HIPAA Texting for NEMT in 2027: What Drivers and Dispatchers Can Text Riders

One trip can mean several texts to a rider: a reminder the night before, an “I’m outside” at the curb, a heads-up when the driver runs late. HIPAA allows all of it. What it asks is that each message carries only what the rider needs, reaches the right phone, and sits on a phone that is locked down. A second set of rules, from the FCC, decides when automated reminders need consent and how fast a STOP must work.

Can NEMT staff text riders under HIPAA?

Yes. HHS says the Privacy Rule lets health care providers communicate with patients about their care at home, by mail, by phone, or in some other manner (FAQ 198, last reviewed December 28, 2022). For messages left on a machine, it suggests your name and number and only what is needed to confirm an appointment, or a request to call back. For email, HHS says providers may use it with patients if they apply reasonable safeguards, such as checking the address before sending and limiting the amount or type of information in an unencrypted message (FAQ 570). The same care fits texts.

The duty behind that advice is the safeguards rule. A covered entity must reasonably safeguard health information from any use or disclosure the rules do not allow, intentional or not (45 CFR 164.530(c)). The minimum necessary rule does not apply to what you tell the rider directly (45 CFR 164.502(b)). The safeguards rule still does, because anyone who picks up the phone can read the text.

How HIPAA reaches you decides whose rules you follow. If your company is a covered entity, the rules apply to you directly. If you run trips for a broker, you are usually its business associate, and you may use member information only as your business associate agreement allows (45 CFR 164.502(a)(3)). The HIPAA guide for NEMT providers walks through both tests.

Brokers expect you to text. MTM Health’s Virginia handbook (approved August 10, 2026) has drivers make reasonable attempts by phone or text before leaving on a no-show, and its Rhode Island handbook (updated July 1, 2026) has them tell the member by call or text that they are outside. In Texas Medicaid managed care, most demand response rides must be confirmed with the member 24 hours ahead by phone, text, or another platform, and members may not be contacted after 9 p.m. local time (Uniform Managed Care Manual 16.4, effective August 1, 2021). The guide to reducing no-shows covers those wait and confirmation rules.

What a pickup text can say, and what to leave out

Write every text as if a stranger will read it on a lock screen. The rider already knows where they are going. Nobody else needs to.

Put these in a text:

• Your company name and a callback number
• The pickup date and time, or the pickup window
• The pickup place, such as “your home” or “the main entrance”
• The vehicle color and number, and the driver’s first name
• For automated reminders, how to reply STOP

Leave these out:

• The clinic, doctor, or facility name
• The reason for the visit or any diagnosis
• Medicaid, the health plan, or the broker’s name
• Member ID, date of birth, or authorization number
• Mobility needs, oxygen, or other care details
• Anything about another rider on the same van

The destination is the risky part. A dialysis center, a cancer center, or a methadone clinic names a condition. CareOregon’s guidelines for the brokerages and providers that serve its Oregon plans (version 1.3, February 2024) tell drivers never to reveal a member’s appointment information or diagnosis outside the care team. They also treat the fact that someone is in the program as confidential, so “your Medicaid ride” does not belong in a text. A rider’s name tied to a pickup and an appointment is protected health information whenever your company holds it as a covered entity or for one.

Sample texts

Keep each one under 160 characters, the limit the FCC sets for exempt health care texts.

• Day-before reminder: “[Company]: pickup tomorrow, Tue, 7:40 to 7:55 a.m. at your home. Call [phone] to change it. Reply STOP to end ride texts.”
• Driver arriving: “[Company]: your driver Ana is outside in a white van, number 12. Call [phone] if you need a few minutes.”
• Running late: “[Company]: your driver is about 15 minutes late for your 9:30 pickup. Call [phone] with questions.”
• Before a no-show: “[Company]: your driver is outside for your 7:45 pickup and can wait until 8:00. Please call [phone].”

Log the time of every call and text you make before leaving on a no-show. MTM Health’s Virginia handbook has you document each no-show under its procedures.

Texting family members, caregivers, and facilities

Some riders want a daughter, a home aide, or group home staff to get the texts. HIPAA allows it. You may share with a family member, friend, or anyone the rider names the information that bears on that person’s part in the rider’s care (45 CFR 164.510(b)). If the rider is available and able to decide, get their agreement or give them a chance to object first.

HHS also says a provider may leave a message with a family member who answers the phone, using professional judgment and limiting what is said (FAQ 198). A guardian or health care agent with legal authority is treated as the rider under 45 CFR 164.502(g).

Riders can also ask you to change how you reach them. A covered health care provider must accommodate reasonable requests to be contacted by other means or at other places, such as “call, don’t text” or “use my other number” (45 CFR 164.522(b)). You may ask for the request in writing, but you may not ask why. If you work under a broker, follow its instructions and note the preference either way.

