HIPAA authorization form for NEMT riders: letting a family member or caregiver book and hear about rides

Do you need a signed authorization at all?

For most family calls, no. 45 CFR 164.510(b) lets a covered provider share details directly relevant to a relative’s, friend’s, or other named person’s part in the rider’s care or payment, as long as the rider agrees or does not object, and the section says that agreement can be oral. Our guide to talking to riders’ families under HIPAA covers that rule and gives dispatchers a call script. A guardian or health care agent is treated as the rider for what the role covers (164.502(g)), so that person needs no form either.

A signed authorization is worth having in three cases:

• The rider wants a person to see more than the rule allows. The rule stops at information “directly relevant” to the person’s involvement. A daughter who should see every receipt for the year, or an attorney handling an injury claim, usually needs the rider’s signature.
• The arrangement is standing. A son who books, changes, and cancels rides for months, and gets a text each time, is easier to explain to a broker or auditor with a page on file than with a note that someone once agreed on the phone.
• Someone asks for proof. A facility, a relative, or your own policy may want it on paper.

One more difference matters. The identity check in 164.514(h) excuses disclosures made under 164.510 but not those made on an authorization, so with a signed form you verify who is calling when you do not already know them. Part 2 of the form below builds in a call-back number for that.

Riders on a broker’s program usually book through the broker, and the broker’s own rules say who may ask. MTM Health’s Virginia handbook, for example, lets a member book for themselves at 18 or older or when emancipated and, for a member under 18, a parent or guardian, an authorized representative, the case manager, or the health care provider. This page fits private-pay riders, facility residents, and rides you arrange under your own contracts.

The form

Fill in the brackets and print it on one page. Give the rider a copy after signing.

[Company name] permission to share my ride information

Rider: ____________ Date of birth: ____________ Phone: ____________

What I allow each person to do (check all that apply):

• ☐ Book, change, or cancel my rides
• ☐ Hear when my driver is on the way, late, or has arrived
• ☐ Be told if a ride was missed or cancelled
• ☐ See my ride dates, times, and pickup and drop-off places
• ☐ See my receipts and statements

Part 3: What may be shared. The details of my rides with [Company name]: dates, pickup and drop-off addresses, the kind of vehicle and help I need, driver arrival and wait times, missed or cancelled rides, and charges and payments. It does not include why I am seeing a doctor or any medical history, because [Company name] does not need them to drive me.

Part 4: Who may share it. [Company name] and its drivers, dispatchers, and billing staff.

Part 5: Who may receive it. The people named in Part 2.

Part 6: Why. At my request, so these people can book and follow my rides.

Part 7: When this ends. This permission ends on [date, usually one year from today] or on the day I stop riding with [Company name], whichever comes first.

Part 8: What I should know.

• I do not have to sign this page. My rides, my price, and the way I am treated stay the same whether or not I sign.
• I can cancel this permission at any time by writing to [name, address, email, or the office where the form is signed]. [Company name] will stop sharing from the day it gets my note. It cannot take back anything it already shared before then.
• The people named above may pass on what they learn, and once they do, federal privacy law may no longer protect it.
• I will get a copy of this page.

What each part does

Parts 3 to 7 and Part 9 carry the six core elements 164.508(c)(1) names, in this order: a specific description of the information, who may make the disclosure, who may receive it, the purpose, an expiration date or event, and the signature with a date (plus the signer’s authority when someone signs for the rider). Part 8 carries the three required statements in (c)(2): the right to revoke in writing and how, that rides do not depend on signing, and that the recipient may share the information onward. The plain wording follows the plain-language rule in (c)(3), and the copy given to the rider meets (c)(4).

The purpose line can say “at the request of the individual” when the rider starts the request and does not give a reason. Naming booking and ride updates is better, because staff can then read the page and know what it allows.

Five defects that void a form

A form that looks signed is not valid when any of these is true (164.508(b)(2)). Check each time someone relies on it:

1. The expiration date has passed, or the expiration event is one you know has happened.
2. A required element is blank, such as the date, the purpose, or the signer’s authority.
3. You know the rider has revoked it.
4. It was combined with another document, or the rider was told rides depend on signing.
5. Something material in it is false, and you know it.

Put the expiration date in a calendar the office checks weekly, so nobody keeps sharing on a form that has lapsed.

Keep the page to one job

Do not fold this permission into the rider agreement, the rate sheet, the photo release, or a card authorization. Section 164.508(b)(3) bars combining an authorization with any other document, with exceptions for research and for other authorizations that are not a condition of anything. The booking checkbox in Part 2 is part of the purpose, not a second consent. The private-pay rider agreement can say that the permission page exists and is optional, then leave the page itself separate.

A request for a different phone number or address is a separate matter. A covered provider has to accommodate reasonable requests to be reached by another means or at another place, and may ask for the request in writing but not for a reason (164.522(b)). The “how I want to be reached” line in Part 1 records it.

When a rider cancels the permission

A cancellation takes five steps:

1. Stop on the call. Tell dispatch to stop sharing with those people right away, even before the paper arrives.
2. Write it down. Record the date, time, who took the call, and what the rider said.
3. Ask for a signed note. The rule wants the revocation in writing, with an exception for anything you already did in reliance on the form.
4. Update the profile. Remove the people from the contacts that dispatch sees, and note the date.
5. File it. Keep the note with the original form for six years from the date the form was created or last in effect, whichever is later (164.508(b)(6) and 164.530(j)).

Cancelling the form does not cancel the rider’s rides. Booking stays with the rider unless the rider names someone new. Whether you are a covered entity at all depends on how you bill, which our HIPAA guide for NEMT providers walks through, and the rider profile form has the matching line for people a rider allows you to discuss rides with.

Letting families follow a ride in HealthRide

In HealthRide, riders and families book online, and a family member can follow the driver live from a text link. Riders also get reminder texts before the ride. Every change is recorded, and your team members see only what their role allows. The live map page explains the tracking link. The signed permission page itself stays in your own files.