NEMT Policies and Procedures in 2027: The Manual Every Company Needs

Brokers, state Medicaid programs, and auditors all ask the same two questions. What are your written rules? Can you prove your staff follow them? Your policies and procedures manual answers both. This guide lists the policies a NEMT company needs, what each one must say, and the rule behind it.

What a NEMT policy and procedure manual is

A policy says what your company does. A procedure says who does it, in what order, and what record proves it was done. Together they turn broker contracts and state rules into steps a driver or dispatcher can follow on a busy morning.

Brokers write this into their contracts. MTM Health’s standard provider agreement, in the January 1, 2023 version Pennsylvania posts, requires providers to follow the agreement’s policies and procedures. It also allows inspections, audits, and copying of trip logs and other records, and they may be unannounced. A provider that misses a records deadline can be removed from the network.

The HHS Office of Inspector General lists written policies and procedures as the first of seven compliance program elements in its General Compliance Program Guidance (November 2023). The guidance is voluntary, but auditors know it well. It says a small company may start from templates, as long as it edits them to fit its own work and risks.

The policies every NEMT company needs

Policy	What it covers	Who requires it	Template or guide
Driver qualifications and screening	License, background check, driving record, exclusion checks, offenses that disqualify	Federal Medicaid law, brokers	Driver file checklist
Drug and alcohol testing	Which tests, when, refusals, removal from duty, return to duty	Brokers, some states, DOT or FTA for some drivers	Drug and alcohol policy
Driver training	Orientation, passenger assistance, securement, first aid, HIPAA, fraud awareness	ADA rules, brokers, states	Driver training
No-shows and late cancellations	Wait time, calls before leaving, proof, private pay fees	Brokers, state manuals	No-show policy
Accidents and incidents	First calls, report deadlines, the written report, investigation	Brokers, state manuals	Incident report form
Rider privacy	Manifests, phones, texting, who may see rider details, breaches	HIPAA, broker business associate agreements	HIPAA policy
Vehicles and securement	Daily checks, inspections, lift and securement upkeep, removal from service	ADA rules, brokers, states	Vehicle inspection checklist
Complaints and grievances	Taking, logging, answering, and fixing complaints, with no retaliation	Brokers, state manuals	Complaint log
Weather, disasters, and backup	Backup vans and drivers, storm days, lost records	Brokers	Emergency plan
Rider conduct and refusals	Seat belts, child seats, behavior, when a ride may be refused	ADA rules, brokers	Passenger conduct policy
Fraud, waste, and abuse	Honest billing, reporting concerns, gifts, conflicts of interest	OIG guidance, brokers, federal law above $5 million	Compliance program
Records	What you keep, where, and for how long	Medicaid rules, HIPAA, brokers	Record retention

The sections below give the rule behind each policy, with its date, and what to write. When a broker’s rule is stricter than your state’s, follow the broker on that broker’s trips.

Policies federal and state law require

A process for drug law violations and driving history

Section 209 of the Consolidated Appropriations Act, 2021 added section 1902(a)(87) to the Social Security Act. Every state Medicaid plan must now ensure that each NEMT provider and driver it pays meets four minimums (42 U.S.C. 1396a(a)(87)):

1. The provider and each driver are not excluded from federal health care programs or listed on the HHS OIG exclusion list.
2. Each driver has a valid driver’s license.
3. The provider has a process to address any violation of a state drug law.
4. The provider has a process to disclose each driver’s driving history, including traffic violations, to the state Medicaid program.

Public transit authorities are exempt. CMS says states may meet the rule through attestation (SMD 23-006, September 28, 2023), and Georgia’s NEMT manual (version date July 1, 2026) repeats all four points. If your state or broker asks you to attest, you are confirming that both processes exist. Write them down as part of your drug and alcohol policy and your driver screening policy.

