Should a driver report to the office or to the agency?

Both, and the agency call comes first. In many states the legal duty belongs to the person who has the suspicion, so telling a supervisor does not discharge it. Laws in 17 states say so outright, whatever the employer's own policy says. In Texas, for example, a professional may not hand the job to someone else or count on another person to make the report (Family Code 261.101(b)). The policy has the driver call the agency, then the office the same day.

What happens if a driver reports and turns out to be wrong?

The policy promises protection for a report made in good faith, even when the agency finds nothing. The Child Welfare Information Gateway calls a report a request for an investigation and assessment to find out whether help is needed, not an accusation. Texas, as one example, shields a good-faith reporter from civil and criminal liability, but not one who acts in bad faith or with a malicious purpose (Family Code 261.106). A driver who stays silent for lack of proof leaves the question unasked.

What if my broker wants the report faster than the state does?

The shortest clock wins, so put each one in the policy table. MTM's Rhode Island handbook treats sexual harassment or misconduct, physical assault, injuries, and incidents needing police as Tier 1, which means a phone call to MTM immediately and a written report within 24 hours, and it charges $500 for missing any reporting timeframe. Modivcare's 2025 provider training says abuse, neglect, and exploitation are critical incidents that must be reported immediately.

Where do I find the number for an adult rider?

Use the National Adult Protective Services Association list of each state's reporting contact, and call the state where the rider lives, since NAPSA says reports go to the state or territory of residence. Some states split the line by age: Louisiana separates adults 18 to 59 from those 60 and older, and Massachusetts and Rhode Island also divide by age. NAPSA does not take reports itself. For a child, the Childhelp National Child Abuse Hotline at 1-800-422-4453 can refer a caller.

Do we tell the rider's family or caregiver that we made a report?

A driver does not, and the policy keeps the reporter's name from the family and the caregiver. For an adult rider, HIPAA requires the company to promptly tell the rider that a report was made, unless that would put the rider at risk of serious harm, and it need not tell a personal representative it believes is responsible for the abuse (45 CFR 164.512(c)(2)). The company decides who gives that notice and how, and a driver never does.

Does HIPAA stop a driver from giving the agency a rider's details?

No. A covered entity may disclose protected health information to a public health or other government authority authorized by law to receive child abuse or neglect reports (45 CFR 164.512(b)(1)(ii)). For adults, it may disclose to a protective services agency when the law requires it, when the rider agrees, or when a statute authorizes it and the company believes it is necessary to prevent serious harm (164.512(c)(1)). Give the agency what it asks for and nothing more.

Is a written policy required for NEMT?

Not for every company. What applies to yours comes from your state's reporting law, your broker contracts, and any waiver program you serve. MTM Health's Virginia handbook lists mandatory reporter training among the courses drivers must finish before carrying members, and under the federal Medicaid rule for waiver services, states must require providers to report critical incidents, including abuse, neglect, and exploitation, within state-set timeframes (42 CFR 441.302(a)(6)).

Abuse and neglect reporting policy template for NEMT companies: what drivers report, to whom, and how fast

Updated October 6, 20268 min read

Overview

An abuse and neglect reporting policy tells drivers and staff to report any reasonable suspicion that a rider is being harmed, to call 911 first when someone is in danger, then the state child or adult protective services line, then the broker and the office, in that order and without investigating on their own. It names who is protected from retaliation and leaves blanks for your state hotlines.

On this page

What should an abuse and neglect reporting policy cover?

It should tell every driver and staff member what to report, who to call in what order, what never to do, how to write it down, and who is protected for speaking up. This page is the document itself, with blanks for your state’s hotlines and your brokers’ clocks. The reasoning behind it sits elsewhere: the rider abuse prevention guide covers screening, conduct rules, and the controls for a driver alone with a rider, and the mandated reporter entry explains who the law makes a reporter. Adopt the policy, train on it, and have each person sign it.

The policy

Fill in the brackets, print it, and keep the signed copies in each person’s file.

[Company name] abuse and neglect reporting policy

Effective [date]. This policy applies to every driver, attendant, dispatcher, and office employee, and to any contractor who drives for us.

1. Why we have this policy. Our drivers see riders at their door and in the van, trip after trip, and are well placed to notice a change. Reporting a concern is a request for an investigation to find out whether help is needed, not an accusation. We expect everyone covered by this policy to speak up, and we will protect anyone who does.

2. What you report. Any reasonable suspicion that a rider, child or adult, is being abused, neglected, or exploited, by anyone: a caregiver, a relative, facility staff, another rider, or one of our own people. You do not need proof.

Abuse is physical, sexual, or emotional harm done to a person.
Neglect is a caregiver failing to provide food, clothing, shelter, medical care, or supervision. An adult who cannot look after themselves is also a concern, which the law calls self-neglect.
Exploitation is using a person’s money or belongings for someone else’s gain.

