Patient Data and HIPAA Context

When HIPAA may apply

HIPAA applies to covered health plans, health care clearinghouses, certain health care providers, and their business associates. MedicalRide's status depends on the relationship and service involved. MedicalRide is not automatically a HIPAA-covered entity merely because a request relates to health care or contains mobility information.

If MedicalRide performs services on behalf of a HIPAA-covered entity that require MedicalRide to create, receive, maintain, or transmit protected health information, a business associate agreement and additional safeguards may be required. MedicalRide must not represent that a HIPAA business associate relationship exists unless an appropriate agreement has been executed.

Consumer-submitted requests

When a patient, family member, caregiver, or other consumer independently submits a private-pay transportation request, HIPAA may not govern MedicalRide in the same way it governs a covered health care provider or health plan. Other privacy, consumer-protection, contract, security, and data-protection laws may still apply.

How MedicalRide handles ride information

MedicalRide aims to:

• Collect information reasonably relevant to the transportation request
• Avoid requesting unnecessary clinical records
• Limit or stage direct contact details where practical
• Share ride information with providers and vendors that need it for the request
• Use payment processors for card handling
• Restrict internal access according to operational need
• Require providers not to use patient information for unrelated marketing or sale
• Maintain reasonable security and operational controls

Related privacy controls

These controls support MedicalRide's sensitive ride-information handling without changing its directory-platform role.

• Clear operator identity

  MedicalRide.org is operated by Tipmunk SASU, with public controller and contact details listed in the Legal Notice and Privacy Policy.

  Legal Notice
• Directory platform boundary

  MedicalRide presents a directory and request platform. Independent providers remain responsible for transportation services, vehicles, drivers, licensing, insurance, pricing, and ride completion.

  Terms
• Consent and privacy choices

  Analytics and advertising storage default to denied, limited cookieless measurement remains consent-aware, Global Privacy Control is honored where applicable, and key consent choices are recorded.

  Privacy Choices
• Rights request workflow

  People can request access, correction, deletion, portability, consent withdrawal, and California privacy choices through a dedicated intake form.

  Data Rights
• Retention and deletion controls

  MedicalRide publishes baseline retention categories and uses review, legal-hold, and approval steps before eligible deletion or redaction runs.

  Retention
• Vendor transparency

  The vendor register lists core provider categories, data categories, transfer evidence, BAA availability, and public legal evidence links.

  Subprocessors
• Security and audit controls

  Admin/session controls, role-based permissions, rate limits, same-origin checks, and sensitive-access audit logs support privacy operations.

  Security
• Organization agreement evidence

  Organizations can accept directory-platform terms through an electronic agreement flow that records authority, accepted text, and request context.

  Organization agreement

Independent providers

Transportation providers are independent businesses and may have their own HIPAA, privacy, licensing, medical-transportation, recordkeeping, or contractual obligations. Providers are responsible for using request information only for the relevant transportation, payment, safety, support, or legal purpose.

Facilities and covered entities

A hospital, clinic, nursing facility, dialysis center, health plan, or other organization that wants MedicalRide to process protected health information on its behalf should contact MedicalRide before transmitting such information so the parties can determine whether a business associate agreement or other data-processing agreement is required.

Covered-entity workflows

MedicalRide handles covered-entity workflows only through appropriate written arrangements and designated handling channels. Health organizations should contact MedicalRide before sending protected health information on behalf of a patient or member.

• Confirm whether the customer is a HIPAA covered entity or business associate.
• Execute a business associate agreement or other required data-processing agreement before receiving PHI on behalf of that organization.
• Route PHI only through vendors and communication channels approved for the covered-entity workflow.
• Disable or avoid non-essential analytics, advertising, AI, and non-BAA vendor processing for covered-entity PHI.
• Limit email, SMS, voice, and provider outreach content to the minimum necessary information.
• Document provider obligations for request-specific use, confidentiality, retention, and incident reporting.
• Maintain access, audit, retention, deletion, and incident-response evidence for the workflow.

Vendor BAA status and restrictions are tracked in the Subprocessors and Vendor Register. Security safeguards are summarized on the Security Measures page.

Questions

For privacy or data questions, email support@medicalride.org.