# NEMT Spreadsheet vs Software in 2027: When Paper and Spreadsheets Stop Paying Off

Canonical URL: https://nemtguide.com/guides/nemt-spreadsheet-vs-software/ · Updated 2026-09-30

A small NEMT company can run on spreadsheets and signed paper trip logs when it has a few vans, one broker whose free app records its trips, and one or two people keeping the file. Spreadsheets start costing more than software once you work for several brokers, retype each trip two or three times, miss claim deadlines, or cannot show who changed a record.

- A spreadsheet is your schedule and ledger, not your trip record. The signed paper log or the broker app's record is what backs a claim.
- Paper and spreadsheets work best with one broker that gives you a free driver app, a few vans, and a free state claim portal.
- Count what retyping costs: legs a month × minutes per leg ÷ 60 × what an hour of office time costs you.
- Rider data in a spreadsheet needs the same HIPAA safeguards as software: separate logins, a record of changes, backups, and a business associate agreement with any online storage service.
- Keep records the same length of time either way: 6 years after payment in New York, 7 years in Indiana, and 10 years under MTM Health's standard agreement.

A notebook, a spreadsheet, and the broker's app on the driver's phone can run a small NEMT company. That can be the right call. The question is not whether software is better in general. It is whether the hours your team spends retyping and chasing records now cost more than a system would.

## What a spreadsheet can and cannot be

A spreadsheet is a good schedule, billing tracker, and credential calendar. It is not a trip record. The record that backs a claim is the one made at the time of the ride, such as a trip log the driver fills in and the rider signs, or the broker app's record of each pickup and drop-off.

Programs say so directly:

- **New York** pays only when there are contemporaneous, complete, verifiable records for every leg, kept for 6 years after payment. Electronic records count only with a unique electronic driver signature, the pickup and drop-off coordinates, and an accurate, system-generated time stamp that cannot be changed. A manifest or dispatch sheet cannot be the only evidence of a trip (manual effective August 25, 2023).
- **Indiana** says a copy of the claim form is not documentation. Records must be made when the service is provided and before the claim is sent, and kept for 7 years from the date of service (provider enrollment module, version 7.1, September 8, 2026).
- **Minnesota** lets you keep trip records in electronic systems or on paper, if you can produce them on request. Each record needs 14 items, including the driver's dated signature attesting to the actual miles, the rider's or the medical provider's signature, pickup and drop-off times, and odometer readings at both ends (Minnesota Statutes 256B.0625, subdivision 17b).

A spreadsheet row typed after the shift meets none of the New York electronic tests, because anyone can edit it and nothing stamps the time. Minnesota is heading the same way. Its electronic visit verification law covers NEMT starting January 1, 2027, or on federal approval if later, and each ride must then be recorded at the time with an approved verification method. The law calls a record the office enters afterward, or edits after the ride, a "manual visit." A manual visit does not comply until it is confirmed through the state's process (Laws 2026, chapter 121, article 10).

So if you run on spreadsheets, keep the signed paper log as the record and let the spreadsheet point to it. The free [trip log template](https://nemtguide.com/templates/nemt-trip-log-template/) has columns for the fields most programs ask for, and [NEMT trip documentation](https://nemtguide.com/guides/nemt-trip-documentation/) lists each state's rules.

## When spreadsheets and paper still work

A manual setup holds up when most of the work runs through one broker's tools and only a few people touch the records.

| Piece | What covers it without paid software | What you still do by hand |
|---|---|---|
| Broker trips | The broker's free driver app and portal. MTM Health's Virginia handbook (approved August 10, 2026) requires vehicle location tracking on every ride and offers a free app that meets the rule. | Check each synced trip before you bill. MTM Health's Rhode Island handbook says to correct errors even when the app filled in the trip. |
| Private pay and facility trips | A signed paper trip log for each leg | Enter each leg in the spreadsheet and invoice it |
| Medicaid claims you bill yourself | A free state portal where one exists. New York lets providers submit electronic transactions to Medicaid free of charge through ePACES. | Key in each claim and track its deadline |
| Driver and vehicle credentials | A spreadsheet tab with each expiration date | Upload renewals to every broker before they lapse |
| A backup when the app fails | Paper trip logs. MTM Health's Rhode Island handbook (July 1, 2026) requires every driver to keep paper copies of approved trip logs as a backup. | Fill them in and submit them when the app is down |

This works best for a company with a few vans, one main broker, and an owner who does the billing. The broker's app is the trip record for its trips, and the spreadsheet only has to hold the rest. [What NEMT software is](https://nemtguide.com/guides/what-is-nemt-software/) explains what a full system adds on top.

