Notice of Privacy Practices Template for NEMT: Who Needs One, the Required Parts, and a Rider Acknowledgment

A notice of privacy practices is a short, plain statement that a HIPAA covered entity gives the people it serves. It says how you may use and share their health information, what rights they have over it, and who to call. Two sentences decide whether you need one. Only a covered entity gives the notice, and a company that only drives trips for a broker or health plan under a business associate agreement is usually not one. HIPAA for NEMT providers walks through the covered entity test. If you are covered, this page holds the notice, a one-line acknowledgment, and a list of where to post it.

How to use this template

1. Settle whether you need one. Read “Who has to give a notice” below. If you are a business associate only, keep this page for reference and follow your broker agreement.
2. Fill in the brackets in Part 1. Add your company name, the effective date, a privacy contact by name or title with a phone number, and a line for any state law that limits sharing more than HIPAA does.
3. Keep every required statement. The grid under “What the rule requires in the notice” shows which lines each rule demands. Part 1 leaves out the fundraising statement because most ride companies never raise funds. Add it if you do.
4. Check the date. The effective date may not be earlier than the day you print or publish the notice (45 CFR 164.520(b)(1)(viii)).
5. Hand it out at or before the first ride with the acknowledgment in Part 2, and train drivers and dispatchers to do it the same way every time. See HIPAA training for NEMT staff.
6. Post it where Part 3 says, and put it on your website.
7. Log every version and acknowledgment in Part 4, and keep them for 6 years.

The template

Part 1: The notice

[Company name]

Notice of Privacy Practices

Effective date: ______________

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who we are. [Company name] gives rides to medical appointments. We keep information about you, such as your name, your pickup and drop-off addresses, where your appointments are, how you need help getting around, and what we are paid for your rides. This notice tells you how we use and share that information, and what you can do about it.

How we use and share your information

• To arrange your ride and work with your care. We may share what is needed with the clinic, dialysis center, or hospital at either end of your ride. For example, we call the dialysis center when you are running late or when you need help at the door.
• To get paid. We may share trip records with Medicaid, your health plan, or the broker that arranges your rides. For example, we send a claim that shows the date of your ride, where it started and ended, and who drove.
• To run our company. We may use your information to check that rides happened, keep riders safe, train drivers, review GPS and trip records, and answer complaints. For example, your health plan or ride broker may audit our trip records.
• With people who help you. If a family member, friend, or caregiver rides with you or helps with your care, we may share what they need to know. We will ask you first when we can. If you cannot answer, we may share what we believe is in your best interest.

Other times we may share your information without your written permission

The law allows or requires us to share information in these cases:

• When a federal or state law requires it.
• With public health agencies, to prevent or control disease, injury, or disability.
• With the agency that receives reports of suspected abuse, neglect, or domestic violence.
• With agencies that oversee us and the programs that pay for your rides, for audits and investigations.
• In response to a court order, or a subpoena or similar request when the steps the law requires have been followed.
• With police, in the ways the law allows, such as with a warrant, a court order, or a subpoena from a judge, or to help find a missing person.
• With a coroner, medical examiner, or funeral director.
• With groups that arrange organ and tissue donation.
• For research, when the law’s conditions are met.
• To prevent a serious and imminent threat to health or safety.
• For national security and other special government functions.
• For workers’ compensation claims.

Things that need your written permission. We will not use or share your information for marketing, sell it, or share psychotherapy notes without your written permission. We will not use or share your information in any way this notice does not describe unless you give us written permission. If you give permission, you can take it back at any time by telling us in writing.

Substance use disorder treatment records. If we receive records from a substance use disorder treatment program covered by federal rule 42 CFR part 2, we will not use or share them in a civil, criminal, administrative, or legislative case against you unless you give written consent, or a court orders it after you or the record holder are told and can respond, and the order comes with a subpoena or other legal demand that requires us to produce the records.

State laws that give you more protection. [Write one line for each state law that limits sharing more than HIPAA does, such as laws on mental health, HIV, or substance use records. Delete this paragraph if none applies to you.]

