Notice of privacy practices for NEMT companies: who needs one and a fill-in version

Who has to give riders a notice of privacy practices?

Only if it is a HIPAA covered entity. The duty to give riders a notice sits on covered entities (45 CFR 164.520), and for a transportation company that usually means one thing: it sends a standard transaction, such as a claim, to a health plan electronically (45 CFR 160.103). Using a billing service does not change the answer. CMS’s covered entity decision tool says a provider that has another company, such as a clearinghouse, send its transactions electronically is treated as sending them itself.

A company that runs trips only for brokers and never bills a health plan electronically is normally the broker’s business associate. Business associates do not give notices; the broker’s contract governs what they do with rider data. Many companies do both kinds of work, and HIPAA for NEMT providers shows how to sort out the role for each line of business. The notice also has to match your internal rules, so write it alongside the HIPAA policy template, and name the same complaint contact in both.

The notice, ready to fill in

The text below covers every element of 164.520(b)(1) still in force, with transport examples in place of a doctor’s office. The rule asks for plain language, so keep sentences short when you edit. Brackets are choices or blanks.

Notice of privacy practices: [Company name]

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective date: [date, no earlier than the date this notice is printed or posted]

Questions or complaints: [privacy official’s name or title], [phone], [email]

How we use and share your health information

• For your care. We share what is needed to get you to your appointments with the people providing your care. Example: we confirm your appointment time with your dialysis center so your pickup fits it.
• For payment. We send trip details to Medicaid, to your health plan, or to the broker who booked your ride, so we can be paid. Example: our claim lists the date of your ride, the pickup and drop-off addresses, and the miles driven.
• To run our company. Example: we review trip records to check that drivers arrived on time and to train our staff.
• With family and friends. If you agree, or do not object when you have the chance, we may tell a family member, friend, or caregiver who helps with your care or pays for it what they need to know, such as when you will be home. If you cannot tell us what you want, we may share information when we judge it to be good for you.

Other ways the law lets us share your information without your permission

We must meet the law’s conditions each time. We may share your information:

• when a state or federal law requires it, including with the U.S. Department of Health and Human Services when it checks our compliance;
• for public health and safety, such as reporting suspected abuse, neglect, or domestic violence, or preventing a serious threat to someone’s health or safety;
• with agencies that oversee health programs, such as Medicaid auditors;
• for research that meets the law’s conditions;
• with organ and tissue donation organizations, and with a coroner, medical examiner, or funeral director;
• for workers’ compensation claims, for law enforcement purposes the law allows, and for special government functions such as military and national security;
• in answer to a court or administrative order or a subpoena.

[Keep if you receive records from a federally assisted substance use disorder treatment program.] If we have records about you from a substance use disorder treatment program covered by 42 CFR part 2, we will not use them or hand them over for any civil, criminal, administrative, or legislative case against you unless you consent in writing, or a court orders it after you or the record holder had notice and a chance to be heard. A court order by itself is not enough: a subpoena or another legal demand has to accompany it before we release the records.

[Describe any state law that protects some of your riders’ information more strictly than federal law, such as a state law on mental health or HIV records. Delete this paragraph if none applies.]

When we need your written permission

We need your written permission to use your information for marketing, to sell it, or to share psychotherapy notes. Any use or sharing not described in this notice also needs your written permission. You may take back a permission in writing at any time, though not for anything we already did relying on it.

Your rights

• See or get a copy of your health information, on paper or electronically. We act on your request within 30 days and may charge a reasonable fee based on our cost.
• Ask us to correct information you believe is wrong or incomplete. If we say no, we tell you why in writing within 60 days.
• Ask us to contact you a certain way, such as a different phone number or mailing address. We will agree to reasonable requests.
• Ask us to limit what we use or share. We do not have to agree, with one exception: if you pay for a ride in full yourself, you can ask us not to tell your health plan about it for payment, and we will do so unless a law requires us to share it.
• Get a list of the times we shared your information over the six years before your request, other than for your care, payment, and our operations and a few other cases. The first list in any 12 months is free.
• Get a paper copy of this notice at any time, even if you agreed to get it electronically.
• [Name someone to act for you. A guardian or a person holding your medical power of attorney can use these rights for you.]
• Complain to us using the contact above, or to the federal Office for Civil Rights, by phone at 1-877-696-6775, by mail at 200 Independence Avenue, S.W., Washington, D.C. 20201, or online at hhs.gov/hipaa/filing-a-complaint. Nobody here will punish you for complaining.

