844-740-7100

    Colington Consulting

    Helping Organizations Achieve HIPAA Compliance™

    Contact Us

    Category: HIPAA Business Associates

    • When Are NEMT Organizations HIPAA Business Associates?

      Non-Emergency Medical Transportation (NEMT) providers serve a critical role in helping patients access healthcare services. However, one of the most common compliance questions in the industry is straightforward: When is a NEMT organization considered a HIPAA Business Associate?

      For most providers, the answer is simpler than expected—yet often misunderstood.

      Understanding the Business Associate Role

      A HIPAA Business Associate (BA) is any organization that creates, receives, maintains, or transmits Protected Health Information (PHI) on behalf of a covered entity, such as a healthcare provider, health plan, or managed care organization.

      PHI includes identifiable information connected to healthcare services. In the NEMT context, that often looks like patient names tied to medical appointments, transportation arranged for treatment, Medicaid identifiers, or trip data linked to healthcare delivery.

      If your operations involve this type of information, even at a basic level, HIPAA likely applies.

      How NEMT Providers Become Business Associates

      In most healthcare transportation models, NEMT organizations are functioning as an extension of the healthcare system. This is particularly true in Medicaid and broker-driven environments, where transportation is a defined benefit tied to care.

      When trip requests are received from a broker, hospital, dialysis center, or health plan, they almost always include information that connects an individual to medical services. That connection is what transforms routine transportation data into PHI.

      Dispatch teams, drivers, and administrative staff all interact with this information in some form—whether scheduling rides, confirming appointments, or maintaining trip records. Even if the data seems limited, the healthcare context is what matters.

      The role of the NEMT provider in these scenarios is not just logistical. It supports treatment access, continuity of care, and patient outcomes. From a regulatory standpoint, that places the organization squarely within the definition of a Business Associate.

      The Role of Data Storage and Technology

      Many NEMT providers assume HIPAA only applies when they actively use patient information. In reality, simply maintaining or storing PHI is enough to trigger Business Associate status.

      Trip manifests, dispatch software, billing platforms, and ride history logs often contain patient identifiers linked to healthcare services. These systems—whether cloud-based or local—must be evaluated through a HIPAA compliance lens.

      Communication tools are another important factor. Dispatch-to-driver coordination frequently involves mobile apps, texting, or call systems. If these channels include PHI, they must be secured appropriately. Standard consumer tools without safeguards can create immediate compliance risks.

      What HIPAA Requires from NEMT Business Associates

      Once classified as a Business Associate, an NEMT organization takes on defined responsibilities under HIPAA.

      This includes executing Business Associate Agreements (BAAs) with covered entities, implementing safeguards to protect PHI, and training workforce members on privacy and security expectations. Organizations are also responsible for identifying risks, monitoring their environment, and responding to potential breaches.

      Importantly, these obligations apply across the organization—not just in the back office. Drivers, dispatchers, and management all play a role in protecting patient information.

      Common Misunderstandings in the NEMT Industry

      A frequent misconception is that NEMT providers are “just transportation” and therefore outside the scope of healthcare regulation. In reality, the moment transportation is linked to medical care and involves patient-specific information, the regulatory landscape changes.

      This misunderstanding often leads to gaps such as missing BAAs, unsecured devices, or untrained staff. Over time, these issues increase exposure to audits, penalties, and contract challenges with healthcare partners.

      Key Takeaways

      Most NEMT organizations working within healthcare networks should assume they are operating as Business Associates. The combination of receiving, storing, and using patient information tied to medical services establishes that role in the majority of cases.

      Compliance is not just a contractual requirement—it is a foundational part of operating responsibly within the healthcare ecosystem.

      Final Thoughts

      For NEMT providers, the question is rarely whether HIPAA applies, but rather whether compliance practices fully reflect that reality. Organizations that take a proactive approach—aligning their policies, technology, and workforce—are better positioned to reduce risk and strengthen partnerships.