Your rights

• Get a copy of your records. You can ask to see or get a copy of the trip, billing, and other records we keep about you. We will answer within 30 days. If we need more time, we will tell you why in writing and finish within 30 more days. We may charge a reasonable fee for copying, supplies, and postage.
• Ask us to correct your records. If something in them is wrong or incomplete, tell us. We will answer within 60 days. If we say no, we will tell you why in writing.
• Ask us to contact you privately. We will say yes to reasonable requests, such as calling only your cell phone or writing to a different address.
• Ask us to limit what we share. We do not have to agree. The one exception is this: if you pay for a ride in full yourself and ask us not to tell your health plan about it, we will agree unless a law requires us to share it.
• Get a list of who we shared with. You can ask for a list of the times we shared your information in the six years before your request, with whom, and why. The list leaves out sharing for treatment, payment, and running our company, sharing you asked for, and some other cases. One list a year is free. If you ask again within 12 months, we may charge a reasonable fee, and we will tell you the fee first.
• Get a paper copy of this notice, even if you agreed to get it by email.
• Choose someone to act for you. If someone has legal authority to act for you, such as a guardian or a health care power of attorney, that person can use these rights for you.

To use any of these rights, contact: [name or title], [phone], [email], [mailing address].

Our duties. We are required by law to keep your health information private, to give you this notice of our legal duties and privacy practices, to tell you if there is a breach of your unsecured information, and to follow the notice that is in effect. We may change this notice, and the new notice will apply to all the information we have. We will post a changed notice [in our office, in our vans,] and on our website at ______________, and give you a copy if you ask.

Complaints. If you believe we violated your privacy rights, you may complain to us at the contact above, and to the U.S. Department of Health and Human Services Office for Civil Rights: 200 Independence Avenue, S.W., Washington, D.C. 20201, 1-877-696-6775, or hhs.gov/hipaa/filing-a-complaint. We will not retaliate against you for filing a complaint.

Help with this notice. [Keep only what you can do.] We will give you this notice in large print or read it to you at no cost, and we will help you get it in your language. Call [phone].

Part 2: Rider acknowledgment

I received a copy of the [company name] Notice of Privacy Practices, effective ______________.

Rider name: ______________________________

Signature: ______________________________ Date: ______________

If not signed (tick one and write the date):

Reason	Tick	What we did to ask	Staff initials and date
Rider declined to sign
Rider could not sign
Sent by email, and the rider agreed to get notices by email
Emergency, so we will give the notice as soon as we reasonably can
Other: ______________

Part 3: Posting and handout checklist

Where	What to do	Done (date)
Website	Link to the full notice from the footer of every page, and keep a page that prints cleanly
Office or lobby where riders come in	Post the notice, and keep copies riders can take
Each vehicle	Keep a copy in the vehicle and tell riders they may ask for it
First ride or intake packet	Hand the rider the notice and the Part 2 acknowledgment
Riders who agree to email	Email the notice and record the rider’s agreement
Riders who ask for a paper copy	Give one promptly, even if they agreed to email
Large print, read aloud, help in another language	Offer what you can, and attach the language notice if Section 1557 applies to you
Each time the notice changes	Post the new notice, give it on request, and update the website

Part 4: Version and acknowledgment record

Version	Effective date	Date posted	Replaced on	Keep until (6 years after replaced)

Who has to give a notice

The rule gives the right to a notice to people served by a covered entity. Section 164.520(a)(1) says an individual has a right to adequate notice of the uses and disclosures of health information that may be made “by the covered entity.” A covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in a transaction covered by HIPAA (45 CFR 160.103). HHS’s guidance (content last reviewed February 13, 2026) lists three kinds of covered entity that need not develop a notice: a clearinghouse that handles information only as a business associate, a correctional institution, and certain insured group health plans. The rule puts no notice duty on a business associate, and HHS said so when it amended the rule in 2024: unlike many Privacy Rule provisions, 164.520 applies only to covered entities, not to their business associates (89 FR 32976).

A business associate follows its contract instead. It may use or disclose health information only as its business associate agreement permits or as the law requires (164.502(a)(3)). A health plan has its own notice duty. It must give its notice to new enrollees at enrollment and tell members at least every three years that it exists and how to get it (164.520(c)(1)).

