TL;DR
- NEMT trip records often include protected health information, such as rider names, addresses, Medicaid ID numbers, and medical appointments.
- Under HIPAA, an AI vendor that handles this information for a covered entity is a business associate and needs a signed Business Associate Agreement.
- HIPAA limits most uses of rider data to the minimum needed for the task, and de-identified data falls outside HIPAA only if strict rules are met.
- AI tools belong in the provider’s security risk analysis, which HHS has made an enforcement priority.
- Before using any AI tool, check the vendor’s data use terms, breach notice process, and any data rules in broker or health plan contracts.
AI tools can summarize calls, draft messages, and sort trip data in seconds. To do that, many of them need rider information. For an NEMT provider, that information is often protected by federal law. This post covers what to check under US law before rider data goes into an AI tool.
Why Rider Data Is Often Protected Health Information
HIPAA applies to covered entities and their business associates. According to HHS, a health care provider is a covered entity if it sends information electronically in connection with a transaction for which HHS has adopted a standard, such as an electronic claim. Government programs that pay for health care, including Medicaid, are also covered entities. An NEMT provider that bills electronically is likely a covered entity. A provider that works for a broker or health plan may also handle rider data as that organization’s business associate.
A typical NEMT trip record holds several details that HIPAA treats as identifiers. HHS lists these in its de-identification guidance. They include:
- Names.
- Street addresses, cities, and ZIP codes.
- Dates directly related to a person, other than the year.
- Phone numbers.
- Health plan beneficiary numbers, such as a Medicaid ID.
When these details are tied to a rider’s medical appointment or mobility needs, the record should be handled as protected health information.
Check Whether the Vendor Will Sign a Business Associate Agreement
HHS guidance on cloud services states that a vendor that creates, receives, maintains, or sends electronic protected health information for a covered entity is a business associate. This is true even if the vendor only stores encrypted data and does not hold the key. The covered entity and the vendor must sign a Business Associate Agreement (BAA) before rider data is shared.
A BAA sets out what the vendor may do with the data and requires the vendor to protect it. Business associates are also directly liable for following certain HIPAA rules. If an AI vendor will not sign a BAA, rider data that counts as protected health information should not go into that tool.
Check How Much Rider Data the Task Needs
HIPAA’s minimum necessary standard requires covered entities to take reasonable steps to limit the use and sharing of protected health information to the minimum needed for the purpose. The standard has exceptions, such as disclosures to a health care provider for treatment. Most business uses of AI tools, such as summarizing calls or drafting reports, are not among those exceptions.
In practice, this means asking what the tool needs to do the job. A tool that drafts a weekly on-time report may only need trip times and service levels. It does not need rider names or Medicaid ID numbers.
Check Whether the Data Can Be De-Identified First
Data that is properly de-identified is no longer protected health information under HIPAA. HHS recognizes two methods. Under the safe harbor method, all 18 listed identifiers must be removed, and the organization must have no actual knowledge that the remaining data could identify a person. The other method requires a qualified expert to determine that the risk of identifying a person is very small.
The safe harbor rules are strict for NEMT data. Every geographic detail smaller than a state must be removed, including street address, city, and county. The only exception is the first three digits of a ZIP code, and only when that area has more than 20,000 people. Dates must be cut back to the year. Because trip records are built around addresses and dates, removing a rider’s name alone does not de-identify a trip record.
Check What the Vendor Does With Your Data
Before using an AI tool, read the vendor’s terms on how it uses the data you enter. Key questions include:
- Whether the vendor uses your data to train its AI models.
- How long the vendor keeps your data, and how you can have it deleted.
- Whether the vendor can change its data terms, and how it notifies customers.
The Federal Trade Commission has warned AI companies that quietly changing their terms to start using customer data for AI training may be unfair or deceptive. The warning shows that data terms can change. For rider data, the BAA should control how the vendor may use it.
Check That the Tool Is in Your Security Risk Analysis
The HIPAA Security Rule requires covered entities and business associates to assess the risks to the electronic protected health information they hold. This is called a risk analysis. A new AI tool that stores or processes rider data is a new place where that data lives, so it belongs in the analysis.
