Skip to content

Menu

LexBlog, Inc. logo
NetworkSub-MenuBrowse by SubjectBrowse by PublisherJoin the NetworkGet StartedSubscribeSupportContact
Search
Close

Uber as a HIPAA business associate

By Alexis Wilpon (US) on March 7, 2018
Email this postTweet this postLike this postShare this post on LinkedIn
iStock_000017760721Large

Norton Rose Fulbright - Data Protection Report blog

Uber recently announced the launch of Uber Health, a non-emergency ride service that allows healthcare providers to schedule and pay for transportation for their patients. The stated purpose of the service is to expand medical transportation to traditionally underserved areas. Roughly 3.6 million Americans miss medical appointments each year due to lack of reliable transportation, contributing to the roughly $150 billion per year the healthcare industry loses due to missed appointments.

Healthcare providers will be able to access a digital dashboard to schedule rides for their patients. The providers will pay the cost of the individual ride rather than obtaining a monthly subscription. However, anti-kickback laws may be triggered if a provider offers certain patients free or discounted transportation. Thus, healthcare providers must be cognizant of their compliance obligations and familiar with the requirements of the federal anti-kickback statute safe harbor for ride-hailing services.

With regard to patient privacy, Uber stated that its drivers will not be given any information to indicate that the passenger hailed the ride through Uber Health, as opposed to Uber’s traditional ride share model.  Because Uber Health handles healthcare data for healthcare providers who are covered by HIPAA, Uber Health is considered a HIPAA “Business Associate” and is required to comply with HIPAA obligations, including executing Business Associate Agreements (BAAs) with healthcare organizations. Uber Health has stated that it is HIPAA compliant, and that it provides HIPAA-trained support to ensure patient privacy and security and to answer any questions the healthcare provider or staff may have relating to the service. Other steps Uber Health said it has taken to ensure HIPAA compliance include the encryption of rider information in order to safeguard PHI when ordering patient rides.

So far, over 100 healthcare organizations have tested the beta version of the program.  Not surprisingly, Uber is not the only ride-share service to enter this space.  Over the past few years, Lyft has engaged in strategic partnerships with health insurers, hospitals, and medical transport services to provide non-emergency medical transportation.  If these ventures in medical transportation prove successful, others can be expected to follow suit.

Photo of Alexis Wilpon (US) Alexis Wilpon (US)
Read more about Alexis Wilpon (US)Email
  • Posted in:
    Health Care and Life Sciences, Privacy and Cybersecurity
  • Blog:
    Health Law Pulse
  • Organization:
    Norton Rose Fulbright
  • Article: View Original Source

Call us at 1-800-913-0988 or email sales@lexblog.com.

Facebook LinkedIn Twitter RSS
The Library at LexBlog
  • About LexBlog
  • The Field We Built
  • Library at LexBlog
  • Our Beliefs
  • Our Team
  • Contact LexBlog
  • Disclaimer
  • Editorial Policy
  • Terms of Service
  • Get Started
  • Publishing Solutions
  • Compass
  • Submit a Request
  • Support Center
  • System Status
Copyright © 2026, LexBlog, Inc. All Rights Reserved.
Law blog design & platform by LexBlog LexBlog Logo