The HIPAA Law Enforcement Exception for NEMT: What to Release When Police, Lawyers, or Families Ask

The calls come after a crash, a rider who never made it home, or a lawsuit. An officer wants the trip log, a lawyer wants the GPS history, or a daughter wants to know where her father went. What you may hand over depends on three things: who is asking, what paper they bring, and whether a broker sent you the trip.

First, check whether you answer to HIPAA, a broker, or both

The rules on this page bind a company that is a HIPAA covered entity, and a company that runs trips as a broker’s business associate. HIPAA for NEMT walks through the tests for each.

A business associate has less room than a covered entity. It may use or disclose rider information only as its business associate agreement allows, or as the law requires (45 CFR 164.502(a)(3)). Broker contracts are often stricter still:

• MTM Health. Section 21.B of its standard provider agreement, in the January 1, 2023 version Pennsylvania posts, bars you from disclosing any information about members to anyone without MTM’s written consent, except for internal use needed to run the trips.
• WellTrans. Its subcontractor business associate agreement, revised October 16, 2025, lets you use or disclose rider information to perform the agreement or as required by law. When WellTrans must give a rider access to their records, you must give WellTrans that access within five business days of its request.

State law can add more. A state law that protects health privacy more strictly than HIPAA still applies (45 CFR 160.203(b)). So on any broker trip, the first call after an outside request goes to the broker.

Who can get rider records, and with what

The short version: legal paper opens the most, a request with no paper opens very little, and the rider can see nearly everything about their own rides. Here is what each requester needs under the HIPAA Privacy Rule.

Who is asking	What they must give you	What you may release
Police with a court order, a warrant, or a subpoena from a judge or grand jury	The order, warrant, or subpoena	What the document names
Police with an administrative subpoena or investigative demand	A written statement that it meets a three-part test	What the request names
Police looking for a missing person or suspect, with no paperwork	Proof they are police, such as a badge	Name, address, birth date, and other listed identifying facts
A lawyer with a court order	The order	Only what the order expressly authorizes
A lawyer with a subpoena and no court order	Written proof the rider was notified or a protective order was sought	What the subpoena asks for
The rider, or a personal representative	A request, in writing if you require it, and proof of identity	The rider’s records in your designated record set
Family or a friend helping with care	The rider’s agreement, or no objection	What relates to their part in the rider’s care

When the police ask for rider records

The law enforcement exception, 45 CFR 164.512(f), lists the cases where you may disclose rider information to a law enforcement official without the rider’s authorization. HHS’s two-page guide for law enforcement sums them up. The ones a NEMT company meets are below.

With a warrant, court order, or subpoena

You may disclose what is required by a court order, a court-ordered warrant, a subpoena or summons issued by a judicial officer, or a grand jury subpoena. Stay inside what the document names.

An administrative subpoena or summons, an investigative demand, or similar process the law requires you to answer needs more. You may answer it only if three things are true: the information is relevant and material to a legitimate inquiry, the request is specific and limited in scope, and de-identified information could not reasonably be used. HHS’s guide says the request must include a written statement saying so. When an official tells you the information requested is the minimum needed, you may rely on that if doing so is reasonable (45 CFR 164.514(d)(3)(iii)).

Check who is asking before you send anything. Under 164.514(h), you may confirm identity with a badge or other official credentials shown in person, or a written request on government letterhead. You may confirm authority with a written statement of the legal authority for the request. A warrant, subpoena, or order is presumed to be legal authority.

To help find a missing rider or a suspect

When an officer is trying to identify or locate a suspect, fugitive, material witness, or missing person, you may answer with limited facts only:

• name and address
• date and place of birth
• Social Security number
• blood type
• type of injury
• date and time of treatment
• date and time of death, if it applies
• a physical description, such as height, weight, hair and eye color, scars, and tattoos

Where the rider was going, the clinic, and the diagnosis are not on that list. Two other rules can help when a rider is missing. If you believe in good faith that sharing more is needed to prevent a serious and imminent threat to someone’s health or safety, you may share it with people able to prevent it, including police (164.512(j)). And when you judge it is in the rider’s best interest, you may tell a family member or caregiver where the rider is and their general condition (45 CFR 164.510(b)(1)(ii) and (b)(3)).