3. What to watch for. One sign alone proves nothing. Pay attention when signs repeat or appear together.

A child: injuries nobody explains; saying no one is home to care for them; being reluctant to be near a particular person; a sudden change in behavior; no help for a known medical problem; clothing that does not fit the weather; an adult whose explanation of an injury does not match it.
An adult: injuries that do not match the explanation; a caregiver who answers for the rider and does not let the rider speak; a caregiver unusually interested in how much money is spent; belongings that go missing; no help with eating, bathing, or walking; unclean or neglected appearance; fear or cowering around one person.

4. If someone is in danger right now. Call 911 first. Then call dispatch at [phone]. Do not leave a rider who is hurt or in danger alone.

5. Who you call after that. Make the calls that apply, from the top of the table down. The report to the state agency is yours to make. Do not wait for the office to do it.

Call	Number	When
911	911	At once, if anyone is in danger
State child abuse hotline or local child protective services (rider under 18)	[__]	Immediately, or by [state deadline]
State adult protective services (rider 18 or older). Use the state where the rider lives. Some states split by age.	[__ / __]	Immediately, or by [state deadline]
The rider’s broker or program	[__]	Within [broker deadline]
Our office: [name]	[__]	The same day, as soon as the agency call is done

6. What you say when you call. Have this ready, and give what you have. Missing a detail is no reason to wait.

The rider’s name, approximate age, and address or the place where you saw the rider.
Whether anyone is hurt or in danger right now.
What you saw and heard, in plain words, with dates and times. Leave out conclusions.
The names of the caregiver and anyone else in the home or at the facility, if you know them.
The person you suspect, if you know the name, and anyone else who knows about it.
The rider’s doctor, if you know it, and your own name and phone number.

7. What you do not do. Do not press the rider for details, examine the rider, or search belongings. Do not confront a caregiver, relative, facility, or coworker. Do not promise the rider to keep it secret. Do not investigate on your own. Do not discuss the report with anyone except the agency, our office, the broker, and the people they send. Do not post about it anywhere.

8. Write it down the same day. Use our incident report form: trip number, date and times, what you saw and heard, who you told and when, and any reference number the agency gave. The report goes in the incident file, which only [roles] can open.

9. If you report in good faith, you are protected. No one is disciplined, scheduled differently, or treated worse for a report made in good faith, even if the agency finds nothing. We do not tell the rider’s family or caregiver who made the report. Anyone who retaliates faces discipline under [handbook section].

10. If the concern is about one of our own people. Report it the same way, and also tell [owner or compliance lead] at once. We will take the person off rider contact the same day, assign someone else to the rider’s trips, tell the broker within its clock, keep the trip records and messages, and let investigators lead.

11. Rider privacy. Share only what the agency needs. HIPAA permits reports of abuse and neglect to the right agencies, and our privacy official [name] decides anything beyond that.

12. Training. Everyone covered by this policy is trained on it when they start and every [12] months. Training records go in the training log.

	Name	Signature	Date
Employee
Manager

Which clock applies to a report?

The state sets the first clock and each broker sets another, so list the shortest in the table. Three examples show how far they differ:

State law, Texas. Besides the duty everyone has to report at once, a professional has a fixed clock: 24 hours from the first reasonable cause to believe a child was or may be abused or neglected, and the report cannot be delegated (Family Code 261.101(b)). The statute defines a professional as a person licensed or certified by the state, or an employee of a facility licensed, certified, or operated by the state, who has direct contact with children. Your own state’s rules are explained on the mandated reporter page.
MTM, Rhode Island. Tier 1 incidents include sexual harassment or misconduct, physical assault, injuries, and incidents that need police or EMS. They go to MTM by phone immediately, then in writing within 24 hours, with a copy of the police report, when there is one, within five business days. Missing any timeframe costs the provider $500 (handbook last updated July 1, 2026).
Modivcare. Its 2025 provider training says abuse, neglect, and exploitation are critical incidents, all reported immediately, and a provider who suspects it, or hears it from a member, reports to its assigned Provider Relations contact.

Waiver programs add a third clock. Under 42 CFR 441.302(a)(6), a state must run an incident management system that defines critical incidents to include verbal, physical, sexual, psychological, or emotional abuse, neglect, and exploitation, and must require providers to report them within state-established timeframes. The rule applies to services authorized under a section 1915(c) waiver, and states must comply starting July 9, 2027. If you carry waiver riders, get the incident deadline from your state’s waiver agency and put it in the table.

What does HIPAA allow when a driver reports?

It allows the report, in two separate rules. For child abuse or neglect, a covered entity may disclose protected health information to a public health or other government authority that is authorized by law to receive those reports (45 CFR 164.512(b)(1)(ii)). For adults, it may disclose to a government authority, including a protective services agency, when the law requires it, when the rider agrees, or when a statute authorizes the disclosure and the company believes it is necessary to prevent serious harm (164.512(c)(1)).

