Covered Entity vs Business Associate in NEMT

Most NEMT companies are not covered entities. They’re usually business associates. The fast test is simple: if you handle PHI for a hospital, health plan, Medicaid program, or broker, you’re likely a business associate for that trip. If the ride is private-pay and no covered healthcare party is involved, HIPAA may not apply.

Here’s the short version:

• Covered entity usually means the hospital, clinic, health plan, or Medicaid-related payer
• Business associate usually means the NEMT company, broker, software vendor, or subcontractor handling PHI for that covered entity
• Your role can change by trip
• BAAs must be in place before PHI is handled
• Contract breach notice terms can be much shorter than HIPAA’s 60-day outside limit, with some deals calling for notice in 10 to 72 hours
• Missing a BAA can lead to six-figure OCR settlements

What I’d check first: who booked the ride, who is paying, what PHI is being shared, and whether a BAA is already signed.

Quick comparison

Trip source	Who usually hires you	Your usual HIPAA role	Main document to check
Brokered Medicaid trip	Broker	Business Associate	BAA with broker
Hospital discharge	Hospital or health system	Business Associate	BAA with facility
MCO direct trip	Health plan / MCO	Business Associate	BAA with MCO
Private-pay trip	Patient or family	Often outside HIPAA	Service terms / privacy notice

If you want one plain-English takeaway, it’s this: don’t label your whole company once and move on. Review the role at the trip level.

HIPAA Business Associates and Business Associate Agreements

sbb-itb-cef70f4

Basic HIPAA Roles in Plain English

For NEMT, the main question is pretty simple: are you handling PHI for a covered entity, or are you operating on your own?

That one distinction shapes who controls the data, who has HIPAA duties, and who needs to sign a BAA.

What a Covered Entity Is

A covered entity is a healthcare provider, health plan, or clearinghouse that creates, receives, or bills for healthcare data electronically. In NEMT, that usually means the hospital, Medicaid plan, or dialysis center that orders the ride.

That matters because the trip source controls who holds the PHI and who must sign the BAA.

What a Business Associate Is

This role usually changes by trip type, not by vehicle.

A business associate is a person or company that handles PHI for a covered entity. If you receive a trip manifest with a patient's name, address, Medicaid ID, and appointment time, you're handling PHI for that entity. That makes you a business associate.

Your dispatch software, cloud host, and overflow sub-hauler can also be business associates if they touch PHI.

The conduit exception does not fit NEMT. Why not? Because NEMT companies store and use trip data. They don't just pass sealed records through.

Covered Entity vs Business Associate: Side-by-Side Table

The table below shows how the two roles differ in day-to-day work. Use it to match each role to the trip you're actually running.

Role	Typical NEMT Example	Who They Work For	PHI Access	Main HIPAA Duties	BAA Required?
Covered Entity (CE)	Hospital, Medicaid plan, dialysis center	Patients and members	Full clinical and payment records	Privacy Rule, Security Rule, Breach Notification	Initiates BAAs with vendors
Business Associate (BA)	NEMT company, broker, dispatch software	Covered entities or other BAs	Trip-related PHI (name, address, destination, Medicaid ID)	Security Rule and BAA-specific privacy and breach duties	Signs BAAs with CEs and subcontractors

Next, apply these roles to broker work, discharge trips, Medicaid trips, and private-pay service.

How the Difference Shows Up in Common NEMT Trip Types

The same NEMT company can wear different HIPAA hats based on who set up the ride and what information moved with it. That’s where people often get tripped up. On paper, it may look like “just transportation.” In practice, the HIPAA role can shift from one trip to the next.

Broker Work and Downstream Provider Relationships

When a health plan hires a broker like ModivCare or MTM to run transportation benefits, the broker acts as a business associate (BA) for the health plan. If that broker then sends your NEMT company a trip manifest with the patient’s name, Medicaid ID, pickup address, and appointment type, your company becomes a downstream BA.

That means you need a signed BAA with the broker, not only with the health plan. The chain looks like this: health plan → broker → NEMT provider → software vendor. Each step in that chain needs its own BAA.

Hospital Discharge and Medicaid Trips

If a hospital or health system hires your company straight from the source to take a patient home after discharge, your company is a Business Associate. In that setting, the PHI can include the patient’s identity, destination, timing, mobility needs, and any handling instructions tied to the ride.

Medicaid trips usually work in a similar way. Under federal standards at 42 CFR § 431.53, Medicaid transportation providers usually sit inside this chain: State Medicaid program → broker → NEMT provider. For most NEMT companies, that puts them in the downstream BA role.

Private-Pay Trips and When HIPAA May Not Apply

Private-pay is different. If a patient’s family calls your company and pays out of pocket for a ride to a doctor’s appointment, and no health plan, hospital, or Medicaid program is involved in arranging or paying for that trip, HIPAA may not apply.

That said, this is not a free pass to get sloppy with data. State consumer data laws may still apply, and HIPAA-style privacy and security steps are still the professional baseline in medical transportation.

Trip Type Comparison Table

Use the table below to match the trip source with the right HIPAA role.

