Run NEMT HIPAA Compliance in Transport Audit — Free

Audit Scope and Site Identification

Audit site, date, and inspector identified

Dispatch platform, mobile tablets, and billing systems included in scope critical (required)

PHI-handling workflows identified for review critical (required)

Minimum-Necessary Access Controls

Role-based access limits PHI visibility by job function critical (required)

Yes No N/A

Dispatch staff can view only trip details required for scheduling and routing critical (required)

Yes No N/A

Drivers and attendants can access only the information needed to complete the transport critical (required)

Yes No N/A

Billing staff access is limited to claim-relevant PHI critical (required)

Yes No N/A

Shared accounts are prohibited or formally controlled critical (required)

Yes No N/A

Dispatch, Tablet, and Device Safeguards

Workstations lock automatically after inactivity critical (required)

Yes No N/A

Tablets are password-protected or use equivalent authentication critical (required)

Yes No N/A

Mobile devices are encrypted or otherwise protected against unauthorized disclosure critical (required)

Yes No N/A

Screens are positioned to reduce unauthorized viewing of PHI

Yes No N/A

Lost, stolen, or compromised device reporting process is documented and available critical (required)

Yes No N/A

Billing and Records Handling

Billing forms contain only the PHI required for payment and claims processing critical (required)

Yes No N/A

Printed trip sheets and manifests are secured when not in use critical (required)

Yes No N/A

PHI is not visible to unauthorized staff or visitors in billing areas critical (required)

Yes No N/A

Retention and disposal practices for trip records are documented

Yes No N/A

Any paper records awaiting scanning or filing are stored in a controlled area

Yes No N/A

HIPAA Training and Workforce Awareness

Annual HIPAA training completed for all staff handling trip data critical (required)

Yes No N/A

Training completion records are available for review critical (required)

Yes No N/A

Staff can describe how to report a suspected privacy incident or unauthorized disclosure

Note (optional)

Incidents, Corrective Actions, and Sign-Off

Deficiencies or non-conformances documented with corrective actions

Follow-up owner and due date assigned for each corrective action

Inspector signature

Get your results

Enter your email — we'll send you a PDF of your filled-out template, plus the occasional MangoScoop newsletter (templates, workflow tips, product updates). Unsubscribe anytime — link is in every email.

Email (required)

Your name (optional)

Run: NEMT HIPAA Compliance in Transport Audit

Audit Scope and Site Identification

Minimum-Necessary Access Controls

Dispatch, Tablet, and Device Safeguards

Billing and Records Handling

HIPAA Training and Workforce Awareness

Incidents, Corrective Actions, and Sign-Off

Get your results