## Signs spreadsheets now cost more than they save

Each sign below is a place where manual work turns into lost money or a broken rule.

| Sign | Why it costs you | The rule behind it |
|---|---|---|
| You work for two or more brokers | Two apps on each phone, two portals, and one spreadsheet trying to merge them | Each broker sets its own tracking, claim, and credential rules |
| Claims go out late | A late claim is a trip you drove for free | MTM Health allows 90 days from the date of service in Rhode Island and 6 months in Virginia. Federal rules cap state limits at 12 months ([42 CFR 447.45](https://www.ecfr.gov/current/title-42/section-447.45)). |
| Claims come back for missing fields | Each denial is a trip you must fix and resubmit, or lose | MTM Health's Virginia claims need an electronic trip log with the trip ID, scheduled and actual pickup times, departure and arrival times, and the member's signature, or they are denied |
| Credentials lapse without warning | One expired license can cost you points and trips | MTM Health's Virginia handbook charges 2 points for each expired credential on a trip. At 3 points your marketplace access is suspended, and at 10 you are out of the network. Points last a year. |
| Several people share one file and password | You cannot tell who changed a trip, or keep someone out | The HIPAA Security Rule requires unique user identification and audit controls ([45 CFR 164.312](https://www.ecfr.gov/current/title-45/section-164.312)) |
| The file lives on one laptop | A lost or broken laptop can take months of records with it | HIPAA requires retrievable exact copies of electronic rider data. New York requires you to report records lost to fire, flood, or disaster to its Office of the Medicaid Inspector General. |
| A payer wants GPS or visit data | A spreadsheet cannot send GPS points | New York has required start, end, and all GPS points on every trip since April 3, 2023. Minnesota NEMT providers must follow its electronic visit verification law starting January 1, 2027, or on federal approval if later. |
| Someone retypes each trip two or three times | Hours of office time every week, plus typing errors | See the math below |

One sign alone may not justify a switch. When two or three show up together, price the manual work with the formula below.

## The cost math: when software pays for itself

Put a number on the manual work before you look at prices. One formula does it:

**Monthly cost of manual work = legs a month × minutes of retyping per leg ÷ 60 × what an hour of office time costs you + the value of trips never billed or denied for missing data + any paper claim fees**

Here is a worked example. Replace each input with your own.

| Input | Example | Result |
|---|---|---|
| Legs a month | 3 vans × 8 legs a day × 22 days | 528 legs |
| Minutes of retyping per leg | 4 minutes: paper log to spreadsheet, then spreadsheet to portal | 35.2 hours a month |
| Cost of an hour of office time | $25 | $880 a month |
| Trips never billed or denied for missing data | 5 legs at $40 | $200 a month |
| **Monthly cost of manual work** | | **$1,080** |

Paper claims can add a line. Since January 29, 2026, Indiana Medicaid has charged $5 for each initial fee-for-service paper claim, taken out of later payments (bulletin BT2025181, December 18, 2025).

Compare the total with quotes at your current size and at twice it. [NEMT software cost](https://nemtguide.com/guides/nemt-software-cost/) explains how vendors price and what a quote leaves out. Count the saved hours only if you will use them, for example to drive, sell to a facility, or chase unpaid claims.

## The records you must keep either way

Software does not change what you keep or for how long. It only changes where the records live.

| Record | What it shows | How long, for example |
|---|---|---|
| Trip record for each leg | Rider, date, addresses, times, odometer or GPS, driver, vehicle, signatures | 6 years after payment in New York, 7 years from the date of service in Indiana, 10 years under MTM Health's standard agreement (January 1, 2023 version posted by Pennsylvania) |
| Claims, remittances, and payments | What you billed and what each payer paid | Medicaid requires the records needed to disclose the extent of your services ([42 CFR 431.107](https://www.ecfr.gov/current/title-42/section-431.107)). The IRS generally wants records behind your tax return for at least 3 years. |
| Payroll and driver time records | Hours, pay, and pay rates | Payroll records 3 years and time cards 2 years under federal wage rules (29 CFR 516.5 and 516.6). Employment tax records at least 4 years (IRS). |
| HIPAA policies and your risk analysis | How you protect rider data | 6 years from creation or the date last in effect ([45 CFR 164.316](https://www.ecfr.gov/current/title-45/section-164.316)) |
| Driver and vehicle credentials | Licenses, checks, training, inspections, insurance | As long as each broker contract requires. MTM Health's standard agreement covers all records of operations under it. |