When a rider is a crime victim, has died, or a crime happened on your premises

• A rider who is a crime victim. You may answer an officer’s questions if the rider agrees. If the rider cannot agree because of incapacity or an emergency, you may disclose only if the officer says the information is needed to find out whether someone else broke the law and will not be used against the rider, that waiting would badly hurt an immediate investigation, and you judge it is in the rider’s best interest.
• A rider who has died. You may alert police to the death if you suspect it resulted from a crime.
• A crime on your premises. You may give police what you believe in good faith is evidence of a crime that happened on your premises. Ask your lawyer whether a van counts before you rely on this one.

After a crash or a medical emergency

Call 911 first. You may tell paramedics what they need to treat the rider, such as mobility needs and any oxygen on board, because HIPAA allows disclosures for another provider’s treatment (45 CFR 164.506(c)(2)). When a statute or rule requires a report, HIPAA allows the disclosure the law requires and no more (164.512(a)). The vehicle accident guide covers police and DMV crash reports in four states and what brokers want after a crash.

When a lawyer asks for rider records

Lawyers ask for three different reasons, and each one follows a different rule.

The rider’s own lawyer

The rider can sign a HIPAA authorization naming the lawyer. A valid one describes the information, names who may disclose it and who may receive it, states the purpose, has an expiration date or event, and carries the rider’s signature and date (45 CFR 164.508(c)). It must also tell the rider they can revoke it in writing. If a personal representative signs, it must describe their authority.

A rider can also use the right of access to direct you to send copies to someone else, in a signed written request that names the person and where to send them. A January 23, 2020 court ruling limited that right to requests for an electronic copy of an electronic health record, and HHS says the copy fee limit does not apply when records go to a third party. For paper trip logs, ask for a signed authorization.

A lawyer in a lawsuit

A court order lets you disclose only what the order expressly authorizes (45 CFR 164.512(e)). A subpoena or discovery request with no court order needs a written statement, with documentation, from the lawyer showing one of two things:

1. Notice to the rider. The lawyer made a good faith attempt to give the rider written notice with enough detail to object, the time to object has passed, and no objection was filed or the court resolved it.
2. A protective order. The parties agreed to a qualified protective order and gave it to the court, or the lawyer asked the court for one. A qualified protective order bars using the records outside the case and requires them to be returned or destroyed at the end.

You may also make those efforts yourself instead. HIPAA only says when you may disclose. Whether you must answer the subpoena, and by when, is a court question, so send it to your own lawyer the day it arrives.

Your own lawyer or insurer

Defending a claim against your company is a different matter. The dash camera guide covers sharing footage with your own lawyer and insurer, and the agreement your lawyer should sign.

When family or caregivers ask

Start by asking what role the caller has, because HIPAA treats two groups very differently.

Personal representatives stand in the rider’s shoes. Under 45 CFR 164.502(g), that is the person with legal authority to make the rider’s health care decisions. HHS gives these examples for adults: a health care power of attorney, a court-appointed legal guardian, or a general or durable power of attorney that includes health care decisions. A power of attorney limited to one decision covers only records about that decision. For a minor it is usually a parent or guardian, with exceptions that depend on state law. For a rider who has died, it is the executor or administrator of the estate. Ask to see the document, then treat that person as the rider.

Family and friends helping with care get much less. Under 164.510(b), you may share what relates directly to their part in the rider’s care or payment:

• If the rider is there and able to decide, share when the rider agrees, or does not object when given the chance, or when you reasonably judge the rider would not object.
• If the rider is absent or unable to decide, share only what is in the rider’s best interest and directly relevant, using professional judgment.

