HIPAA quiz for NEMT drivers and office staff: 20 questions with answers and the rule behind each

How do you give the quiz?

Give it at the end of your HIPAA training session, closed book, in about 20 minutes. Then grade it with each person, talk through every miss, and sign the score sheet at the bottom. The questions below describe common moments on a ride day, and the answer key names the section of the HIPAA rules behind each one. The HIPAA guide for NEMT drivers explains the habits, and the HIPAA guide for NEMT providers explains whether your company is a covered entity or a business associate of a broker.

1. Hand out the quiz and the score sheet. Staff write their name and the date, and answer each question with one letter.
2. Grade it together. Read the answer and the rule aloud. A wrong answer is a training topic, not a mark against the person.
3. Set your pass line. HIPAA sets none. Eighteen of 20 with every miss reviewed is a sensible choice.
4. Sign and file. The sheet becomes part of the person’s training record.

The answers cite the Privacy Rule as it binds a covered entity. A company that is a business associate of a broker follows the same practices through its business associate agreement.

The quiz

1. A man phones the office: “I’m Mrs. Alvarez’s son. Where is she going today, and when does her ride end?” He is not on her contact list.

• A. Give him the clinic name and the pickup time, because he is family.
• B. Share the pickup time only.
• C. Take his name and number, share nothing, and ask Mrs. Alvarez whether she wants him told.

2. At 6 a.m. the office texts tomorrow’s whole list (names, addresses, appointment times) to a driver’s personal number so everyone sees it at once.

• A. Fine, it saves time.
• B. Not fine: each driver gets only their own trips, through the company’s approved app.
• C. Fine, if the driver deletes it afterward.

3. A driver posts a picture of a smiling rider beside the van on the company page. No name is shown.

• A. Not allowed without the rider’s signed authorization.
• B. Allowed, because there is no name.
• C. Allowed, if the rider said yes out loud.

4. A uniformed officer asks the dispatcher which clinic a rider was dropped at yesterday.

• A. Tell him, because he is the police.
• B. Tell him the neighborhood only.
• C. Take his name and badge number, and bring in the privacy official.

5. A driver loses a phone with the driver app on the way home and plans to look for it over the weekend before telling anyone.

• A. Tell the privacy official now.
• B. Wait and see if it turns up.
• C. Tell dispatch on Monday.

6. After a trip, the driver finds a rider’s medication list on the seat.

• A. Throw it away.
• B. Leave it for the rider’s next trip.
• C. Keep it safe, tell the office, and let the office log it and return it.

7. A rider in the back seat asks, “Who was the woman in here before me? Where did you take her?”

• A. “I can’t talk about other riders.”
• B. “A dialysis patient from the east side.”
• C. Describe her without giving a name.

8. The front desk at a clinic phones to ask when a rider will arrive.

• A. Refuse, because HIPAA bars talking to clinics.
• B. Give the arrival time and what the trip needs, such as a wheelchair.
• C. Read out the rider’s whole trip history.

9. A dispatcher looks up a neighbor’s trips because she heard the neighbor is sick.

• A. Allowed, because she has access to the system.
• B. Allowed, if she tells nobody.
• C. Not allowed: access is for the work in front of you, and it can bring a sanction.

10. A rider asks the driver not to tell her family she goes to the cancer center.

• A. Promise, and forget about it.
• B. Say “I’ll note that,” say nothing to family, and tell the privacy official the same day.
• C. Say the family has a right to know.

11. A rider says she needs a list of her past trips for an insurance reimbursement.

• A. Send her to the privacy official, who has 30 days to act.
• B. Refuse, because trip data is private.
• C. Hand over the driver’s own notes.

12. A fax from a law firm demands a rider’s trip records under a subpoena signed by an attorney.

• A. Send the records the same day.
• B. Ignore it.
• C. Give it unread to the privacy official, and release nothing until it checks out.

13. A dispatcher texts a rider’s pickup time and address to the wrong phone number.

• A. Do nothing, it was an honest mistake.
• B. Delete the text from your own phone.
• C. Tell the privacy official right away, and ask the person who got it to delete it.

14. Yesterday’s manifests are torn in half and tossed in the dumpster behind the office.

• A. Fine, they are torn.
• B. Not fine: shred them, or hand them to a shredding service.
• C. Fine, if the dumpster is locked.