Trip Type	Who Hires NEMT	Covered Entity Involved?	NEMT Role	PHI Typically Shared	Contract Check
Brokered Medicaid/MCO	Broker (e.g., ModivCare, MTM)	Yes (Health Plan or State)	Downstream business associate	Name, Medicaid ID, medical destination, mobility needs	BAA with broker
Hospital Discharge	Hospital or Health System	Yes (The Hospital)	Business associate	Discharge details, mobility needs, timing, destination	BAA with facility
Managed Care (MCO Direct)	Insurance Company / MCO	Yes (The MCO)	Business associate	Name, insurance ID, appointment type and location	BAA with MCO
Private-Pay	Patient or Family Member	No	Service provider outside HIPAA	Name, address, phone number	Service agreement / privacy notice

What NEMT Companies Need to Do in Practice

Once a trip puts your company in BA territory, your contracts and day-to-day work need to line up with that role.

When a Business Associate Agreement Is Required

For brokered Medicaid trips, hospital discharge trips, and MCO trips, your company needs a signed BAA with the entity hiring you. That could be a broker, hospital, clinic, dialysis center, or health plan.

The same rule applies to your software stack. If your software provider or cloud vendor handles PHI, they need a BAA too.

Before you sign, read the fine print. This is where companies get tripped up. Pay close attention to breach-notice deadlines and subcontractor terms. Many brokers want notice within 10 to 72 hours, which is much shorter than HIPAA’s federal 60-day window.

Daily Privacy Controls for Dispatch, Drivers, and Software

Drivers need the details required to do the trip safely: a pickup address, drop-off location, and any mobility or safety notes. They do not need a diagnosis code or a patient’s full medical history.

A simple way to set this up is to keep your controls centered on these five areas:

• Role-based access: Dispatchers should see only the data they need to run trips. Billing staff should access claims data in a separate lane
• Auto-lock: Set driver mobile devices to lock after 2 minutes and dispatch workstations after 5 minutes
• Remote wipe: Every field device should support remote wipe
• Encrypted storage and transit: Use AES-256 for data at rest and TLS 1.3 for data in transit
• Encrypted messaging: Standard SMS should not be used for PHI

Operations Checklist by Role

Use the checklist below to make each HIPAA duty somebody’s clear job, not everybody’s vague job.

Task	Covered Entity Concern	Business Associate Concern	Who Handles It	How Often
BAA Management	Must sign with all business associates	Must sign with subcontractors and vendors	Owner	Continuous
HIPAA Training	Direct regulatory requirement	Contractual and legal obligation	All staff (drivers and dispatch)	At hire, then annually
Risk Analysis	Security Rule compliance	Required to protect covered entity data	Owner / Security Officer	Annually
OIG Exclusion Screening	Mandatory for billing privileges	Required by broker contracts	Owner / Compliance Officer	Monthly
Device Security	Unauthorized PHI access	Encryption and remote-wipe capability	IT/Security Lead	Continuous
Trip Note Review	Privacy Rule compliance	Minimum necessary access	Dispatch	Every trip
Breach Assessment	Regulatory reporting liability	Contractual reporting windows	Owner / Compliance Officer	As needed

Conclusion: A Simple Test for Identifying Your NEMT Role

After looking at the main trip types, the test is pretty simple: if your company handles PHI for a hospital, health plan, Medicaid program, or broker acting for them, you’re likely working as a Business Associate. HIPAA doesn’t hinge on your industry by itself. It depends on your role and the relationship tied to that trip. That’s why the same company can be a BA on one trip and outside HIPAA on another. The review has to happen at the trip level, not by slapping one label on the whole company.

Key Points to Remember

• Covered entities are hospitals, health plans, Medicaid programs, and clearinghouses.
• NEMT companies handling brokered, hospital discharge, or Medicaid trips are usually acting as Business Associates.
• Private-pay trips may sit outside HIPAA, but HIPAA-aligned practices are still the smart move for NEMT.
• Ask who is sharing the PHI and whose behalf your company is acting on.
• A signed BAA must be in place before your company handles PHI for a covered entity or broker.

FAQs

How do I know if a trip makes me a business associate?

In NEMT, you’re a business associate if you create, receive, maintain, or transmit protected health information (PHI) for a covered entity.

That can include patient names, home addresses, appointment details, or even information that points to a medical condition.

If you provide trips for a broker, health plan, or healthcare provider, you’ll often fall into this role, especially if you’re working under a contract that includes a Business Associate Agreement.

What happens if I handle PHI before a BAA is signed?

Handling PHI before a BAA is signed creates immediate HIPAA risk and can lead to a serious compliance violation.

A BAA needs to be in place before any vendor or partner creates, receives, maintains, or transmits PHI on your behalf. Without that agreement, the rules for permitted disclosures, security safeguards, and breach reporting simply are not there. That leaves a dangerous gap.

If a vendor needs PHI but will not sign a BAA, do not move forward.

Can one NEMT company have different HIPAA roles on different trips?

Yes. An NEMT company can wear different HIPAA hats depending on the setup.

When it works with brokers, hospitals, or health plans that share protected health information, the company usually acts as a Business Associate.

But private-pay trips are a different story. If no Covered Entity is involved, the role can be harder to pin down. That's why it helps to map each workflow with care.

Related Blog Posts

• NEMT Compliance: Complete Guide for Business Owners