A daughter who rides along to dialysis can be told the return pickup time when her father does not object. She does not get her father’s trip history without his request or authorization. HHS’s guide for providers says HIPAA does not require proof of identity from a caller who says they are family, though you may set your own check. It also says you do not have to share when the rider is absent or incapacitated, and you may wait until the rider can agree. If the rider says no, the answer is no.

When the rider asks for their own trip records

A rider has a right to see and get copies of the information about them in your designated record set (45 CFR 164.524). If you are a covered entity, these rules apply:

1. Take the request. You may require it in writing if you tell riders so. HHS says you may not make a rider come in person, use a web portal, or mail the request.
2. Check identity without stalling. HHS leaves the method to you, as long as it does not create a barrier or delay.
3. Answer within 30 calendar days. One extension of up to 30 more days is allowed, with a written reason and a new date sent within the first 30.
4. Give the format asked for, if you can readily produce it. If the records are electronic and the rider asks for an electronic copy, give one.
5. Charge only the allowed fee: labor for copying, supplies, and postage. Searching for and pulling the records is not chargeable. HHS allows a flat fee of up to $6.50 for electronic copies of electronic records, which is an option and not a cap.
6. Never hold records for an unpaid bill. HHS says a provider may not deny access because the rider owes money.
7. Deny only in writing, in plain language, with the reason and how to complain. If you do not hold the records but know who does, tell the rider where to ask.

Never make the rider explain why they want the records. HHS says a covered entity may not require a reason.

If you run trips as a business associate, the request usually belongs to the broker or plan, and your agreement sets your part. WellTrans wants access within five business days of its request. HHS says a business associate is directly liable for failing to provide an electronic copy as its agreement requires.

Are GPS logs and camera video part of the record?

It depends on how you use them. The designated record set is a covered provider’s medical and billing records, plus any other records used to make decisions about individuals (45 CFR 164.501). GPS records you use to bill miles are part of your billing records, so treat them as in. HHS says quality improvement and business planning records used for general business decisions may fall outside, so video used only to coach drivers may not be. Video you use to make a decision about a rider can be in.

Material compiled for a lawsuit is excluded from the right of access, but the trip records underneath it stay in. The dash camera guide covers how long to keep footage.

If a rider asks you to fix a record, a covered entity must act within 60 days, with one 30-day extension (45 CFR 164.526). Make the change by adding to the record, never by erasing it. Correcting a NEMT trip record shows how.

Log every disclosure

Riders can ask a covered entity for a list of disclosures made in the six years before the request (45 CFR 164.528). Disclosures to police, and to courts and lawyers in a lawsuit, under 164.512 belong on that list. Disclosures for treatment, payment, and operations, to the rider, under the rider’s authorization, and to family under 164.510 do not.

For each listed disclosure, record:

• the date
• who received it, and their address if you know it
• a short description of what you sent
• the purpose, or a copy of the written request

You must answer a request for the list within 60 days, with one 30-day extension. The first list in any 12 months is free. If police give you a written statement that an accounting would likely impede their work, you must leave their disclosures off the rider’s list for the time they state. A spoken request holds them back for no more than 30 days unless a written one follows. Keep the log and the requests for six years (45 CFR 164.530(j)).

Business associates keep the same kind of log for the broker. WellTrans’s agreement requires you to document disclosures so it can answer a rider’s request.

How to handle any records request, step by step

1. Write it down. Note who called or came in, their agency or firm, a callback number, and exactly what they want.
2. Ask for the paper. A warrant, order, subpoena, written request, signed authorization, or power of attorney. No paper means very little can go out.
3. Check identity and authority. Look at the badge or letterhead, and call the agency or firm back at a number you find yourself.
4. Call the broker on any trip a broker sent, before you release anything.
5. Send only what is named. One trip and one clip, not the whole day or the whole file. See minimum necessary.
6. Send it safely. Use a secure method and keep a copy of exactly what went out.
7. Log it the same day, with a copy of the request.
8. Train the office. The NEMT HIPAA policy template routes every request from police, lawyers, and reporters to one person, so drivers and dispatchers never answer on the spot.