15. A driver paid on a 1099 says HIPAA training is for employees.

• A. Wrong: a person whose work you direct is part of your workforce, paid or not, and takes the training.
• B. Right, because contractors are not employees.
• C. Right, unless the driver works more than 20 hours a week.

16. A new answering service wants tomorrow’s rider list to handle after-hours calls.

• A. Send it today, because they are professionals.
• B. Send names only.
• C. Sign a written business associate agreement first.

17. A rider’s daughter writes a glowing review online, and the owner wants to reply: “We loved driving your mom to her chemo visits.”

• A. Fine, because the review is positive.
• B. Not fine: thank her without confirming that anyone rode with you, and give no trip details.
• C. Fine, because the daughter wrote first.

18. A driver props a phone on the dash with message previews turned on, and the front-seat rider can read the next rider’s name.

• A. Turn previews off, and lock the screen when the phone is not in use.
• B. Normal, because the volume is off.
• C. Normal, because the rider is not a patient.

19. A rider complains that a driver talked about her appointment in front of other riders. The owner is annoyed and tells dispatch to give her the last pickup slot every day from now on.

• A. Allowed, because the owner decides the schedule.
• B. Allowed, if the slot is still within the window.
• C. Not allowed: the company may not retaliate against a rider for complaining.

20. When must a new driver finish HIPAA training?

• A. Within the first year.
• B. Within a reasonable time after joining, and many brokers want it before the first trip.
• C. Only when the company changes its policy.

Answers and the rule behind each

1. C. A company may share with a relative only what bears on that person’s involvement in the rider’s care or payment, and while the rider can be asked, only with her agreement or without her objection (45 CFR 164.510(b)(1) and (2)). A caller who is not on her list gets nothing until she says so. Many companies share only with people the rider named, and the family members guide covers the cases.

2. B. A company must limit its uses and disclosures of rider information to the minimum necessary, and it must limit each role’s access to what the job needs (164.502(b) and 164.514(d)(2)). A list of every rider on a personal phone also sits outside company controls, which the Security Rule’s transmission security standard addresses (164.312(e)(1)).

3. A. A full-face photograph is one of the identifiers that must be removed before information counts as de-identified (164.514(b)(2)(i)(Q)), so a picture can identify a rider even with no name. Posting it tells the public that this person uses your service, and a company needs a signed authorization for any use or disclosure the rule does not otherwise permit (164.508(a)(1)), marketing included (164.508(a)(3)). A photo release form comes first.

4. C. Without a warrant, court order, or subpoena, police can be given only a short identifying list when they are looking for a suspect, fugitive, material witness, or missing person: the person’s name and address, birth date and birthplace, Social Security number, blood type, type of injury, when the person was treated or died, and a physical description (164.512(f)(2)). A drop-off place is not on it. Any other request needs a court order, a warrant or subpoena issued by a judge, a grand jury subpoena, or an administrative request that meets the rule’s three tests (164.512(f)(1)(ii)). The police and subpoena guide goes further.

5. A. The clock for a breach starts on the first day anyone on staff other than the person responsible knows of it, or would have known by looking with reasonable care (164.404(a)(2)). Notice to affected riders is due without unreasonable delay and within 60 calendar days after discovery (164.404(b)). A phone reported at once can be locked, and the risk assessment can start.

6. C. A company must have administrative, technical, and physical safeguards for rider information (164.530(c)(1)), and a medication list left on a seat is open to the next passenger. Securing it and passing it to the office keeps it from being read, and the office’s log shows what happened to it.

7. A. A company may use or disclose rider information only as the rule permits (164.502(a)). An incidental disclosure is excused only when it results from a permitted use and the company has applied minimum necessary and reasonable safeguards (164.502(a)(1)(iii)). Answering a curious rider is not that, and a description can identify someone as surely as a name.

8. B. The clinic is part of the rider’s care, and a covered entity may disclose information for the treatment activities of a health care provider (164.506(c)(2)). The minimum necessary limit does not apply to disclosures to a provider for treatment (164.502(b)(2)(i)), but company policy should still keep the answer to what the trip needs: the arrival time, the mobility device, and any escort.

9. C. Staff access is tied to the job, and a company must apply appropriate sanctions to workforce members who break its privacy policies and document the sanction it applies (164.530(e)(1) and (2)). Curiosity about a neighbor is the standard example, and a documented sanction shows the company took it seriously.