Our duties

• We must keep your health information private, hand you this notice explaining our legal duties and privacy practices, and tell you if a breach puts your unsecured information at risk.
• We follow the notice that is in effect now.
• We may change this notice, and the change will apply to all information we hold about you. You can get the new notice [on our website, at our office, and from any driver] or by asking us.

Acknowledgment of receipt

I received [Company name]‘s notice of privacy practices.

If not signed (staff complete):

Getting it to riders and asking for the signature

A covered provider that treats the rider directly must give the notice by the first time it serves the rider, or in an emergency soon after, once that is practicable (164.520(c)(2)). The indirect category in 164.501 covers providers that act on another provider’s orders and report results back to that provider rather than to the patient. A company that books with the rider and carries the rider looks much more like the direct case, so treat the first ride as the deadline unless your lawyer reads your setup differently.

A workable routine for a transport company:

1. Email the notice with the booking confirmation when the rider has agreed to email, or mail it when the first ride is booked far enough ahead.
2. Have the driver carry printed copies and the acknowledgment form, and collect the signature at the first pickup.
3. When a rider declines or cannot sign, complete the “If not signed” box the same day.
4. File each form where you can find it for six years.

The rule expects an honest attempt to collect the acknowledgment, not a signature every time. HHS proposed removing the acknowledgment requirement in January 2021 (86 FR 6446), estimating large savings for providers, but the Federal Register lists only proposals under that rulemaking, and the requirement is still in the regulation as of October 2026.

If you keep a physical site where riders receive service, have copies there for people to take and post the notice where riders can read it (164.520(c)(2)(iii)). If your website describes your services, the notice must be posted prominently and available from the site; the guide to what a NEMT website needs lists it with the other required pages. Anyone who asks for the notice gets a copy, rider or not.

Calls from relatives fall under the family section of the notice, and talking to riders’ families gives dispatchers a script for them. Riders who need the notice in another language may have rights under Section 1557, covered in language access in NEMT.

What changed on February 16, 2026

Two notice changes had a February 16, 2026 compliance date, and only one of them is still required: the substance use disorder statement stays, and the reproductive health items are gone. The April 26, 2024 Privacy Rule amendments (89 FR 32976) set that date for the notice changes, to match the date in the February 16, 2024 Part 2 rule (89 FR 12472).

The substance use disorder change is in force. A covered entity that receives or keeps records from a federally assisted treatment program now needs the statement shown in the template about those records and legal proceedings. HHS revised its model notices in February 2026 to reflect it. A company that takes ride requests from a treatment center may hold such records; rehab center transportation explains the agreement those centers sign with outside services.

The reproductive health items are gone. In Purl v. HHS, decided June 18, 2025, a federal court in the Northern District of Texas vacated most of the 2024 reproductive health privacy rule. HHS says the court vacated three notice paragraphs, 164.520(b)(1)(ii)(F), (G), and (H), and left the rest of the notice changes in effect. The online eCFR still prints those three paragraphs as of October 1, 2026, so leave them out when you work from the rule text.

Changing the notice and keeping copies

Revise and redistribute the notice promptly whenever a material change affects the uses and disclosures it describes, riders’ rights, your legal duties, or your other privacy practices. Except where a law requires it, a material change may not start before the effective date stated on the notice that describes it. Keep a copy of every version you issue, along with the signed acknowledgments and the notes on attempts that failed, for six years, counted from when each was made or, if later, from the last day it applied (164.520(e) and 164.530(j)).

OCR does check notices. Its December 2022 resolution agreement with New Vision Dental, a two-office California dental practice, listed a notice missing required content among three findings and made the practice pay $23,000. Its corrective action plan required a compliant notice that describes the uses needing a patient’s written authorization, including posting on the practice’s website and social media pages, and required the new notice to be posted at both offices and on the website. The case began with patient details in replies to online reviews, covered in replying to reviews under HIPAA.

Backing up the notice’s promises

The notice tells riders you keep their information private, so the systems behind it have to do that. In HealthRide, patient information is encrypted and protected. Each person on your team sees only what their role allows. On drivers’ phones, the driver app keeps rider details off the lock screen. HealthRide is HIPAA compliant and signs business associate agreements with its providers.