HIPAA privacy and security policies

If your company is a HIPAA covered entity, the Privacy Rule requires written policies and procedures for protected health information. They must fit your company’s size, change when the law changes, and be kept for six years from creation or the date last in effect, whichever is later (45 CFR 164.530). You must also name a privacy official.

The Security Rule’s written policy and documentation rule applies to covered entities and business associates alike (45 CFR 164.316). Both must name a security official. Many NEMT companies are business associates of their broker. MTM Health’s standard agreement, for example, requires every provider to sign its business associate agreement and to report breaches of member information to MTM.

A business associate must report a breach of unsecured health information to the covered entity without unreasonable delay, and no later than 60 days after finding it (45 CFR 164.410). Your broker agreement may set a shorter deadline, so copy its deadline into your policy. See HIPAA for NEMT providers to work out which role you have.

DOT and FTA drug and alcohol policies

Federal transportation testing rules reach NEMT companies in two cases:

• Drivers who need a CDL. FMCSA’s testing rule covers drivers subject to commercial driver’s license rules, such as drivers of vehicles designed for 16 or more people (49 CFR 382.103). The employer must hand each driver written materials on its testing policy covering 12 required topics, and each driver signs a certificate of receipt that you keep (49 CFR 382.601).
• Transit agency contractors. FTA’s rule covers contractors of agencies funded under FTA sections 5307, 5309, or 5311. The employer’s governing board adopts a policy statement covering 10 required items (49 CFR 655.15).

If neither applies, your broker’s testing rules still do. They are in the drug and alcohol section below.

A bloodborne pathogens exposure control plan

OSHA requires a written exposure control plan from any employer whose employees can reasonably be expected to contact blood or other potentially infectious materials in their duties. The plan must be available to employees and reviewed at least once a year (29 CFR 1910.1030).

Brokers and states expect NEMT drivers to do this work. MTM Health’s Virginia handbook (approved August 10, 2026) requires a spill kit on board and cleaning of contaminated surfaces after each ride. Georgia requires first aid and spill kit training before a driver starts. New York’s transportation policy manual (effective August 25, 2023) says every transportation provider, as an employer, must follow this OSHA standard, and it requires protective equipment in each vehicle that meets it. If your drivers clean spills or give first aid, write the plan.

False Claims Act policies at $5 million, and New York at $1 million

Any entity that receives at least $5,000,000 a year under a state Medicaid plan must have written policies on the federal False Claims Act, state false claims laws, whistleblower protections, and its own fraud prevention procedures. The same topics go in its employee handbook (42 U.S.C. 1396a(a)(68)).

New York sets a lower bar. A provider that claims or receives at least $1,000,000 from Medicaid in any 12 months in a row, directly or through managed care plans, must run a compliance program under Social Services Law 363-d and 18 NYCRR Part 521. As of September 2026, it attests to that program every year on the anniversary of its Medicaid enrollment.

What to put in each policy

Driver qualifications and screening

MTM Health’s standard agreement lists what each driver file must hold, including owner-drivers:

• A current driver’s license
• A criminal background check before hire and every year after
• A driving record covering the past three years, pulled every year
• Drug and alcohol test results
• Training certificates

The OIG guidance says every organization should have a written exclusion screening policy. It names who runs the checks, how a possible match is verified, and what happens if someone turns out to be excluded. Check owners, managers, and drivers, since MTM bars anyone on the OIG list or other government exclusion lists. The OIG updates its list every month, so it says a monthly check best limits what you could owe.

Add how drivers report new trouble. MTM requires immediate notice of any criminal investigation or charge against a driver. Texas Medicaid managed care rules require written notice within 10 business days of a driver’s conviction, pending felony charge, or sex offender registry listing (Uniform Managed Care Manual 16.4, version 2.0.1).

Then set the renewal routine. MTM Health’s Rhode Island handbook wants renewed credentials uploaded 10 business days before they expire. If a credential is not in 5 days before it expires, trips tied to that driver or vehicle may come off the manifest. The driver file checklist and NEMT driver requirements cover each document.

