone else, as a business associate does for a broker, must tell the data’s owner quickly: immediately in California, Texas, and Washington, immediately and within 30 days in New York, and within 10 days in Florida. Your broker agreement may be tighter still.

Folding it all into one privacy program

The workable approach is one set of policies built to the strictest rule you face, so staff learn a single routine.

1. List your states. Note where you operate and where your riders and drivers live. Breach laws follow the residence of the people affected.
2. Set the incident deadline at 30 days. Write the shortest notice clock into your response plan, along with the attorney general contacts for each state.
3. Train everyone within 90 days of hire. If you run trips in Texas, the signed completion statement and six-year file are required; elsewhere they cost nothing extra.
4. Post the notices. Texas wants notice of electronic disclosure; Washington wants a consumer health data policy linked on your homepage if you serve private-pay riders there.
5. Protect driver files like rider files. Lock down Social Security and license numbers, because state law treats them as breach-reportable.
6. Check your contracts. A broker’s business associate agreement can set a much shorter clock than any state. WellTrans’s agreement for in-network providers, for example, wants unpermitted disclosures and breaches reported within one business day.

A written HIPAA privacy and security policy is the natural home for these state additions. If something does go wrong, cyber insurance can pay for the notices and legal help these deadlines require.

Where HealthRide fits

HealthRide is HIPAA compliant and signs business associate agreements with its providers. Access follows each person’s role, and HealthRide records every change, which helps when a state gives you 30 days to work out what happened. In the driver app, rider details stay off phone lock screens, and the provider portal gives owners, dispatchers, and billers separate sign-ins.