When rules differ, keep the longest. [NEMT record retention](https://nemtguide.com/guides/nemt-record-retention/) lists the rules by state and payer.

## Keeping rider data safe in a spreadsheet

If your company is a HIPAA covered entity, or a broker's business associate, a spreadsheet with rider names, addresses, and Medicaid IDs is electronic protected health information. The Security Rule treats it the same as data in software.

| Safeguard | Required or addressable | What it means for a spreadsheet |
|---|---|---|
| Risk analysis | Required, 164.308 | Include every laptop, phone, and online account that holds the file |
| Unique user identification | Required, 164.312 | Each person gets their own login. No shared password. |
| Audit controls | Required, 164.312 | Use a service that keeps a history of who changed what, and when |
| Data backup plan | Required, 164.308 | Keep retrievable exact copies and test that you can restore them |
| Automatic logoff | Addressable, 164.312 | Screens lock after a few idle minutes |
| Encryption | Addressable, 164.312 | Turn on device encryption and use encrypted storage |

"Addressable" does not mean optional. You use the safeguard, or you write down why it is not reasonable and use an equivalent measure where one is.

Online storage needs an agreement first. A service that creates, receives, maintains, or transmits rider information for you is your business associate under [45 CFR 160.103](https://www.ecfr.gov/current/title-45/section-160.103), so get its signed business associate agreement before you load any riders. The same goes for a bookkeeper or billing service that opens the file.

Encryption also protects you after a loss. Rider information encrypted to the standard HHS sets in guidance is not "unsecured" under [45 CFR 164.402](https://www.ecfr.gov/current/title-45/section-164.402), so the breach notice rules do not apply if an encrypted laptop goes missing and the key is safe. An unencrypted spreadsheet on a lost laptop is presumed a breach, unless a written risk assessment shows a low probability that the information was compromised. See [NEMT data breach](https://nemtguide.com/guides/nemt-data-breach/) for the steps.

HHS proposed on January 6, 2025 to require encryption of all electronic protected health information at rest and in transit, and multi-factor login, each with limited exceptions (90 FR 898). As of September 2026 the proposal is not final, and the rule in force still lists encryption as addressable. Turning encryption on now puts you ahead of it.

Paper needs safeguards too. A covered entity must reasonably protect health information in any form ([45 CFR 164.530](https://www.ecfr.gov/current/title-45/section-164.530)), so keep signed logs in a locked place and out of sight in the van. HHS and ONC offer a downloadable Security Risk Assessment Tool built for small and medium providers. [HIPAA for NEMT providers](https://nemtguide.com/guides/hipaa-for-nemt/) covers the rest.

## If you stay on spreadsheets, set them up like this

1. **Make one row per leg.** A round trip is two legs, each with its own row, times, and miles. See [trip leg](https://nemtguide.com/glossary/trip-leg/).
2. **Use these columns on the trip tab:** date, broker trip ID or your own trip number, rider ID, level of service, pickup address and time, drop-off address and time, odometer at pickup and drop-off, loaded miles, driver, vehicle, payer, and a link or file name for the signed log.
3. **Add a claims tab.** For each leg, record the date billed, the claim deadline (date of service plus the payer's limit), the amount paid, and the date paid. Sort by deadline every week.
4. **Add a credentials tab.** List every license, check, inspection, and insurance date for each driver and van, with the date each renewal is due to the broker. MTM Health's Rhode Island handbook wants renewals uploaded 10 business days before expiration.
5. **Keep rider details to what you need.** Use a rider ID in the trip tab and keep names, phone numbers, and needs in one restricted tab.
6. **Lock it down.** Separate logins, change history, encrypted devices, automatic screen lock, daily backups, and a signed business associate agreement with the storage service.
7. **Scan signed logs every day** and store the originals in a locked cabinet.
8. **Reconcile every Friday.** Every completed leg is billed, and every claim is paid, denied and fixed, or on your follow-up list.