Drug and alcohol testing

Program	What it requires	Date of the rule
MTM Health, standard agreement	A written substance free workplace policy with pre-employment, random, post-accident, and reasonable suspicion tests. MTM gets a copy on request, and a refusal counts as a positive result.	Version dated January 1, 2023
MTM Health, Rhode Island	A verifiable five-panel drug testing program with pre-employment, post-accident, and random tests covering more than 25% of drivers each year	Handbook updated July 1, 2026
Louisiana Medicaid	A five-panel screen every year and on reasonable suspicion, with results sent straight to the broker. A driver who fails returns only after a substance abuse professional clears them, followed by three screens over six months.	Section 10.3, issued July 14, 2025
CareOregon	A drug-free workplace with an anti-drug policy and awareness program. Drivers may have to sign an attestation, and a driver suspected of impairment is tested at the provider’s expense.	Manual version 1.3, February 2024

Your policy should name who is tested, which tests, and when. Spell out what counts as a refusal and what happens after a positive result. It also needs a rule on medication. MTM requires a driver taking prescription or over-the-counter medicine that could affect their driving to tell a supervisor and not transport members. A driver may use a properly prescribed medicine on duty only when you hold a written note from their medical provider that it will not affect their driving.

Training

The ADA requires every public or private demand response service, which includes NEMT, to train staff to proficiency in operating vehicles and equipment safely and treating riders with disabilities respectfully (49 CFR 37.173). MTM’s standard agreement requires a driver orientation and training program, with records in each driver file. That program must include fraud, waste, and abuse training and HIPAA.

Brokers set the list and the timing. MTM Health’s Virginia handbook requires passenger assistance, HIPAA, defensive driving, and, where they apply, first aid and wheelchair securement before a driver’s first ride. A company that runs its own course needs written approval that it meets the standard. Modivcare’s 2025 attestation gives new employees 30 days from hire to finish its training. See NEMT driver training.

No-shows and late cancellations

Write the wait time, the calls a driver and dispatcher make before leaving, and the proof you keep. New York’s transportation policy manual (effective August 25, 2023) requires a wait of at least 15 minutes after the scheduled pickup time and a record of every no-show. MTM Health’s Virginia handbook counts a pickup as on time from 15 minutes before to 15 minutes after the scheduled time. Before leaving, the driver must follow MTM’s no-show steps and try to reach the member by phone or text.

Medicaid providers accept the Medicaid payment as payment in full (42 CFR 447.15). Keep any no-show fee for private pay riders who agreed to it in writing. Your own missed pickups count too. MTM’s agreement can penalize or refuse to pay for a trip when your late pickup makes a member miss the appointment. The no-show policy template is ready to fill in.

Accidents, incidents, and emergencies on a ride

Program	First call	Written report	Date of the rule
MTM Health, Rhode Island	Injury, police, EMS, assault, or a missing member: phone MTM right away	Within 24 hours for every incident. Police report within 5 business days.	Handbook updated July 1, 2026
New York Medicaid	The broker	The state NEMT Accident and Incident Report within 48 hours	Policy manual effective August 25, 2023
Louisiana Medicaid	Emergency services right away	Crashes within 72 hours, with a drug screen done within 12 hours. The crash report within 15 business days.	Section 10.4, issued July 14, 2025
CareOregon	Injury, death, or abuse allegation: written notice right away	Other incidents within 24 hours	Manual version 1.3, February 2024
Modivcare	Any accident, incident, or moving violation: tell Modivcare immediately	Keep a copy of Modivcare’s report form in every vehicle	2025 compliance attestation

Missing a deadline costs money. MTM Health in Rhode Island charges $500 in liquidated damages when a report is late or skipped. CareOregon also requires written procedures for drivers when a member needs emergency care, and a written procedure for investigating every collision and incident. It asks for objective reports: what was seen, heard, or measured, not what someone felt.

Put the steps and the form where drivers can reach them. Georgia’s manual requires accident procedures and forms in each vehicle’s information packet, and so does New York. The incident report form has the deadlines printed on it.

