Which compliance tasks does a NEMT company have to do every month?

Two are near universal. Screen owners, staff, and contractors against the federal and state exclusion lists, which OIG recommends monthly and states such as Georgia and Pennsylvania require. Check which driver and vehicle credentials expire in the next 60 days, because brokers such as MTM Health can withhold payment for trips run with an expired credential. Add any monthly report your broker contract names.

How often should a driver's motor vehicle record be pulled again?

Once a year is the usual floor. Motor carriers must request and review the driving record of each commercial vehicle driver they employ at least once every 12 months, and Modivcare tells its out-of-network providers to collect a yearly motor vehicle report for each driver. Some brokers and states ask for it more often, so follow the shortest cycle in your contracts.

How often does Medicaid revalidate a transportation provider?

Federal rules give every state Medicaid agency a five-year maximum between revalidations for each provider, and a state may choose a shorter cycle. States also collect an enrollment application fee from organizations at revalidation, unless the company paid that fee to Medicare or another state already; for applications filed in calendar year 2026 the fee is $750. Put the due date on this calendar the day your enrollment is approved.

Do companies with only a few employees have to post the OSHA 300A summary?

Only if the company has to keep OSHA injury and illness records. If you had no more than 10 employees at any point in the last calendar year, the recordkeeping rule mostly does not apply. Reporting still does: OSHA must hear about a worker's death from a work incident within 8 hours, and about an inpatient hospital stay, an amputation, or the loss of an eye within 24 hours. Companies that keep the records post the 300A from February 1 through April 30.

Do I need Unified Carrier Registration?

Only if you carry paying passengers across state lines. Registration for 2027 opens October 1, 2026, and under an FMCSA rule effective that day the 2027 fee for a carrier with 0 to 2 commercial vehicles is $55. Running only vans that seat 10 or fewer, driver included, does not remove the duty to register; it only affects the fee. A company that stays within one state generally does not register, although federal law lets a state apply the agreement to its intrastate carriers.

Who should own the compliance calendar?

One named person, usually the compliance contact. OIG's guidance for small providers suggests naming a compliance contact who, whenever possible, stays out of billing and claims, and who updates the owner on compliance work at least once a quarter. That quarterly report is a good moment to walk through this calendar line by line.

NEMT Compliance Calendar Template (2026)

How to set it up

Fill this calendar in once, at the start of the year, and give it one owner. In a small company that is usually the compliance contact. That person opens it on the first business day of each month and hands out whatever falls due within 60 days.

Copy every table below into your own file. Delete rows that do not apply to you, such as UCR for a company that never crosses a state line.
Add the dates only you know. Policy renewals, license expirations, contract end dates, and each driver’s and vehicle’s anniversaries.
Keep the “Source” column. It shows which items are law, which are federal guidance, and which come from a broker contract. When two sources set different cycles for the same task, use the shorter one.
Mark each item done with the date and initials. Brokers and auditors ask for proof, and a dated calendar with the records behind it is proof that the program runs.

The program this calendar supports is laid out in our guide to setting up a NEMT compliance program.

Every month

Task	Due	Source
Screen owners, managers, staff, and contractors against the LEIE, SAM.gov, and each applicable state exclusion list	Same day each month, after mid-month	OIG recommends monthly screening because it updates the LEIE monthly; Georgia and Pennsylvania require monthly checks; Modivcare asks out-of-network providers for them monthly
Pull a list of driver and vehicle credentials that lapse within 60 days, and schedule each renewal	First business day	MTM Health’s Virginia fee-for-service handbook (trips from October 1, 2026): training has to be completed before a credential lapses, and trips run by drivers with lapsed documents risk going unpaid
Review open claim denials and deadlines	Weekly, with a monthly tally	Payer filing and appeal windows (see the claim denial log)
Broker monthly reports or attestations named in your contracts	Per contract	Your broker agreements

Keep the screening results in the exclusion screening log.

Every quarter

Task	Due	Source
Compliance contact reports to the owner on compliance work, findings, and open items	End of each quarter	OIG’s guidance for small entities: at least quarterly
File Form 941 (payroll taxes for the quarter)	Last day of the month after the quarter ends: April 30, July 31, October 31, January 31	IRS Publication 509
Walk through this calendar and update next quarter’s dates	With the quarterly report	Good practice

Every year, on a fixed date

Date	Task	Who it applies to
February 1, 2027 (moved from January 31, a Sunday)	File Form 1099-NEC with the IRS and give a copy to every contractor who received $2,000 or more from you for work done in 2026	Anyone paying contractors, such as independent drivers
February 1, 2027	Hand out 2026 Forms W-2 to employees and send Copy A with Form W-3 to the SSA	All employers
February 1 to April 30	Post the OSHA 300A summary of last year’s work injuries and illnesses	Employers that must keep OSHA records (more than 10 employees at some point last year)
March 1, 2027	Report to HHS any breaches of unsecured rider data discovered in 2026 that affected fewer than 500 people (due 60 days after the year ends)	HIPAA covered entities
March 2	Submit last year’s 300A data to OSHA electronically; establishments with 100 or more employees in the industries on a second OSHA list, which also includes NAICS 4859, send Form 300 and 301 data too	Establishments with 20 to 249 employees in listed industries, which include Other Transit and Ground Passenger Transportation (NAICS 4859), and any establishment with 250 or more employees that keeps OSHA records
October 1	Registration for the next UCR year opens; for 2027 that is October 1, 2026	Interstate for-hire passenger carriers
(your dates)	Auto, general liability, and workers’ compensation renewals; send new certificates to each broker	Everyone
(your dates)	Broker contract renewals and recredentialing	Everyone with broker work

Tax deadlines that land on a Saturday, Sunday, or legal holiday move to the next business day. Check IRS Publication 509 for the exact year.