10. B. A rider may ask a company to restrict what it shares with family under the involvement rule (164.522(a)(1)(i)(B)). The company does not have to agree (164.522(a)(1)(ii)), but once it agrees it must honor the restriction (164.522(a)(1)(iii)). The driver should not promise for the company, and should not volunteer anything to family either. The privacy official records the request and the decision.

11. A. A rider’s request for records goes to the privacy official, who must act no later than 30 days after receiving it. One extension of up to 30 days is allowed when the company sends the rider a written statement of the reasons and the date it will finish (164.524(b)(2)).

12. C. Neither a driver nor a dispatcher decides this one. A subpoena that is not accompanied by a court order gets records only after the company receives written assurance that the rider was notified and had time to object, or that a protective order was requested (164.512(e)(1)(ii) to (iv)). A court order allows only what the order expressly authorizes (164.512(e)(1)(i)).

13. C. The rule starts from the assumption that an improper disclosure is a breach. The company overcomes it only with a risk assessment showing a low chance the information was compromised, which weighs what was sent, who got it, whether they actually looked at it, and how far the risk has been reduced (164.402). The company also has to reduce the harm as far as practicable (164.530(f)). That begins with an early report and a request to delete the text.

14. B. A company must reasonably safeguard rider information from unintended disclosure (164.530(c)(2)(i)), and paper in a dumpster can be read by anyone who lifts the lid. Shred it, in the office bin too. For electronic devices and media, the Security Rule requires a policy for final disposal (164.310(d)(2)(i)).

15. A. Workforce means employees, volunteers, trainees, and other persons whose work is under the company’s direct control, whether or not they are paid (160.103). The test is control over the work, and the company trains all of its workforce on its privacy policies (164.530(b)(1)). The 1099 or W-2 guide covers the classification question separately.

16. C. A company may share rider information with a business associate only after it obtains satisfactory assurance, documented in a written contract that meets the content rules (164.502(e)(1) and (2), 164.504(e)). An answering service, a billing company, and an IT provider that handles rider details each need one, and the business associate agreement template gives the clauses.

17. B. Saying that a person rode with you, or giving any trip detail, discloses rider information, and a company may do that only as the rule permits or with a valid authorization (164.502(a) and 164.508(a)(1)). A reply that thanks the writer and gives a phone number says nothing about who rides. The online reviews guide shows wording.

18. A. A company must limit incidental disclosures with reasonable safeguards (164.530(c)(2)(ii)). A name on a screen that a passenger can read is the kind of leak a setting fixes. The driver keeps previews off, and locks the phone whenever it is not in use.

19. C. A covered entity may not intimidate, threaten, coerce, discriminate against, or retaliate against anyone for exercising a Privacy Rule right, including filing a complaint (164.530(g)(1)). It must also give people a way to complain and document each complaint and what came of it (164.530(d)). Assign the rider’s trips the way you would for any other rider, and handle the complaint through the process.

20. B. Each new workforce member must be trained within a reasonable period of joining, and the company must record that the training took place (164.530(b)(2)(i)(B) and (ii)). MTM Health’s Virginia handbook goes further and requires its mandated training, which includes HIPAA, before providing NEMT services. The simplest policy is before the first trip.

How do you file the quiz as a training record?

File the signed score sheet with the person’s training record, because HIPAA requires proof that training was given and the sheet is that proof. A covered entity has to document the training it provides (164.530(b)(2)(ii)) and to keep that documentation for six years, counted from whichever is later, its creation or its last day in effect (164.530(j)(2)). The Security Rule asks for a security awareness and training program for all workforce members, management included (164.308(a)(5)(i)), and keeps its written documentation for six years too (164.316(b)(2)(i)).

Record these on the sheet or next to it: the person’s name and role, the date, the trainer, the topics the session covered, the score, which questions were missed and who reviewed them, and the signature. Add a line to the driver training log the same day so a broker can see the whole roster on one page. Pair it with the confidentiality agreement, signed at the end of the same session.

Repeat the training, and the quiz, when a policy change affects someone’s job. The rule calls for it within a reasonable period after a material change (164.530(b)(2)(i)(C)). When an incident teaches something new, swap one of the 20 questions for it, keeping the rider’s name out.

Rider details stay off the lock screen in HealthRide

Several of these questions come down to what a phone shows. In HealthRide, rider details stay off phone lock screens, each person’s role decides what they can open, and every change is recorded. HealthRide is HIPAA compliant. The driver app page shows what drivers see.