Set this up before the first message:

1. Write the approved number and name in the rider’s profile, with the date the rider agreed.
2. Verify callers. CareOregon’s guidelines limit trip details to the member, the member’s caregiver or representative, or a health care provider, after staff check the caller’s identity.
3. Text the facility’s main line, not a staff member’s personal cell, for nursing home and group home riders.
4. Remove a number the day the rider or family says to stop.

For who may ride along, see escorts and caregivers on NEMT trips.

Reminder texts and consent: the FCC rules

HIPAA is not the only law on texting. Under the Telephone Consumer Protection Act, autodialed and prerecorded calls to cell phones need the called party’s prior express consent unless they are for an emergency (47 CFR 64.1200(a)(1)). The FCC counts automated texts as calls under these rules. Treat any system that sends reminders on its own as covered.

Who has consented

In a 2015 ruling (FCC 15-72, released July 10, 2015), the FCC said that giving a phone number to a health care provider is prior express consent for health care calls subject to HIPAA. That consent covers the provider and the business associates acting for it, within the scope of the consent and unless the person says otherwise. The FCC added that an intermediary may pass along only consent the person actually gave.

Courts no longer have to follow the FCC’s reading of the law. In McLaughlin Chiropractic Associates v. McKesson (June 20, 2025), the Supreme Court held that district courts are not bound by the FCC’s interpretation in these cases. So do not rely on the 2015 ruling alone. Put a line on your intake and standing order forms where riders agree to ride texts at a named number, and keep it.

The health care exemption

The rules also exempt some health care calls and texts to cell phones from the consent requirement (64.1200(a)(9)(iv)). The exemption names hospitals, emergency care centers, physician offices, poison control centers, and other health care professionals, so do not count on it for van rides. Its conditions still make a good standard for any reminder text:

• Number. Only the cell number the patient gave.
• Identity. The provider’s name and contact information in every text.
• Purpose. Appointment confirmations and reminders, plus a short list of other care messages such as lab results and follow-up after discharge.
• Content. No marketing, and no billing, debt collection, or other money matters.
• Length and frequency. 160 characters or less, and at most one message a day and three a week per patient.
• Opt-out. Each text says the recipient can reply STOP, and requests are honored at once.

The exemption also bars charging the recipient for the text or counting it against their plan limits.

When a rider replies STOP

Under the rule in effect on October 2, 2026, a rider can revoke consent by any reasonable method. A reply of stop, quit, end, revoke, opt out, cancel, or unsubscribe always counts, and you must honor it within 10 business days at most (47 CFR 64.1200(a)(10)). You may send one confirmation text with no marketing, and one sent within five minutes is presumed covered by the earlier consent.

The FCC changed this on September 30, 2026 (FCC 26-67, released October 1, 2026). The new rule takes effect 30 days after it is published in the Federal Register, and the FCC will announce the date. Once it does:

• You may choose the only ways riders can opt out, from the FCC’s list: a reply with a stop word, an automated opt-out on a call, or a website or phone number you set up. Every text must say how. A text that includes one of the standard stop words meets that duty, as long as you honor all of them.
• A STOP can end only that kind of text. A revocation sent in reply to an informational text, such as a ride reminder, may be treated as ending that category alone. A STOP to a marketing text still ends all marketing.
• The deadline stays at 10 business days.

The new rule replaces the January 31, 2027 date the FCC had set for making one STOP end every kind of automated text (Order DA 26-12, January 6, 2026). Until the new date arrives, honor any reasonable request, including a rider who says “no more texts” on a call.

Timing, wrong numbers, and damages

• Time of day. The FCC’s 8 a.m. to 9 p.m. window covers sales calls, not ride reminders (64.1200(c)(1)). Texas Medicaid managed care still bars member contact after 9 p.m., so send next-day reminders in the afternoon.
• Reassigned numbers. Phone numbers change hands. If you checked the FCC’s Reassigned Numbers Database and it wrongly said the number had not changed, you are protected for texts to that number (64.1200(m)).
• Damages. A person can sue for actual losses or $500 per violation, whichever is greater, and a court may triple that for willful or knowing violations (47 U.S.C. 227(b)(3)).

Never use trip texts to sell other rides

A ride reminder and a sales pitch are different messages under every rule that applies.

