NEMT HIPAA Compliance in Transport Audit

Inspection template for reviewing how non-emergency medical transportation teams handle protected health information across dispatch, tablets, and billing, with verification of minimum-necessary access and annual HIPAA training completion.

Audit Scope and Site Identification

• Audit site, date, and inspector identified
• Dispatch platform, mobile tablets, and billing systems included in scope
• PHI-handling workflows identified for review

Minimum-Necessary Access Controls

• Role-based access limits PHI visibility by job function
• Dispatch staff can view only trip details required for scheduling and routing
• Drivers and attendants can access only the information needed to complete the transport
• Billing staff access is limited to claim-relevant PHI
• Shared accounts are prohibited or formally controlled

Dispatch, Tablet, and Device Safeguards

• Workstations lock automatically after inactivity
• Tablets are password-protected or use equivalent authentication
• Mobile devices are encrypted or otherwise protected against unauthorized disclosure
• Screens are positioned to reduce unauthorized viewing of PHI
• Lost, stolen, or compromised device reporting process is documented and available

Billing and Records Handling

• Billing forms contain only the PHI required for payment and claims processing
• Printed trip sheets and manifests are secured when not in use
• PHI is not visible to unauthorized staff or visitors in billing areas
• Retention and disposal practices for trip records are documented
• Any paper records awaiting scanning or filing are stored in a controlled area

HIPAA Training and Workforce Awareness

• Annual HIPAA training completed for all staff handling trip data
• Training completion records are available for review
• Staff can describe how to report a suspected privacy incident or unauthorized disclosure

Incidents, Corrective Actions, and Sign-Off

• Deficiencies or non-conformances documented with corrective actions
• Follow-up owner and due date assigned for each corrective action
• Inspector signature