For adult reports, HIPAA adds a duty to promptly tell the rider that the report was or will be made, except when that would put the rider at risk of serious harm, or when the company would be telling a personal representative it believes is responsible (164.512(c)(2)). That is why clause 9 keeps the notice with the company and not with the driver. The HIPAA guide for drivers covers the everyday rules.

What protects a driver who reports?

Three layers help, and none is complete. Check each against your state.

Immunity. Texas protects a person who reports child abuse or neglect in good faith from civil and criminal liability, but not someone who reports their own abuse of a child or acts in bad faith or with a malicious purpose (Family Code 261.106).
Retaliation. Texas also bars an employer from firing or otherwise penalizing a “professional” who reports in good faith (261.110), and the definition of professional covers people licensed or certified by the state and employees of facilities the state licenses, certifies, or runs who deal directly with children. A private van driver may fall outside it, which is why the policy promises protection in clause 9 and does not rely on the statute. The Child Welfare Information Gateway survey, current through May 2023, counts 17 states that expressly bar an employer from retaliating against an employee who made a child abuse report, so check whether yours is one.
Confidentiality. In Texas, a reporter’s identity is confidential unless the reporter waives it in writing, with narrow exceptions such as a criminal investigation (261.101(d)). Other states have their own rules, and clause 9 promises the same by policy.

Keeping the facts of the trip ready in HealthRide

The call sheet in clause 6 asks for dates, times, and the driver’s trip. Each trip in HealthRide keeps its timestamps, signatures, and GPS-recorded miles, so the office can pull those facts from the record and does not rebuild them from memory. Access follows each person’s role, and every change is recorded. The live map shows where each vehicle is.

Frequently asked questions

Should a driver report to the office or to the agency?: Both, and the agency call comes first. In many states the legal duty belongs to the person who has the suspicion, so telling a supervisor does not discharge it. Laws in 17 states say so outright, whatever the employer's own policy says. In Texas, for example, a professional may not hand the job to someone else or count on another person to make the report (Family Code 261.101(b)). The policy has the driver call the agency, then the office the same day.
What happens if a driver reports and turns out to be wrong?: The policy promises protection for a report made in good faith, even when the agency finds nothing. The Child Welfare Information Gateway calls a report a request for an investigation and assessment to find out whether help is needed, not an accusation. Texas, as one example, shields a good-faith reporter from civil and criminal liability, but not one who acts in bad faith or with a malicious purpose (Family Code 261.106). A driver who stays silent for lack of proof leaves the question unasked.
What if my broker wants the report faster than the state does?: The shortest clock wins, so put each one in the policy table. MTM's Rhode Island handbook treats sexual harassment or misconduct, physical assault, injuries, and incidents needing police as Tier 1, which means a phone call to MTM immediately and a written report within 24 hours, and it charges $500 for missing any reporting timeframe. Modivcare's 2025 provider training says abuse, neglect, and exploitation are critical incidents that must be reported immediately.
Where do I find the number for an adult rider?: Use the National Adult Protective Services Association list of each state's reporting contact, and call the state where the rider lives, since NAPSA says reports go to the state or territory of residence. Some states split the line by age: Louisiana separates adults 18 to 59 from those 60 and older, and Massachusetts and Rhode Island also divide by age. NAPSA does not take reports itself. For a child, the Childhelp National Child Abuse Hotline at 1-800-422-4453 can refer a caller.
Do we tell the rider's family or caregiver that we made a report?: A driver does not, and the policy keeps the reporter's name from the family and the caregiver. For an adult rider, HIPAA requires the company to promptly tell the rider that a report was made, unless that would put the rider at risk of serious harm, and it need not tell a personal representative it believes is responsible for the abuse (45 CFR 164.512(c)(2)). The company decides who gives that notice and how, and a driver never does.
Does HIPAA stop a driver from giving the agency a rider's details?: No. A covered entity may disclose protected health information to a public health or other government authority authorized by law to receive child abuse or neglect reports (45 CFR 164.512(b)(1)(ii)). For adults, it may disclose to a protective services agency when the law requires it, when the rider agrees, or when a statute authorizes it and the company believes it is necessary to prevent serious harm (164.512(c)(1)). Give the agency what it asks for and nothing more.
Is a written policy required for NEMT?: Not for every company. What applies to yours comes from your state's reporting law, your broker contracts, and any waiver program you serve. MTM Health's Virginia handbook lists mandatory reporter training among the courses drivers must finish before carrying members, and under the federal Medicaid rule for waiver services, states must require providers to report critical incidents, including abuse, neglect, and exploitation, within state-set timeframes (42 CFR 441.302(a)(6)).