      Next Steps for NEMT Providers

      At Colington Consulting, we specialize in helping NEMT providers operating as HIPAA Business Associates build proactive compliance programs. Contact us at 844-740-7100 or schedule a free 30-minute HIPAA risk review to evaluate your current compliance posture as an NEMT organization.

      • Reviewed on June 16, 2026 by: Jay Hodes, President – Colington Consulting, HIPAA Compliance Expert
      • Regulatory Sources:  45 CFR 164.502(e), 164.504(e), 164.532(d) and (e)  
      • Disclaimer: The information provided in this article is for educational and informational purposes only and does not constitute formal legal advice or an official regulatory determination. For specific guidance regarding your organization’s unique operational workflows, consult directly with a HIPAA compliance specialist or legal counsel.

    • Business Associate Agreements Under HIPAA

      Business Associate Agreements Under HIPAA: Regulatory Necessity and OCR Enforcement Lessons

      The HIPAA Privacy Rule permits covered entities to use vendors and service providers that create, receive, maintain, or transmit protected health information (PHI). However, this permission is conditional. Federal law requires covered entities to obtain written “satisfactory assurances” that such third parties—known as business associates—will appropriately safeguard PHI. These assurances must take the form of a Business Associate Agreement (BAA) that meets the regulatory requirements established by the U.S. Department of Health and Human Services (HHS).

      Under 45 C.F.R. § 164.502(e), a covered entity may not disclose PHI to a business associate unless it first obtains these assurances in writing. The regulation is unequivocal: in the absence of a compliant BAA, disclosures of PHI to a business associate are impermissible under HIPAA, regardless of whether a breach or misuse ultimately occurs. HHS guidance further clarifies that covered entities are prohibited from sharing PHI with a business associate until such an agreement is in place. [

      Required Elements of a HIPAA‑Compliant Business Associate Agreement

      The mandatory content of a BAA is prescribed directly by regulation at 45 C.F.R. § 164.504(e)(2). To satisfy the Privacy Rule’s requirement for “satisfactory assurances,” a Business Associate Agreement must include the following provisions:

      1. Permitted and Required Uses and Disclosures of PHI

      The agreement must establish the permitted and required uses and disclosures of PHI by the business associate and may not authorize conduct that would violate the HIPAA Privacy Rule if done by the covered entity.

      2. Safeguards to Protect PHI

      The agreement must require the business associate to use appropriate safeguards to prevent unauthorized uses or disclosures of PHI, including compliance with the HIPAA Security Rule for electronic PHI.

      3. Reporting Obligations

      The business associate must be required to report to the covered entity any use or disclosure of PHI not permitted by the contract, including breaches of unsecured protected health information.

      4. Subcontractor Flow‑Down Requirements

      The agreement must require the business associate to ensure that any subcontractor that creates, receives, maintains, or transmits PHI on its behalf agrees to the same restrictions and conditions.

      5. Access to Records by HHS

      The agreement must permit the business associate to make its internal practices, books, and records available to the Secretary of HHS for purposes of determining compliance with HIPAA.

      6. Return or Destruction of PHI Upon Termination

      Upon termination, the agreement must require the return or destruction of PHI when feasible or require continued protection of the information if destruction is not feasible.

      7. Termination for Cause

      The agreement must authorize the covered entity to terminate the contract if the business associate violates a material term.

      If any of these elements are missing, the agreement does not meet HIPAA requirements.

      OCR Enforcement and Lessons Learned

      The HHS Office for Civil Rights (OCR) has repeatedly enforced the BAA requirement through resolution agreements and corrective action plans. OCR has taken the position that disclosures of PHI made in the absence of a compliant BAA violate the HIPAA Privacy Rule, even when no breach has yet occurred. OCR resolution agreements routinely require covered entities to identify all business associates, execute compliant BAAs, and implement processes to prevent disclosures of PHI without prior agreement.