HHS has made this an enforcement priority. As of April 2026, the HHS Office for Civil Rights had completed 13 investigations under its Risk Analysis Initiative. In February 2026, a treatment center paid $103,000 and agreed to two years of monitoring after a phishing attack exposed data on 1,980 patients. HHS found it had not done an accurate and thorough risk analysis.
Check What Happens if There Is a Breach
The HIPAA Breach Notification Rule sets deadlines for reporting breaches of unsecured protected health information. Covered entities must notify affected individuals no later than 60 days after discovering a breach. If a breach affects 500 or more people, they must also notify HHS within 60 days. If it affects more than 500 residents of a state or jurisdiction, they must notify prominent media outlets there.
When a breach happens at a business associate, the business associate must notify the covered entity no later than 60 days after discovering it. The BAA with an AI vendor should spell out how and when the vendor will report a breach, so the provider can meet its own deadlines.
Check Your Broker and Health Plan Contracts
HIPAA sets the federal baseline. Many NEMT providers also work under contracts with brokers or health plans, and those contracts can include their own rules on how member data is stored, shared, and protected. Review these contracts before using an AI tool with member data, since a tool that meets HIPAA may still fall outside a contract’s terms.
Summary of the Checks
| Check | What to Confirm | Rule |
|---|---|---|
| Business Associate Agreement | The vendor signs a BAA before any rider data is shared. | HIPAA business associate requirements |
| Minimum necessary | The tool only receives the rider data the task needs. | 45 CFR 164.502(b), 164.514(d) |
| De-identification | Data meets safe harbor or expert determination before it is treated as outside HIPAA. | 45 CFR 164.514(b) |
| Vendor data terms | The vendor’s use, training, and retention terms fit the BAA. | FTC Act, BAA terms |
| Risk analysis | The tool is included in the security risk analysis. | HIPAA Security Rule |
| Breach notice | The BAA sets how the vendor reports a breach. | HIPAA Breach Notification Rule |
| Contracts | Broker and health plan data terms allow the use. | Your contracts |
The Same Checks Apply to Outside Partners
These checks apply to any outside company that handles rider data for an NEMT provider, including call center and dispatch partners. Phone agents collect rider names, addresses, appointments, and Medicaid ID numbers on nearly every call. Dispatchers use the same details to coordinate with drivers. Any partner doing this work for a covered entity should sign a BAA, limit what it collects to what the trip needs, and have a clear process for reporting a breach.
Trained NEMT Agents and Dispatchers for Your Operation
Pac Biz answers your phones with trained NEMT agents, so no call goes unanswered and no trip gets lost. We also provide dispatchers who coordinate with your drivers throughout the day.
Keeping Rider Data Protected
AI tools can save time for NEMT teams, and the rider data they use often falls under HIPAA. Before rider data goes into any AI tool, confirm that the vendor signs a BAA, send only the data the task needs, and include the tool in your risk analysis. Read the vendor’s data terms, confirm how breaches will be reported, and check your broker and health plan contracts. These steps apply the same rules NEMT providers already follow for any vendor that handles rider information.
Sources
- US Department of Health and Human Services. Covered Entities and Business Associates. https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html
- US Department of Health and Human Services. Guidance Regarding Methods for De-identification of Protected Health Information. https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html
- US Department of Health and Human Services. Guidance on HIPAA and Cloud Computing. https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html
- US Department of Health and Human Services. Minimum Necessary Requirement. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement
- Federal Trade Commission. AI (and Other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive. February 13, 2024. https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive
- US Department of Health and Human Services. HHS’ Office for Civil Rights Settles Four HIPAA Security Rule Ransomware Investigations. April 23, 2026. https://www.hhs.gov/press-room/ocr-settles-four-ransomware-investigations.html
- US Department of Health and Human Services. HHS’ Office for Civil Rights Settles HIPAA Security Rule Investigation with Top of the World Ranch Treatment Center. February 19, 2026. https://www.hhs.gov/press-room/ocr-settles-hipaa-security-rule-investigation-twrtc.html
- US Department of Health and Human Services. Breach Notification Rule. https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html