Rider privacy

Your privacy policy covers manifests, phones, texts, email, and what drivers may say. MTM’s agreement bars drivers from asking about a member’s illness or care. The only exceptions are when the answer affects safe transport or the member becomes ill on the ride. MTM Health’s Virginia handbook adds that drivers may not show or discuss member information with anyone unauthorized, including other riders in the van.

The policy also needs a breach section: who to tell, how fast, and what to write down. Start from the HIPAA policy template.

Vehicles, inspections, and securement

The ADA requires lifts, ramps, securement devices, and other accessibility features to be kept working and repaired promptly. While one is out of order, you must take reasonable steps to serve riders who need it (49 CFR 37.161). You must use the securement system, and you may require a rider’s wheelchair to be secured. You may not refuse a ride because a wheelchair is hard to secure, and you may suggest, but not require, a move to a vehicle seat (49 CFR 37.165).

Brokers and states add inspection and removal rules:

• Virginia (MTM Health, August 2026). Every vehicle is inspected before it carries members and again twice a year. Vehicles out of compliance may be pulled from service.
• Georgia (July 2026). A vehicle out of compliance comes off the road until the state certifies it in writing. Two or more rider complaints about one vehicle within 5 days require an inspection, with the fix recorded in the vehicle’s permanent file.
• Georgia, drivers. A driver with one confirmed failure to secure a wheelchair stops driving until you send the broker proof of retraining.

Use the vehicle inspection checklist for daily checks and see wheelchair securement for the steps.

Complaints and grievances

CareOregon defines a grievance as any expression of dissatisfaction. When a rider complains, your staff tell them they have the right to file a grievance and how to do it. Then you report it to the broker. The provider helps with the investigation, which can include dash camera footage, and may never retaliate against anyone who complains.

MTM’s agreement sends complaints about your service to you for immediate attention, and you must resolve them promptly. Georgia requires its broker to call a complainant back within 24 hours, so expect broker requests for your side on short notice. MTM Health’s Virginia handbook requires complaint procedures posted inside every vehicle, next to the broker’s toll-free and TTY numbers. Log every complaint with dates and the fix in a complaint log.

Weather, disasters, and backup service

CareOregon requires brokers and their providers to keep policies for bad weather, disasters, business continuity, and disaster recovery. They must cover staff training, how people are notified, and what members are told, and you hand over copies on request. It also requires a backup plan for members whose pickup is running very late.

MTM’s agreement asks for a specific backup plan for every trip you accept. If weather makes a trip unsafe, you must tell the member and MTM right away. Plan for your records too: New York requires providers whose records are lost to fire, flood, or disaster to report the loss to the Office of the Medicaid Inspector General. Start from the emergency plan template.

Rider conduct and refusing a ride

The ADA lets you refuse service to a rider who is violent, seriously disruptive, acting illegally, or a direct threat to others. It never lets you refuse a rider because their disability causes an appearance or involuntary behavior that others find offensive or annoying (49 CFR 37.5).

Brokers draw the lines in their contracts:

• MTM’s agreement requires drivers to make riders wear seat belts and to refuse to start or continue a trip if they will not. A driver also refuses a child’s ride when the right child seat is missing or refused. Drivers must allow service animals.
• CareOregon expects drivers to finish scheduled rides unless they have a credible fear for safety. A driver may not put a rider out or leave a started ride over verbal behavior that is not threatening. You may ask the broker not to assign that rider to you again.

The passenger conduct policy puts these rules in one place for drivers and riders.

Fraud, waste, abuse, and conflicts of interest

The OIG guidance lists billing, coding, rider incentives, and dealings with referral sources among the common risk areas. MTM Health’s Virginia handbook requires fraud, waste, and abuse training before a provider starts and every year after. MAS, New York’s broker, treats any gift or favor between a rider and a provider, driver, or employee as possible fraud and reports it to the state. Modivcare’s 2025 attestation asks each provider to have a conflict of interest policy or to follow the one in Modivcare’s code of conduct.