      HHS regulations and OCR enforcement actions make one principle unmistakably clear: a Business Associate Agreement is a prerequisite to lawful disclosure of PHI. Covered entities that fail to execute and maintain compliant BAAs expose themselves to enforcement action, corrective obligations, and significant regulatory risk. In HIPAA compliance, the existence of a valid BAA is not optional, it is required.

      Colington Consulting

      HIPAA Compliance, Risk Assessment & Management

      Our company specializes exclusively in HIPAA compliance, with a focus on helping covered entities and business associates identify risk, implement compliant Business Associate Agreements, and align their operations with HHS and OCR regulatory expectations. Drawing on direct regulatory requirements and real‑world OCR enforcement patterns, we assist organizations with business associate identification, BAA drafting and remediation, vendor management programs, and audit‑ready compliance documentation. Book a free initial consultation to evaluate your current BAA posture, identify gaps that may expose your organization to enforcement risk, and outline practical, defensible steps to strengthen HIPAA compliance before issues arise.

      Helping Organizations Achieve HIPAA Compliance™

    • Understanding the Role of a HIPAA Business Associate

      by Catherine Wanjau and Jay Hodes, President – Colington Consulting

      The continued complexity of modern healthcare systems and growth of patients’ data mean that medical records can be stored in more places than just the doctor’s office. The information may be kept and maintained offsite in a storage facility or on a cloud-based server operated by a third party. Any entity or individual that uses, processes, or discloses this data on behalf of the healthcare provider is called a HIPAA Business Associate. If an organization is contracted by a HIPAA Covered Entity (CE) to perform activities that involve accessing Protected Health Information (PHI) or electronic PHI (ePHI) in any way, they are considered a Business Associate (BA). Because Business Associates use protected patients’ data to support the operations of covered entities, the U.S. Department of Health and Human Services (HHS) requires adherence to the Code of Federal Regulations (CFR) to comply with HIPAA requirements.

      Business Associate Agreement (BAA)

      The HIPAA Privacy Rule states that, “A covered entity must obtain satisfactory assurances from its Business Associate that the Business Associate will appropriately safeguard the protected health information it receives or creates on behalf of the covered entity. The satisfactory assurances must be in writing, whether in the form of a contract or other agreement between the covered entity and the business associate.”

      This means that before a covered entity can work with a Business Associate, the BA must sign a BAA stating that they will safeguard and treat PHI the way CFRs and the covered entity require them to. It does not matter whose version of the BAA is signed, whether provided by the CE or the BA, as long it is executed. According to the Health Information Technology for Economic and Clinical Health (HITECH) Act, a BAA must include specific information to meet HIPAA compliance such as a description of the required and allowed uses of PHI, declarations that the Business Associate will disclose information only as required by law, and proper safeguards to protect patients’ data from breach including steps to take should there be such security violations.

      Why are Some Business Associates Not Complying with HIPAA Regulations?

      One of the major reasons is that most of them have no idea that the law considers them Business Associates. Covered entities have made great strides in following HIPAA compliance requirements, but many Business Associates are still not aware of the need to comply or are just reluctant to do so. Under HITECH, the Office of Civil Rights (OCR) holds Business Associates liable for breaches, and it is imperative that these entities take the necessary steps to ensure HIPAA compliance. In this press release where a Business Associate pays $2.3 million to settle a breach, the OCR Director at the time, Roger Severino terms “The failure to implement the security protections required by the HIPAA Rules in an industry known as a target for hackers and cyber thieves” inexcusable. Sure, following all the steps required to obtain HIPAA compliance may seem overwhelming, but it offers better protection for patients’ data, which helps Business Associates avoid these types of federal penalties.

      Helping Organizations Achieve HIPAA Compliance™

      At Colington Consulting, we specialize in helping healthcare organizations and business associates build proactive compliance programs. Contact us at 844-740-7100 or schedule a free 30-minute HIPAA risk review to evaluate your current policies and protect your organization.