HIPAA training for NEMT providers
Medicaid transportation brokers write HIPAA training into the provider contract. Modivcare asks every owner and driver to complete it at contracting and every year after, MTM requires it in each driver training program, and Arizona's AHCCCS has owners attest that every driver holds a current HIPAA training certificate.
Buy one seat per driver in a single order, invite drivers by email after payment, and keep a named, dated certificate for each of them ready for the next attestation, credentialing review, or audit.
Who requires it
Each card quotes the published document it links to. Requirements differ by broker, state contract, and health plan, and the agreement you signed controls. Reviewed November 3, 2026.
Modivcare
“all owners and drivers providing non-emergency medical transportation services for Modivcare received, reviewed, and successfully completed the following (or substantially similar) education and training: ... HIPAA Privacy and Security”
Timing: Upon contracting and annually thereafter. New employees within 30 days of hire. Completion records kept at least 10 years.
Modivcare Transportation Provider Compliance Attestation (2025)
MTM
“Driver training programs must include Fraud, Waste and Abuse (“FWA”) and HIPAA.”
Timing: The agreement sets no interval. Training documentation lives in each driver's file, and the client contract can add requirements.
MTM Transportation Provider Services Agreement (Pennsylvania, 01.01.2023)
Verida
“Transportation Providers are required to receive training in the following areas: ... HIPAA Privacy Requirements, Business Associate Agreements”
Timing: The training page lists no interval. For Indiana, Verida reported that driver training “is completed initially during onboarding and then annually thereafter.”
Arizona AHCCCS
“As the Owner/Provider, you are responsible for providing CPR and First Aid and HIPAA training for every Employee/Driver.”
Timing: The owner attests that all drivers hold “valid, current HIPAA Training Certificates.” The packet sets no refresher interval, and driver changes are reported in APEP within 30 days.
Colorado (MediDrive)
“HIPAA Privacy Training (Required annually)”
Timing: Annually, followed by a training attestation. MediDrive coordinates Health First Colorado rides in the Denver metro area and is scheduled to expand statewide on January 1, 2027.
The federal floor
The HIPAA Privacy Rule at 45 CFR 164.530(b) requires a covered entity to train every workforce member on its privacy policies, train new members within a reasonable period after they join, retrain people whose functions are affected by a material policy change, and document that the training happened. The Security Rule at 45 CFR 164.308(a)(5) separately requires a security awareness and training program for all workforce members, and it applies to business associates as well as covered entities.
Neither rule names an annual interval. The yearly cycle NEMT companies work to comes from broker contracts and state programs, which is why the same driver can face a 30-day new-hire deadline under one broker and no stated deadline under another. When you hold more than one contract, train to the strictest one.
Why drivers
Modivcare's Mississippi manual puts it plainly: PHI “includes essentially all information about the members you transport. That includes names, pick-up and drop-off addresses, telephone numbers, Medicaid member numbers, members' conditions, levels of service, and anything else that can be used to identify the people you transport.”
Trip manifests
Modivcare's Mississippi manual tells providers not to share trip logs or manifests with anyone other than Modivcare, including factoring companies, and to shred them before they go in the trash.
At the door
Drivers confirm names, destinations, and mobility needs out loud at homes, dialysis centers, and clinics. Minimum necessary decides how much gets said, and to whom.
Phones and apps
The same manual asks providers to send member information by encrypted email. Personal texting, screenshots, and shared phones move that information outside the broker's systems.
The vehicle
Modivcare's manual says that, in compliance with HIPAA, nothing on a vehicle, including the provider's business name, may use the words Medicaid or Medicare or otherwise signal that Medicaid or Medicare members are riding.
Questions
Family members, facility staff, and strangers all ask. Drivers need a short, consistent answer and a clear route to dispatch instead of improvising.
Incidents
MTM's agreement requires providers to report any breach of member PHI to MTM. Drivers who know the first steps contain the problem and tell dispatch instead of hiding it.
What drivers learn
Drivers work through the same HIPAA Essentials course healthcare staff take, at their own pace on any device. Modules include short knowledge checks, and the certificate is issued only after a passing score of at least 80% on the final assessment.
Module 1
What HIPAA does and does not do, what PHI and ePHI are, who counts as a covered entity or business associate, and why minimum necessary matters in real workflows.
Module 2
Permitted uses and disclosures, treatment/payment/operations, patient rights, authorizations, incidental disclosures, and front-desk or phone scenarios where minimum necessary discipline matters.
Module 3
Administrative, physical, and technical safeguards for ePHI, including passwords, access control, workstation discipline, malware awareness, device security, and remote access basics.
Module 4
Who counts as a business associate, when a BAA matters, how to handle vendors and cloud tools, and how to think about texting, emailing, and portal-based communication.
Module 5
What to do after a suspected privacy or security incident, how to escalate quickly, what to document, and how breach review and notification timing work at a high level.
Module 6
Short recap, final checklist, sanctions reminder, and clear instruction on what the learner should know before starting the assessment.
How a fleet order works
No sales call and no account setup before you pay. This is the same purchase path every team buyer uses.
