# What Is the HIPAA Minimum Necessary Rule? Examples for NEMT Drivers, Dispatchers, and Billers

Canonical URL: https://nemtguide.com/glossary/minimum-necessary/ · Updated 2026-10-02

The HIPAA minimum necessary rule requires covered entities and business associates to make reasonable efforts to use, share, and request only the health information a task needs. In NEMT, a driver gets the rider's name, phone, addresses, times, and assistance level, not the diagnosis. The rule does not cover what you tell the rider, reports the law requires, or the required fields of a claim.

- The rule covers three things: what your own staff can see, what you send out, and what you ask others for.
- Write down which roles see which rider details. HHS says a small office on paper may rely on training instead of limiting each record field by field.
- Required and situational fields in a standard electronic claim are exempt. Optional fields and attachments are not.
- Broker agreements often make it a contract term too, as WellTrans does in its business associate agreement revised October 16, 2025.
- A report the law requires, such as an abuse report, is exempt, but you share only what that law asks for.

## What the minimum necessary rule requires

The rule sits in [45 CFR 164.502(b)](https://www.ecfr.gov/current/title-45/section-164.502). When a covered entity or business associate uses, shares, or asks for [protected health information](https://nemtguide.com/glossary/protected-health-information/), it must make reasonable efforts to limit it to the minimum necessary for the purpose. A trip manifest, a run sheet, a rider text, and a claim are all protected health information.

Many NEMT companies meet HIPAA as a business associate of a broker or health plan. A business associate agreement cannot let you use rider information in any way the broker or plan itself could not ([45 CFR 164.504(e)(2)](https://www.ecfr.gov/current/title-45/section-164.504)), so the limit travels with the manifest. HHS's fact sheet on business associates, last reviewed July 16, 2021, lists failing to limit information to the minimum necessary as a violation HHS can enforce against a business associate directly. The [HIPAA guide for NEMT](https://nemtguide.com/guides/hipaa-for-nemt/) explains which role your company plays.

For a covered entity, [45 CFR 164.514(d)](https://www.ecfr.gov/current/title-45/section-164.514) splits the rule into three parts. For a business associate, HHS says how it applies the rule will vary with the circumstances, and its agreement must keep its uses consistent with the broker's or plan's own minimum necessary policies (78 FR 5566, January 25, 2013). The same three parts are the clearest way to show you meet it:

1. **What your staff can see.** List the people or job roles that need rider information, the kinds of information each needs, and any conditions on access. Then make reasonable efforts to hold each role to its list.
2. **What you send out.** For disclosures you make over and over, such as a run sheet or an invoice, a standard protocol is enough. Anything unusual gets reviewed on its own against written criteria.
3. **What you ask for.** When you request information from a plan, broker, or clinic, ask only for what the purpose needs.

One more line covers the whole file: you may not use, share, or ask for an entire record unless the purpose truly requires it and you can say why.

## When the rule does not apply

Section 164.502(b)(2) lists six exceptions:

- **Treatment.** Disclosures to, or requests by, a health care provider for the rider's treatment, such as what a doctor or clinic needs for the rider's care. It never covers what your own staff see: uses inside your company follow your role list either way.
- **The rider.** What you tell the rider directly, such as a pickup text. The safeguards rule still applies, and the [HIPAA texting guide](https://nemtguide.com/guides/hipaa-texting-for-nemt/) covers what a text should say.
- **A signed authorization** from the rider.
- **HHS,** when it investigates or reviews compliance.
- **Required by law.** A report a state law requires, such as an abuse report from a [mandatory reporter](https://nemtguide.com/glossary/mandatory-reporter/). You still share only what that law asks for ([45 CFR 164.512(a)](https://www.ecfr.gov/current/title-45/section-164.512)).
- **Required by HIPAA itself,** including the required fields of a standard electronic claim.

You may also rely on some requests as the minimum, when that is reasonable. That covers a public official who says the request is the minimum needed for a purpose HIPAA allows, another covered entity such as a Medicaid health plan, and a professional on your staff or a business associate who says the same.

## Minimum necessary in dispatch

Picture a broker sending Thursday's manifest at 3 p.m. It lists every rider's name, phone number, Medicaid ID, addresses, appointment times, and notes. The rule asks you to decide who sees which of those details before the run sheets go out.

Here is a sample role list a five-van company might write:

| Role | Sees | Does not need |
|---|---|---|
| Driver | Own trips for the day: name, phone, addresses, times, mobility needs, escort | Diagnosis, other drivers' runs, past rides |
| Dispatcher | All trips for the service day, rider phone numbers, standing order notes | Claim and payment history |
| Biller | Completed trip records, member ID, codes, miles, signatures | Dispatch notes and rider texts |
| Outside billing or factoring company | Only what its contract and business associate agreement cover | Full manifests when invoices will do |

The driver column comes from what changes how the ride is done. A driver needs to know about a wheelchair, oxygen, a stretcher, an escort, or a rider who must be handed to staff. MTM Health's standard agreement, in the January 1, 2023 version Pennsylvania posts, goes further: drivers may not ask about a member's illness or medical services unless the ride needs it or the member becomes ill on the trip (section 2.AA). The same agreement gives member information only to staff who need it, and only the parts their job needs (section 21.B).