Your situation	Do you give a notice?	What to do
You only run trips a broker or plan assigns, under its business associate agreement	No. The plan or state program you work for gives riders its notice	Follow the agreement and send privacy questions to the broker or plan
You bill Medicaid or a plan electronically, and your rides count as health care	Yes, as a covered entity	Use Part 1 and give it by the first ride
You bill Medicaid yourself, and your state lists your provider type as atypical	Probably not, since CMS says atypical providers do not provide health care	Get your state’s answer and a health care lawyer’s view in writing
You are paid by private riders or facilities and send no electronic claims to plans	No. You fall outside the covered entity test	A plain privacy statement is optional; keep your promises

The second row turns on whether your rides count as health care. CMS told state Medicaid programs on September 19, 2006 (SMDL 06-020) that atypical providers do not provide health care as HIPAA defines it, and that taxi services are an example, even when they submit HIPAA transactions. States classify NEMT differently, so the guide to HIPAA for NEMT providers tells you how to check.

If you are required to have a notice, you may not use or share information in a way the notice does not allow (164.502(i)). Write only what you actually do.

Direct treatment relationship

Three duties depend on this phrase. A covered provider with a direct treatment relationship must hand over the notice by the first service, ask for an acknowledgment, and post the notice at a physical site (164.520(c)(2)). Every other covered entity must still make the notice available on request and post it on its website.

Under 45 CFR 164.501, a relationship is indirect when you deliver care on the orders of another health care provider and typically report back to that provider, who reports to the person. The rule text and HHS’s notice guidance do not say which side a ride company falls on. The safe step is to treat the relationship as direct: give the notice by the first ride and ask for the acknowledgment. The cost is one page and one signature.

When to hand it over and what to keep

These are the timing rules for a covered provider with a direct treatment relationship, as of October 2026.

• At or before the first ride. Give the notice no later than the date of first service. In an emergency, give it as soon as reasonably practicable afterward (164.520(c)(2)(i)).
• Ask for a signature. Make a good faith effort to get a written acknowledgment, except in an emergency. If you do not get one, write down your efforts and why (164.520(c)(2)(ii)).
• Post it and keep copies riders can take if you keep a physical service delivery site (164.520(c)(2)(iii)). The rule does not say whether a van counts as a service delivery site. A copy in a sleeve inside each van, and one posted in your office if riders visit, settle the question for the cost of a page.
• Put it on your website if the site describes your services (164.520(c)(3)(i)).
• Email only with the rider’s agreement. If the email fails, send paper (164.520(c)(3)(ii)).
• Revise it promptly when there is a material change to your uses and disclosures, the rider’s rights, your duties, or your other privacy practices. A material change may not take effect before the effective date of the notice that states it, unless the law requires it (164.520(b)(3)).
• After a revision, make the new notice available on request on or after its effective date and update your posting. You do not have to hand the new version to every rider (164.520(c)(2)(iv)).
• Keep copies and acknowledgments for 6 years from the date created or last in effect, whichever is later (164.520(e) and 164.530(j)(2)).

HHS proposed on January 21, 2021 (86 FR 6446) to drop the written acknowledgment. As of October 2026, the Federal Register shows no final rule from that proposal, so the acknowledgment rule stands.

What changed in 2026: substance use disorder records and the vacated statements

One HIPAA rule changed what the notice must say: the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (89 FR 32976, April 26, 2024). Its changes to the notice rule, which add a substance use disorder statement and three reproductive health statements, were due on February 16, 2026. The separate final rule on substance use disorder records (42 CFR part 2; 89 FR 12472, published February 16, 2024; effective April 16, 2024) did not change 164.520. It rewrote the patient notice that substance use disorder treatment programs give, with the same February 16, 2026 compliance date.

Substance use disorder records. HHS’s model notices page says that as of February 16, 2026, covered entities must include information about substance use disorder patient records in their notice. The rule text asks for a statement that such records may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against the person without written consent or a court order after notice and a chance to be heard, and that the order must come with a subpoena or other legal requirement (164.520(b)(1)(iii)(D)). The notice in Part 1 carries that paragraph. HHS’s revised model provider notice includes a short version of it for every provider.

