Rider photo and testimonial release form: a HIPAA authorization for NEMT marketing

When you need this form

Get a signed release before any rider’s photo, video, voice, name, quote, or story appears on your website, social media, brochures, vehicle wraps, or ads. Posting a rider’s information for the public is a disclosure HIPAA allows only with a valid authorization (45 CFR 164.508(a)(1)), and using it to promote your service is marketing, which 164.508(a)(3) names separately as needing one. The rest of the healthcare marketing rules are in our guide to marketing a NEMT business.

The rule reaches your company in one of two ways, explained in our HIPAA guide for NEMT. A NEMT company that bills electronically is usually a covered entity in its own right. A company that carries broker riders under a business associate agreement may use their information only as that agreement allows (164.502(a)(3)). Modivcare’s 2025 compliance training for transportation providers, for example, lists posting a member’s trip records on social media as an improper disclosure, and says member information may not be disclosed for marketing without the member’s express written authorization.

Two narrow exceptions need no form: telling a rider about your services face to face, and handing out a promotional gift of nominal value, such as a pen with your logo. Replying to an online review is a different problem, covered in replying to a bad review without breaking HIPAA.

The form

Section 1: Rider

Section 2: What we may use

Check each item the rider agrees to. Anything unchecked may not be used.

Section 3: Who may use and share it

[Company name], its employees, and [the marketing or design company we hire, by name].

Section 4: Where it may appear and who may see it

Anyone who visits these places or sees these materials, including the general public, may see what is checked in Section 2.

Section 5: Purpose

To promote the transportation services of [Company name].

Section 6: Payment from another company

[Company name] [does not receive / receives] payment from another company for this use. [If it does: name of the company paying, and what it pays for.]

Section 7: How long this lasts

This permission ends on [date] or when [event, such as “we stop offering wheelchair service”], whichever comes first.

Section 8: Your rights

• You do not have to sign this form. Your rides, your fares, and how we treat you will be the same whether or not you sign.
• You may take back this permission at any time by writing to [name, address, email]. We will stop new uses from the day we receive your letter. We cannot recall anything already used before then, such as brochures already handed out or posts that others have already shared.
• Once your photo, words, or story are published, people who see them may share them, and they will no longer be protected by federal privacy law.
• You will receive a copy of this signed form.

Section 9: Signature

Section 10: Office use

What Cadia Healthcare’s $182,000 settlement shows

The clearest example of what goes wrong is a federal case about patient “success stories.” On September 30, 2025, HHS’s Office for Civil Rights announced that Cadia Healthcare Facilities, five rehabilitation, skilled nursing, and long-term care providers in Delaware, paid $182,000 and accepted a corrective action plan monitored for two years (HHS press release).

• How it started. A patient complained in September 2021 that her photo, name, and details of her conditions, treatment, and recovery had been posted as a success story. An employee had posted the photo to Cadia’s social media page with no signed authorization.
• How big it got. OCR found the stories of 150 patients posted without valid authorizations. Cadia ended the program in March 2022 but did not send breach notices to all of those patients.
• What it must fix. The resolution agreement requires a written ban on using patient information for marketing, including website testimonials and social media, without the patient’s or personal representative’s written authorization. Cadia was told to revise its authorization forms to include an expiration date or event and the statement that disclosed information may be shared again and lose its protection, set up a review of each authorization before use, and train every workforce member, including marketing staff.

OCR’s director put the rule in one line: generally, a valid, written authorization is needed before a covered entity or business associate posts someone’s health information in a website testimonial or a social media campaign. Sections 7 and 8 of the form carry the two elements Cadia’s corrective plan singled out, and Section 10 gives you the review step. If a story does go up without a valid release, the disclosure is presumed to be a breach unless a risk assessment shows a low probability that the information was compromised (45 CFR 164.402). The notice steps are in the HIPAA guide, and a complaint that reaches OCR follows the path in how OCR investigates a HIPAA complaint.

Who may sign for a rider

A rider who can make their own health care decisions signs for themselves. Otherwise only a personal representative may sign, and the form must describe that person’s authority (164.508(c)(1)(vi)).

• Adults with a guardian or health care agent. A person with legal authority to make the rider’s health care decisions is treated as the rider (164.502(g)). HHS’s guidance gives one limit that matters here: someone holding a power of attorney for one specific treatment decision, such as life support, should not sign a marketing authorization.
• Minors. A parent or guardian usually signs. The exception is care the minor lawfully consented to alone, where the parent may not be the personal representative for that care. For the rest of the rules on children’s rides, see children on NEMT rides.
• Riders who have died. The executor or administrator of the estate, or another person state law authorizes to act for the rider or the estate, signs.

A relative who books rides, rides along, or pays the bill is not a personal representative for this purpose unless they also hold that legal authority. When in doubt, ask for a copy of the document and keep it with the form.

Keeping the testimonial honest

The release covers privacy. The FTC’s rules cover whether the testimonial itself is fair to the people reading it.

• Use real words from a real rider. The FTC’s rule on reviews and testimonials bans writing or spreading a testimonial that misrepresents that the person exists, used your service, or had the experience described (16 CFR 465.2).
• Quote exactly or paraphrase fairly. Under the Endorsement Guides, quotation marks mean the rider’s exact words, and any rewording may not change the meaning of what the rider said (16 CFR 255.1). Have the rider initial the final text in Section 2.
• Disclose any connection. Payment, free or discounted rides, and family or business ties to the company are material connections that must be disclosed clearly and conspicuously with the testimonial (16 CFR 255.5).
• Leave program riders out of rewards. Federal law penalizes offering a Medicare or Medicaid beneficiary remuneration likely to influence which provider they choose (42 U.S.C. 1320a-7a(a)(5)).

Some details turn a harmless photo into a health disclosure. A dialysis center sign behind the rider, a pharmacy bag, or a house number all tell viewers more than the rider agreed to. Look at every frame before it goes out, and crop or reshoot rather than adding a line to the release.

Keeping rider details private in HealthRide

Rider names and addresses should reach only the people whose jobs need them. HealthRide is HIPAA compliant: each person on your team sees only what their role allows, every change is recorded, and the driver app keeps rider details off the phone’s lock screen.