A few dispatch habits follow from that:

- **Send each driver only their run,** not the whole day's manifest.
- **Keep the reason for the visit out of notes** unless it changes the ride. "Needs help at the door" beats "memory loss."
- **Call a clinic about the ride, not the rider.** Ask whether the appointment moved, not what it is for.
- **Confirm a name and door quietly** at pickup. HIPAA allows a disclosure that slips out during an allowed one only if you applied the minimum necessary rule and reasonable safeguards ([45 CFR 164.502(a)(1)(iii)](https://www.ecfr.gov/current/title-45/section-164.502) and [164.530(c)](https://www.ecfr.gov/current/title-45/section-164.530)).

## Minimum necessary in billing

A claim is a payment disclosure, and payment is not one of the exceptions. HHS's FAQ 212 settles the overlap with the claim format: every data element a standard electronic transaction requires, or requires in a given situation, is exempt, because sending it is required for compliance with HIPAA. Optional fields are not exempt. If a payer asks for optional data, you may rely on its request as the minimum, when that is reasonable. See the [837P](https://nemtguide.com/glossary/837p/) for the claim itself.

The rule bites hardest on everything around the claim:

- **Audit and documentation requests.** When a broker or state auditor asks for records on a sample of trips, send the trip logs, signatures, and GPS records for those trips. Do not send each rider's whole file. A request from a public official who says it is the minimum needed can be relied on, when that is reasonable.
- **Incident reports.** Describe what happened on the ride. Leave out unrelated health history.
- **Outside companies.** WellTrans's subcontractor business associate agreement, revised October 16, 2025, limits you to the minimum amount of information needed for each request, use, or disclosure (section 3.c). It also requires a business associate agreement with any billing company, factoring company, or other entity that receives your trip logs, manifests, or WellTrans billing documents (section 3.g). See [NEMT factoring](https://nemtguide.com/guides/nemt-factoring/) and [business associate agreements](https://nemtguide.com/glossary/business-associate-agreement/).

## How to put the rule in writing

1. **Write the role list.** Name each job, what it sees, and any limits, as 45 CFR 164.514(d)(2) requires of a covered entity.
2. **Write a protocol for each routine disclosure:** run sheets, rider texts, broker incident reports, claims, and uploads to a factoring or billing company.
3. **Set criteria for the unusual requests,** such as a lawyer, a reporter, or a relative who is not on the trip, and review each one against them.
4. **Match your systems to the list where you can.** HHS's FAQ 215 says it generally does not consider office redesigns necessary. Lock the file cabinet, password the computers, and hide fields by role if your software can. A small paper-based office may rely on training.
5. **Train everyone on it** at hire and every year. The [HIPAA training guide](https://nemtguide.com/guides/hipaa-training-for-nemt-staff/) has the topics.

The [NEMT HIPAA policy template](https://nemtguide.com/templates/nemt-hipaa-policy/) has a section for the minimum necessary rule that you can fill in with your role list.

## Frequently asked questions

### Does the minimum necessary rule apply to NEMT drivers?

It applies to your company when HIPAA reaches it as a covered entity or a business associate, and your drivers are part of your workforce. A covered entity's written policy must say which details each role sees (45 CFR 164.514(d)(2)), and a business associate's agreement must keep it within the broker's or plan's own limits. Broker contracts add the same limit: MTM Health's standard agreement, in the January 1, 2023 version Pennsylvania posts, gives member information only to staff who need it, and only the parts their job needs.

### Can a dispatcher tell a driver why a rider is going to the doctor?

Usually not. Give the driver what changes how the ride is done: a wheelchair, oxygen, an escort, or a rider who must be handed to a staff member. MTM Health's standard agreement (January 1, 2023, section 2.AA) bars drivers from asking about a member's illness or medical services unless the ride needs it or the member becomes ill during the trip.

### Does the minimum necessary rule apply to claims I send to Medicaid or a broker?

Only in part. HHS says every data element a standard electronic transaction requires, or requires in a given situation, is exempt, because sending it is required for compliance with HIPAA (FAQ 212, last reviewed July 26, 2013). Optional fields, attachments, and answers to documentation requests are not exempt, so send what the payer asks for and nothing more.

### Is it a HIPAA violation if another rider overhears a pickup address?

Not always. HIPAA allows an incidental disclosure that happens during a permitted one, but only if you applied the minimum necessary rule and reasonable safeguards (45 CFR 164.502(a)(1)(iii) and 164.530(c)). Confirming a name and a door quietly is reasonable. Reading the whole run sheet aloud with other riders on board is not.

### Do I have to buy new software to meet the minimum necessary rule?

No. HHS says it generally does not consider office redesigns necessary to meet the reasonableness standard, though locking file cabinets and putting passwords on computers may be needed (FAQ 215, last reviewed July 26, 2013). It adds that a small practice on paper may rely on training, while an office with an electronic system should consider whether it can limit fields by role.

## Official resources

- [HHS: Minimum Necessary Requirement guidance](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/minimum-necessary-requirement/index.html)
- [HHS: Minimum necessary frequently asked questions](https://www.hhs.gov/hipaa/for-professionals/faq/minimum-necessary/index.html)
- [eCFR: 45 CFR 164.514(d), Minimum necessary requirements](https://www.ecfr.gov/current/title-45/section-164.514)