The limits in 42 CFR part 2 reach a ride company that receives records directly from a treatment program and is told they may not be redisclosed (42 CFR 2.12(d)(2)(i)(C)). A standing order or attendance sheet that carries that notice is the example the guide to methadone clinic rides describes.

Reproductive health statements. On June 18, 2025, the U.S. District Court for the Northern District of Texas vacated the 2024 reproductive health rule in Purl v. HHS except its changes to 164.520, which it severed so they stand, and then vacated three paragraphs of those changes, 164.520(b)(1)(ii)(F), (G), and (H) (opinion, pages 63 and 64). HHS’s reproductive health page says the remaining notice changes are in effect, and that compliance is required by February 16, 2026. The eCFR text as of October 2026 still prints the three paragraphs, but HHS’s revised February 2026 provider model notice does not contain them, and neither does the notice in Part 1.

What the rule requires in the notice

Required part	Rule (45 CFR)	Where it is in Part 1
The header in capital letters	164.520(b)(1)(i)	The sentence under the title
One example each for treatment, payment, and operations	164.520(b)(1)(ii)(A)	“How we use and share your information”
Every other use without written permission	164.520(b)(1)(ii)(B)	“Other times we may share your information”
The stricter law, such as 42 CFR part 2 or a state law	164.520(b)(1)(ii)(C) and (D)	The substance use disorder and state law paragraphs
What needs written permission, and how to revoke it	164.520(b)(1)(ii)(E)	“Things that need your written permission”
The proceedings statement for substance use disorder records	164.520(b)(1)(iii)(D)	“Substance use disorder treatment records”
Fundraising opt-out, only if you raise funds	164.520(b)(1)(iii)(A)	Not in Part 1; add it if you fundraise
The rights, and how to use them	164.520(b)(1)(iv)	“Your rights”
Your duties and your right to change the notice	164.520(b)(1)(v)	“Our duties”
How to complain, and no retaliation	164.520(b)(1)(vi)	“Complaints”
A contact name or title and phone number	164.520(b)(1)(vii)	The line under “Your rights”
An effective date	164.520(b)(1)(viii)	The line under the title

The notice must be written in plain language (164.520(b)(1)). The response times in Part 1 come from the rights rules: 30 days with one 30-day extension for a copy of records (164.524), 60 days with one 30-day extension for a correction or an accounting (164.526 and 164.528), the six-year look back and one free accounting in 12 months (164.528), and a yes to reasonable requests for private contact (164.522(b)). If a rider asks you to limit sharing and pays in full for a ride, you must agree to keep it from their health plan unless a law requires the sharing (164.522(a)(1)(vi)).

The examples behind each use

Each example in Part 1 sits on a rule. Telling the clinic at the other end that a rider is on the way is coordination with a third party, which the definition of treatment includes (164.501), and a covered entity may disclose information for another provider’s treatment activities (164.506(c)(2)). Claims to Medicaid or a plan are payment, which includes billing and claims management (164.501). Trip, GPS, and audit reviews fall under health care operations, which include auditing functions and fraud and abuse detection (164.501), and a covered entity may disclose information to another covered entity for fraud and abuse detection when both have a relationship with the rider (164.506(c)(4)). A family member on the ride falls under 164.510(b): with the rider present, you need the rider’s agreement, a chance to object, or a reasonable inference of no objection. Reviews by Medicaid and its auditors are oversight (164.512(d)), and police requests follow 164.512(f). For what to release to police, lawyers, and families, see rider records requests. Disclosures to police and courts must be tracked, because the accounting right covers them (164.528).

Plain language, large print, and other languages

The notice rule sets one standard for how the notice reads: plain language (164.520(b)(1)). Keep sentences short and put the rider’s rights ahead of legal detail. Offering the notice in large print, read aloud, or with help in another language is good practice. If Section 1557 covers your company, it is a duty: language help and accessible formats must be free of charge (45 CFR 92.201 and 92.202), and the notice of availability of language assistance must accompany the notice of privacy practices when you provide it (92.11(c)(5)(ii)). The Section 1557 notice template has that notice and a place to track it. For the policies and training that stand behind the notice, use the HIPAA policy template.