Every year, on each person’s or vehicle’s date

These run on anniversaries, not a single date. Track them per driver and per van.

Task	Cycle	Source
Pull and review each driver’s motor vehicle record	At least every 12 months	Federal rule for drivers of commercial motor vehicles (49 CFR 391.25); Modivcare asks for a yearly driving history from out-of-network providers
Criminal background or drug-law check	Yearly, or as state law requires	Modivcare out-of-network credentialing reminder
Compliance training, including fraud, waste, and abuse and HIPAA privacy and security	At least yearly	OIG guidance calls for yearly compliance training; MTM Health’s Virginia handbook requires fraud, waste, and abuse training before the first trip and yearly after, in a module that also covers HIPAA
Bloodborne pathogens training for employees with occupational exposure, for example drivers assigned to clean up body fluids	Within one year of the last session	29 CFR 1910.1030
Periodic inspection of vehicles that meet the federal commercial vehicle definition	At least every 12 months, with proof on the vehicle	49 CFR 396.17
Company compliance risk assessment and at least one audit	At least yearly	OIG’s guidance for small entities
Review written policies and procedures	At least yearly	OIG guidance
Review the HIPAA risk analysis	Yearly or as needed (HHS gives every three years as one example), and after a major change	HHS risk analysis guidance; see the HIPAA risk analysis template

Some brokers inspect more often. Under MTM Health’s Virginia handbook, a vehicle passes inspection before its first member trip and is inspected again twice a year. Keep the results with your vehicle inspection checklist records.

Every two years or longer

Task	Cycle	Source
PASS driver certification	Good for two years; CTAA gives a 90-day window after expiry to recertify	CTAA PASS Program Handbook
First aid and CPR cards	Per the card’s expiration date	Your broker or state
MCS-150 update of your USDOT registration	Every 24 months, in the month set by the last digit of your USDOT number; odd or even year set by the next-to-last digit	49 CFR 390.19T (interstate carriers)
Medicaid revalidation	No more than 5 years apart, or sooner if the state sets a shorter cycle. Unless Medicare or another state already collected it, the 2026 application fee is $750	42 CFR 455.414, 42 CFR 455.460

Revalidation cycles differ by state, and a missed one can end your enrollment. Our guide to Medicaid revalidation compares state schedules.

Deadlines that start when something happens

These have no calendar date. Keep the list where the office can see it.

When this happens	Do this	Deadline	Source
You hire someone	Examine the new employee’s documents and fill in the employer section (section 2) of Form I-9	By the third business day after work starts	8 CFR 274a.2
You hire someone	Report the new hire to the state	No later than 20 days after hire (states can set less)	42 U.S.C. 653a
You hire someone	Run exclusion checks and add them to your credential tracking	Before the first shift	OIG exclusion guidance; broker contracts
Your NPI details change (address, name, taxonomy)	Update the NPI record	Within 30 days of the change, for covered health care providers	45 CFR 162.410
Ownership changes	Send Medicaid the ownership disclosures	Within 35 days of the change	42 CFR 455.104
An employee dies from a work-related incident	Report to OSHA	Within 8 hours	29 CFR 1904.39
A work incident puts an employee in the hospital as an inpatient, or causes an amputation or the loss of an eye	Report to OSHA	Within 24 hours	29 CFR 1904.39
You discover a breach of unsecured rider data	Notify affected people	Within 60 calendar days of discovery	45 CFR 164.404
You find you were overpaid by Medicaid or Medicare	Report and return it with a written reason	Within 60 days after it is identified	42 U.S.C. 1320a-7k(d)

Your state and broker dates

Federal dates are the same everywhere. The rest depends on your state, city, and contracts. Add a row for each of these that applies:

Task	Due	Source	Owner	Done
State NEMT license or permit renewal
State vehicle inspections and registrations
Local taxi, livery, or for-hire permits
Business entity annual report with the Secretary of State
Broker vehicle inspections
Broker driver training renewals
Broker attestations and recredentialing

The requirements for your state are in its state guide, and the documents behind each driver row are listed in our driver file checklist.

Letting the per-driver dates run themselves

The anniversary rows are the ones that slip. HealthRide stores each driver’s and each van’s credentials with their expiration dates, reminds you before one runs out, and flags an expired one when a dispatcher assigns that driver or vehicle. Drivers complete their vehicle inspection in the app when a shift begins. More on fleet and credential tracking.

Compliance calendar for NEMT companies: every recurring check and renewal on one page