For a small company, the OIG suggests one compliance contact who reports to the owner at least every quarter. Where possible, that person should not also do the billing. It also asks for a written rule that staff report concerns in good faith, that reports are investigated, and that no one is punished for reporting. See NEMT fraud for the patterns auditors look for.

Records and retention

Every Medicaid provider agrees to keep the records that show what it provided and to hand them over on request (42 CFR 431.107). Your records policy lists each record, where it lives, and how long you keep it.

Record	Keep at least	Rule
Trip records for every leg, New York	6 years after payment	NY Medicaid Transportation Policy Manual, August 25, 2023
Trip, grievance, and incident records, CareOregon	6 years after the ride	CareOregon manual, February 2024
All records under the agreement, MTM Health	10 years, or longer if law requires	MTM agreement, January 1, 2023
Training records, Modivcare	10 years	Modivcare attestation, 2025
HIPAA policies and required documentation	6 years from creation or last in effect	45 CFR 164.316 and 164.530

Keep each record for the longest period that applies to it. NEMT trip documentation covers what each trip record must hold.

How to write a policy a broker will accept

Use the same layout for every policy, so staff and auditors find things in the same place:

1. Title and number, such as “D-3 Drug and alcohol testing”
2. Effective date, version, and next review date
3. Owner: the one person responsible for it
4. Purpose: one sentence
5. Who it applies to: owners, drivers, attendants, dispatchers, office staff
6. The rule: what you do, naming the broker contract, manual, or law it meets
7. Steps: who does what, and by when
8. Records: what is written down, where it is kept, and for how long
9. Forms: the template or log that goes with it
10. Sign-off: a line for each staff member’s signature and date

Keep one topic per policy. When two brokers set different rules, add a short table by payer, or write the stricter rule for everyone. The OIG guidance asks that policies be easy to reach, written at a reading level staff can follow, and translated where needed. It also says to finish a new policy before you change the practice, and to send staff a written interim notice when a change cannot wait.

How to roll out policies and keep them current

• Train before the first ride. Walk each new hire through the policies that touch their job, and collect a signed acknowledgment. For drivers under its testing rule, DOT requires a signed certificate of receipt for the testing materials, and CareOregon may ask drivers to sign an attestation on the anti-drug policy.
• Review at least once a year. The OIG recommends an annual review of all policies. OSHA requires an annual review of the exposure control plan.
• Update when something changes. A new broker contract, a new handbook version, a law change, an incident, or an audit finding means the related policy gets reviewed that week. MTM Health’s Virginia handbook, for example, was last updated July 30, 2026.
• Keep the old versions. Store every retired version with its effective dates for at least six years, or 10 years under an MTM agreement.
• Put the right pages in each van. Accident procedures and forms go in the vehicle packet, and complaint procedures are posted where riders can see them.

How to build your manual, step by step

1. Collect your rules. Gather every broker agreement, provider handbook, business associate agreement, and your state’s NEMT provider manual. See our state guides for your state’s manual.
2. List every “must.” Go through each document and copy each requirement under one of the policy topics in the table above, with its deadline.
3. Start from a template. Use the templates linked above, then edit each one to match what your company really does.
4. Name an owner for each policy. In a small company that may be you for most of them, and that is fine.
5. Write the two federal processes. Make sure your drug and alcohol policy covers state drug law violations and your screening policy covers reporting driving history.
6. Train and sign. Hold a short session, get signatures, and file them in each driver’s folder.
7. Stock the vans. Add accident procedures, report forms, and posted complaint steps to every vehicle.
8. Put reviews on a calendar. Set the yearly review date, and mark each broker’s credential and training renewal dates.
9. Test one ride. Pick a recent trip and pull every record your policies promise: the driver file, the vehicle inspection, the trip log, and any incident or complaint. Fix whatever you cannot find.