A NEMT company knows who travels to dialysis three times a week, who goes to the cancer centre and who was discharged from hospital yesterday. That information can reveal people's health conditions. It is also the kind of information marketing tools love to collect, through website pixels, CRM records, email lists and testimonials. HIPAA compliant NEMT marketing means growing your business without misusing or exposing rider health information.
This guide explains the main risk areas in plain language. It is not legal advice. HIPAA and state privacy laws are complex, and you should confirm your obligations with a qualified healthcare attorney or compliance adviser.
Does HIPAA apply to your NEMT company?
HIPAA applies to covered entities, which include health plans and healthcare providers that conduct certain transactions electronically, such as billing a health plan, and to business associates that handle protected health information (PHI) on their behalf. Depending on how you bill and whom you contract with, a NEMT provider may be a covered entity, a business associate of a broker or plan, or both. Some private pay-only operations may fall outside HIPAA but still be subject to state privacy laws and contractual obligations.
Even where HIPAA does not apply directly, treating rider information as sensitive is good practice and protects trust.
What counts as protected health information in NEMT
PHI is individually identifiable health information. In NEMT this can include a rider's name together with trip details that reveal health services: pick-ups from a dialysis centre, rides to an oncology clinic, mobility equipment, discharge dates, Medicaid IDs and trip histories. A list of names and phone numbers of dialysis riders is not a harmless marketing list.
Marketing uses that need care
| Activity | Consideration |
|---|---|
| Testimonials and case stories | Written authorization that covers the use; avoid health details |
| Rider photos and videos | Written consent; avoid identifiable health context |
| Email or text campaigns to riders | Marketing communications may require authorization; keep transactional and marketing messages separate |
| Review responses | Never confirm someone is a rider or mention health details |
| Website tracking pixels | Can send data about visits to health-related pages to third parties |
| Lead forms | Collect minimum necessary data; secure handling |
| CRM and email platforms | Keep PHI out, or use vendors with appropriate agreements |
| Social media | No rider stories or images without authorization |
Testimonial consent
Testimonials from families are powerful. Get written permission that states exactly how the testimonial will be used: website, social media, print. Under HIPAA, using PHI in marketing generally requires a valid authorization. Keep testimonials focused on service, such as punctuality and kindness, rather than diagnoses or treatments, and use names only in the form approved. Store signed authorizations securely.
Tracking pixels and HIPAA
Website analytics and advertising tools, such as analytics tags and ad platform pixels, collect information about visitors and can share it with third parties. If a tracking tool on a page about dialysis rides captures identifiers and sends them to an ad platform, that could disclose information about a person's health. HHS has published guidance on online tracking technologies for covered entities and business associates, and parts of that guidance have been challenged in court, so take current advice.
Practical steps:
- Inventory every tag and pixel on your website, including those added by plugins.
- Avoid ad platform pixels on booking forms, portals and pages that reveal specific health services, unless your adviser approves the setup.
- Never send form contents to advertising platforms.
- Consider privacy-focused analytics configurations and server-side setups with careful data minimisation.
- Use consent tools where required; see Google consent mode v2.
Secure ride request forms
Booking forms should collect only what is needed to quote and schedule: service level, mobility needs, pick-up and destination, date and contact details. Avoid asking for diagnoses. Use HTTPS, send submissions to secure systems rather than personal inboxes, limit access and set retention periods. See NEMT online booking.
PHI on your NEMT website
Never publish trip schedules, rider names or facility patient lists on your website. Facility portals with PHI must be secured with individual logins and access controls; see NEMT facility portal.
Email, SMS and CRM tools
- Separate transactional messages about a specific trip from marketing messages.
- Keep health details out of marketing lists and CRM records.
- If a vendor will store or process PHI for you, check whether a business associate agreement is required and whether the vendor will sign one.
- Get proper consent for text messaging and honour opt-outs.
Reviews and social media
Responding to a review by mentioning a rider's appointment can be a disclosure. Keep responses general and move details to private channels. Never post rider photos, stories or locations without written authorization. See NEMT reviews and NEMT social media marketing.
Train your team
Drivers, dispatchers and marketing staff all touch rider information. Train them on what not to share on social media, how to handle photos at facilities, how to answer calls asking about riders and who to ask when unsure. Document policies and review them annually.
A HIPAA compliant NEMT marketing checklist
- ☐ HIPAA status confirmed with an adviser.
- ☐ Tracking tags inventoried and reviewed.
- ☐ Booking forms collect minimum necessary data.
- ☐ Vendors handling PHI have appropriate agreements.
- ☐ Testimonial and photo authorizations on file.
- ☐ Review response guidelines written.
- ☐ Staff trained on privacy in marketing.
- ☐ Privacy policy on website accurate and current.
Privacy as a selling point
Facilities and families increasingly ask how providers protect information. A short, accurate privacy section on your website and in facility materials, explaining how you handle data and who can access it, builds trust. Do not overclaim; say "we follow documented privacy policies and train our staff" rather than "fully HIPAA certified", because there is no official HIPAA certification.
Get help reviewing your marketing setup
Projectify Lab reviews website tracking, forms and marketing tools for privacy risks and builds privacy-conscious measurement for service businesses, working alongside your legal advisers. See our conversion analytics service, our NEMT marketing and software approach, or book a demo call.
