Minimum necessary: sharing only the rider details each person needs

What the standard requires

The standard covers three actions: using rider information inside your company, disclosing it to someone outside, and requesting it from someone else. For each one, a covered entity or business associate must make reasonable efforts to keep the information to the minimum needed for the purpose (45 CFR 164.502(b)(1)). It is a reasonableness test, not a ban. A driver needs a name, an address, a time, and the mobility details. A diagnosis is rarely needed for the ride.

The standard is one piece of the Privacy Rule. Our HIPAA guide for NEMT providers covers the rest, including how to tell whether your company is a covered entity or a business associate.

When the standard does not apply

The limit is lifted in six situations, set out in 164.502(b)(2):

1. Treatment: disclosures to a health care provider for treatment, and a provider’s own requests for treatment.
2. Disclosures to the individual, such as a pickup reminder sent to the rider.
3. Uses or disclosures under a written authorization the rider signed, as long as you stay within what it covers.
4. Disclosures to HHS during a compliance review or complaint investigation.
5. Uses or disclosures required by law, limited to what that law demands (164.512(a)).
6. Uses or disclosures needed to comply with the HIPAA rules themselves.

Everything else falls under the standard, including invoices to facilities, trip data sent to brokers, and answers to an insurance adjuster.

How a company puts it into practice

Section 164.514(d) turns the principle into specific duties for covered entities. Business associates follow the same logic through their contracts.

• Decide who sees what. List the people or job classes that need rider information, the categories each one needs, and any conditions, then limit access to match (164.514(d)(2)). The user roles guide lays this out job by job.
• Write standard protocols for routine sharing. For disclosures that happen on a schedule, such as the daily driver manifest or a weekly invoice to a facility, a written protocol can set the fields once (164.514(d)(3)(i)). No one has to judge each copy.
• Review one-off requests individually. An insurance adjuster asking for a rider’s past trips needs criteria and a person who checks the request against them (164.514(d)(3)(ii)).
• Ask for less. Requests you make are covered too. When booking a ride home from the hospital, ask the discharge planner for the mobility needs and equipment, not the discharge packet. A whole medical record may not be used, shared, or requested unless the purpose specifically justifies it (164.514(d)(5)).

Examples of too much detail

These examples, each with its fix, show what too much looks like:

• A manifest with a diagnosis column. Replace it with mobility, equipment, and assistance fields. The driver acts on those, not on the condition.
• A group text to every driver about one rider’s behavior. Send it only to the drivers assigned to that rider, through the channel your policy names.
• A broker trip export saved to a shared folder anyone can open. Store it where only scheduling and billing staff have access, and delete it on your retention schedule.

Drivers’ everyday habits, such as covering screens and keeping names off the radio, are covered in HIPAA for NEMT drivers. Your privacy officer owns the written protocols.

In HealthRide, which is HIPAA compliant, you give each team member a role in the provider portal, and the role decides what that person can see, the same access limit 164.514(d)(2) asks you to set.