Type the number of drivers into the team form. The cart prices every seat at the volume tier for that quantity, and a signed-out buyer only enters the email the receipt and login will use.
Checkout runs through Stripe and the whole order arrives on one receipt. Pay once, or choose the optional annual renewal plan the cart offers.
After payment, name your organization on the purchase page and you become its owner and administrator. Invite each driver by email, one at a time or as a pasted list with bulk invite, and keep a seat for yourself if you need one.
The team workspace shows each learner as invited, not started, in progress, completed, renewal due, or expired, with unused seats summarized by course instead of listed one by one.
Each driver who passes the assessment gets a certificate with their name, the course, issue and expiration dates, and a verification code. Download it or open its verification page from the progress view, and anyone holding the code can confirm it at usahipaa.com/verify.
If a driver leaves before starting, release the seat and invite a replacement. A seat locks to its learner once that person begins training.
Fleet pricing
These are the cart's own one-time prices. The tier is set by the number of seats in the order, and when a team admin adds seats for a team they manage while signed in, seats the team already holds count toward the tier.
| Order size | Price per driver | Example order |
|---|---|---|
| 1 learner | $39 | 1 driver: $39 |
| 2-9 learners | $29 | 2 drivers: $58 |
| 10-24 learners | $24 | 10 drivers: $240 |
| 25-49 learners | $21 | 25 drivers: $525 |
| 50-99 learners | $18 | 50 drivers: $900 |
| 100-1,000 learners | $16 | 100 drivers: $1,600 |
Broker records
The compliance letter in Modivcare's Mississippi manual spells out what evidence of completion must show: “Transportation Provider name, employee(s) full name, training/course title(s), training completion date and time, and employee signature.” MTM's agreement lists training certificates among the credentials kept in each driver's file.
A USA HIPAA certificate supplies the driver's name, the course title, the issue date, and a code anyone can verify. Your own roster adds the provider name, completion time, and the driver's signature where a broker asks for them.
Frequently asked questions
Under every broker contract and state program reviewed on this page, yes. Modivcare's annual attestation covers HIPAA Privacy and Security for all owners and drivers, MTM's transportation provider agreement requires HIPAA in every driver training program, Verida lists HIPAA privacy requirements among required training areas, Arizona's AHCCCS makes the owner responsible for HIPAA training for every driver, and MediDrive lists HIPAA privacy training as an annual requirement in Colorado. HIPAA itself requires covered entities and business associates to train their workforce, and brokers such as MTM contract with transportation providers on business associate terms: MTM's agreement attaches a business associate agreement the provider must sign.
It depends on the broker and the state, so read your own contract. Modivcare requires completion at contracting and annually, with new employees trained within 30 days of hire. MediDrive in Colorado lists HIPAA privacy training as required annually, and Verida reported annual driver training in Indiana. The MTM agreement and the AHCCCS enrollment packet cited on this page require HIPAA training without stating an interval. HIPAA itself sets no annual interval: it requires training for new workforce members within a reasonable period and again after material policy changes. USA HIPAA certificates carry a one-year term, which lines up with annual broker cycles.
No. Brokers also require topics this course does not cover, such as fraud, waste and abuse, ADA, passenger assistance, defensive driving, and CPR and first aid. HIPAA Essentials covers the HIPAA privacy and security portion. Modivcare's attestation accepts its listed training “or substantially similar” training, and its Mississippi manual says alternative educational programs are allowed under some client contracts but must be preapproved by Modivcare and the client, so confirm with your broker before substituting any outside course for broker-supplied material.
Yes. A seat goes to whoever you invite by email, whether that person is an employee, an owner-driver, or a contractor you dispatch. Each person needs their own seat because the certificate is issued to the named learner. Modivcare's attestation covers all owners and drivers, and AHCCCS covers every employee or driver, so count everyone who transports members.
Each driver who passes receives a certificate showing their name, the course, the issue and expiration dates, and a verification code. Anyone with the code can confirm it on the public verification page, and you can open every driver's certificate from the team progress view. Brokers may still require their own roster or attestation form, so keep that alongside the certificates.
HIPAA Essentials has an estimated duration of about 90 minutes, including the final assessment, and it is self-paced, so drivers can stop between trips and pick up where they left off. The certificate is issued after the learner scores at least 80% on the final assessment.
Release the seat from the purchase page and invite the replacement. A seat locks to its learner once that person starts training, so assign seats to drivers who are actually going to complete it.
Related pages
Emergency
For emergency crews, dispatch, and ambulance billing. This page covers non-emergency transportation under broker contracts.
See EMS trainingLogistics
Specimen transport, pharmacy delivery, and chain-of-custody workflows for logistics teams.
See courier trainingContracts
What the BAA you sign with a broker obligates your company to do with member information.
Read the BAA guideRecords
Keep completion dates, renewals, and signatures in one log you can hand a broker at revalidation.
Open the log kitRegulation
The federal training standards behind every broker clause, explained in full.
Read the requirementsHome care
The same team order for caregiver workforces, with federal and state training rules.
See home care trainingEvery requirement on this page comes from one of these documents. Brokers revise manuals and attestations, so check the current version for your state before you rely on a deadline.
Train the fleet