## How to move off spreadsheets when the time comes

A clean spreadsheet makes the move easier, because every leg, claim, and credential is already in one place.

1. **List what you need:** every broker you work with, how each sends trips, and how each wants claims.
2. **Ask each broker which systems connect to it.** MTM Health's Virginia handbook says it integrates with more than 20 outside applications.
3. **Compare vendors** with the checklist in [how to choose NEMT software](https://nemtguide.com/guides/how-to-choose-nemt-software/).
4. **Sign the business associate agreement** before any rider data is loaded.
5. **Run both for a week,** then switch. [Switching NEMT software](https://nemtguide.com/guides/switch-nemt-software/) has the cutover plan.
6. **Keep the old spreadsheets and paper logs** for the full retention period, even after the new system holds the history.

## Frequently asked questions

### Can I run a NEMT business on spreadsheets?

Yes, at a small size, if every leg also has a record made at the time of the ride. Minnesota's statute, for example, says trip records may be kept in electronic systems or on paper, as long as you can produce them on request. The spreadsheet works as your schedule, billing tracker, and credential calendar. The signed trip log or the broker app's record is the evidence behind each claim.

### Is a spreadsheet a valid NEMT trip record?

Not on its own. New York's transportation manual (effective August 25, 2023) accepts electronic records only with a unique electronic driver signature, pickup and drop-off coordinates, and an accurate, system-generated time stamp that cannot be changed. It says a manifest or dispatch sheet cannot be the only evidence of a trip. Indiana says records must be made when the service is provided and before the claim is sent.

### Is it HIPAA compliant to keep rider information in an online spreadsheet?

It can be, if you set it up for it. A service that stores rider information for you is your business associate under 45 CFR 160.103, so you need its signed business associate agreement before you load any riders. The Security Rule also requires a separate login for each person, a way to record and examine activity, and backups you can restore. Encryption is addressable: you use it, or you write down why it is not reasonable for you and use an equivalent measure if one is.

### When should a NEMT company switch from spreadsheets to software?

When the manual work costs more than a system would. Common signs: you work for two or more brokers, someone retypes each trip into a second or third place, claims miss deadlines such as MTM Health's 90 days in Rhode Island, credentials lapse without warning, or several people share one file and login. Price the retyping with the formula on this page, then compare it with quotes at your size.

### Do NEMT brokers require software?

Many require electronic tracking, but some provide it free. MTM Health's Virginia handbook (approved August 10, 2026) requires vehicle location tracking for the full length of every ride and offers a free driver app that meets the rule. New York has required GPS data on every trip since April 3, 2023. A spreadsheet cannot send GPS data, so broker trips usually run through the broker's app or connected software.

### Can I bill Medicaid without billing software?

In some states, yes. New York lets providers submit electronic transactions to Medicaid free of charge through ePACES. Paper claims can cost you: Indiana Medicaid has charged $5 for each initial fee-for-service paper claim since January 29, 2026. Federal rules require states to set a filing limit of no more than 12 months from the date of service, so track each claim's deadline either way.

### How long do I keep trip logs if I use paper?

The same as electronic records, and often longer than you expect. New York requires trip records for 6 years after payment, Indiana requires 7 years from the date of service, and MTM Health's standard provider agreement, in the version Pennsylvania posts dated January 1, 2023, requires 10 years. Store paper logs where fire or water cannot reach them all at once, and scan them.

## Official resources

- [HHS: HIPAA for professionals](https://www.hhs.gov/hipaa/for-professionals/index.html)
- [HealthIT.gov: Security Risk Assessment Tool for small and medium providers](https://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool)
- [eCFR: 45 CFR 164.312, HIPAA technical safeguards](https://www.ecfr.gov/current/title-45/section-164.312)
- [New York State Medicaid Transportation Policy Manual](https://www.emedny.org/ProviderManuals/Transportation/PDFS/Transportation_Manual_Policy_Section.pdf)
- [IRS: How long should I keep records?](https://www.irs.gov/businesses/small-businesses-self-employed/how-long-should-i-keep-records)