• Your broker agreement. As a business associate, you may use member information only as your agreement allows. MTM Health’s provider agreement (the January 1, 2023 version Pennsylvania posts, section 21) treats all information about members as its confidential information. You may not disclose it without MTM’s written consent, except for internal use reasonably needed to perform the agreement, and you may never use it to start or grow a business that competes with MTM.
• Broker conduct rules. MTM Health’s Rhode Island handbook bars drivers from seeking more business from members, families, escorts, or medical providers, and from contacting a member, family, or escort for any purpose other than completing the trip.
• The FCC rules. Autodialed texts that advertise or sell need prior express written consent, a signed agreement naming the number, outside a narrow carve-out for health care messages from HIPAA covered entities and their business associates (64.1200(a)(2) and (f)(9)). Consent to ride reminders is not written consent to sales texts.
• HIPAA. Using health information for marketing needs the person’s written authorization (45 CFR 164.508(a)(3)). The definition leaves out some messages about a provider’s own health services (164.501), but for broker members your agreement controls first.

Texts between drivers and dispatch

Standard SMS texts are not encrypted, and someone with access to a phone carrier’s network can read them, CISA warned in its mobile communications guidance (November 24, 2025). That matters most for messages your own staff trade, which often carry a whole day of names and addresses.

The Security Rule requires technical measures that guard health information sent over a network, with encryption as an addressable safeguard (45 CFR 164.312(e)). HHS says a company must assess its use of open networks, choose a way to protect the information, and document that decision (FAQ 2006). CareOregon’s guidelines go further and call for a secure email portal for any correspondence that contains member information.

• Send trip details through the broker’s app or your dispatch system, not by text or in a group chat.
• In a quick text, use the trip number or the rider’s first name and last initial, never the full name with the address and destination.
• No screenshots or photos of manifests. They land in the phone’s photo library and its cloud backup.
• Never text while moving. MTM Health’s Virginia handbook bars phone use and texting while the vehicle moves. The NEMT driver phone policy covers state laws and broker rules.

A stricter rule may come. HHS proposed on January 6, 2025 to require encryption of health information at rest and in transit, with limited exceptions (90 FR 898). HHS’s 2026 regulatory agenda lists it as a long-term action, with the final rule targeted for July 2027. As of October 2, 2026, only the proposal is in the Federal Register.

Phone settings that protect rider information

Every phone that shows trips or rider texts needs the same settings, whether the company or the driver owns it.

• A passcode screen lock. NIST calls the lock screen the first barrier an unauthorized user must pass (SP 800-124 Rev. 2, May 2023). It supports the access control standard in 45 CFR 164.312(a).
• Auto-lock after a short idle time. NIST’s examples are 45 seconds and 5 minutes. Automatic logoff is an addressable safeguard under 164.312(a)(2)(iii).
• Message previews hidden on the lock screen. NIST warns that lock screen notifications can show information to anyone holding the phone while it is still locked.
• Device encryption on. HHS treats data encrypted to its standard, with the key or passcode kept safe, as secured (74 FR 42740), so a lost phone may not be a reportable breach.
• A separate login for each person in the dispatch or driver app. Unique user identification is a required safeguard under 164.312(a)(2)(i).
• Remote lock and erase set up. NIST calls remote wipe unreliable as the only safeguard, because a phone must usually be on and connected to receive it.
• A company number or app for rider texts. Rider threads stay off personal accounts, and you can close access the day someone leaves.

On a driver’s last day, sign them out of every work app and remove rider threads from their phone. The NEMT HIPAA policy template has a phone section drivers can sign.

When a text goes to the wrong person

A pickup text sent to the wrong number is a disclosure the rules do not allow. It is presumed to be a breach unless a written risk assessment shows a low probability that the information was compromised (45 CFR 164.402).

1. Contain it. Ask the recipient to delete the message, and write down the number, the time, and exactly what the text said.
2. Check your agreement’s deadline. WellTrans’s subcontractor business associate agreement (revised October 16, 2025) wants any use or disclosure it does not allow reported within one business day. MTM Health’s provider agreement requires you to report breaches of member information to MTM.
3. Do the risk assessment and meet the notice deadlines. A business associate tells the covered entity, and a covered entity tells the rider, without unreasonable delay and within 60 calendar days of discovery (45 CFR 164.410 and 164.404).
4. Fix the cause. Correct the number on file and retrain whoever sent it.

A short text with only a time and a place is far easier to clear in that assessment than one naming a clinic. The NEMT data breach guide covers the full response.

A texting policy in eight rules

Put these in writing, train every driver and dispatcher on them, and have each one sign.

1. Text riders only about their own trips: reminders, arrivals, delays, and pickup changes.
2. Use the pickup text format: company name, time, place, vehicle, and callback number.
3. Never name the destination, the reason for the ride, the health plan, or Medicaid.
4. Text only the number in the rider’s profile, or a caregiver the rider approved.
5. Honor STOP and “call me instead” requests the same day.
6. Send trip details between staff through the dispatch or broker app, never by text or screenshot.
7. Keep every work phone locked, encrypted, and set to hide message previews.
8. Report a text sent to the wrong person during the same shift.