Medical Courier Service Guide

How to Start a Medical Courier Service: Licenses, HIPAA, and Compliance Requirements (2026 Guide)

Medical couriers have lower barrier to entry than most healthcare businesses — but HIPAA obligations, DOT specimen transport rules, and insurance requirements trip up most new operators before they get their first hospital contract. This guide covers every requirement in the order you'll actually need them.

Updated April 18, 2026 12 min read

Not legal advice. Requirements may change — always verify with your local government authority before applying. Last verified: .

The quick answer

  • 1Form an LLC and get a business license first. Most hospital and lab procurement departments won't consider a vendor that isn't properly registered.
  • 2Get commercial auto insurance before your first pickup. Personal auto policies exclude commercial delivery use — a denied claim during a specimen transport accident creates serious liability.
  • 3Complete DOT/IATA Category B biological substance training. It's inexpensive ($100–$300 online), takes a few hours, and is required before you can legally transport diagnostic specimens under DOT regulations.
  • 4Write HIPAA policies and sign Business Associate Agreements with each healthcare client. Clients will ask for your HIPAA documentation during the onboarding process.

1. What medical couriers actually transport — and why it matters for licensing

Medical courier services transport items across a spectrum of regulatory complexity:

  • Medical records and non-specimen documents: The simplest category. HIPAA applies because records contain protected health information (PHI), but there are no DOT transport requirements for paper documents in sealed envelopes.
  • Prescription medications and medical supplies: Generally no special transport license, but state pharmacy board rules may apply if you're regularly transporting controlled substances. Most courier contracts with pharmacies or medical supply companies involve only standard equipment and non-controlled medications.
  • Diagnostic specimens (blood, urine, tissue): The most regulated category. These are Category B biological substances under DOT 49 CFR 173.199 and IATA P650. They require specific packaging (triple containment with absorbent material), UN3373 labeling, and transport training. Most clinical lab pickup-and-delivery work falls here.
  • Temperature-sensitive biologics and vaccines: Some specimens and medications require cold chain management — maintaining a specific temperature range from pickup to delivery. This adds equipment requirements (validated coolers, temperature loggers) and documentation obligations.
  • Human organs and tissue for transplant: The most time-critical and complex category. UNOS regulations, organ procurement organization (OPO) protocols, and often FAA/charter aviation coordination apply. This is specialized enough that most new medical courier businesses don't touch it for years.

Most medical courier startups focus on specimen transport for clinical labs, physician offices, and hospitals. That's the sweet spot: consistent recurring contracts, predictable routes, and compliance requirements that are substantial but manageable.

2. Step-by-step licensing and compliance requirements

Step 1: Form an LLC and register your business

Filed with: State Secretary of State Typical cost: $50–$500 Timeline: 1–2 weeks

Healthcare clients — hospitals, labs, clinics — have vendor qualification processes that require a registered legal entity, an EIN, and proof of business insurance. Form your LLC first, then get your EIN from the IRS (free online, takes minutes). Sole proprietor setups work for very small operations, but LLCs are standard for any business working with healthcare facilities.

Step 2: Get a business license

Filed with: City or county clerk Typical cost: $50–$200/year Timeline: 1–2 weeks

Required in every state. Some cities require courier services to register with the city clerk separately. If you'll operate across multiple counties or cities, check whether each jurisdiction requires its own license — some do, many don't.

Step 3: Get commercial auto insurance

From: Commercial auto carrier Typical cost: $2,500–$5,000/vehicle/year Timeline: Same day to 1 week

This is the most important insurance step and the one most new operators skip by mistake. Your personal auto policy does not cover accidents that occur while you're using the vehicle for business purposes. Many personal policies will deny claims outright if the vehicle was being used for commercial delivery at the time. Get a commercial auto policy that covers each vehicle you use for pickups and deliveries before you take your first job.

Step 4: Complete DOT Category B biological substance training

From: IATA-accredited or DOT-compliant training provider Typical cost: $100–$300 per person Timeline: 4–8 hours online

DOT 49 CFR 172.704 requires hazmat employee training before anyone handles or transports regulated materials, including Category B biological substances. For medical specimen transport, you need training that covers packaging requirements, labeling (UN3373), documentation, emergency response, and security. IATA offers a Dangerous Goods Regulations course; several online providers offer DOT-compliant courses specifically for medical specimen transport for $100–$300. Training must be recertified every 3 years.

Step 5: Get proper specimen transport containers

From: Medical supply vendors Typical cost: $200–$1,500 Timeline: 1–2 weeks for delivery

DOT requires triple containment for biological specimens: a primary sealed container (the tube or vial), a leak-proof secondary container, and a rigid outer packaging. The outer packaging must be labeled "Biological Substance, Category B" with the UN3373 mark and a UN-compliant diamond hazmat label. Many labs provide their own specimen bags and labels — but you should have your own transport bags and coolers that meet these standards. For temperature-sensitive specimens, a validated cooler with ice packs or gel packs is required.

Step 6: Write HIPAA policies and procedures

From: HIPAA compliance consultant or template provider Typical cost: $200–$800 for templates or consulting Timeline: 1–2 weeks

As a Business Associate under HIPAA, you need written policies covering: how you handle PHI on lab requisition forms and specimen labels; how you secure transport containers; your breach notification procedure if a specimen is lost or compromised; and your workforce training program. These don't need to be elaborate — a clear 5–10 page policy document is sufficient for most medical courier operations. Healthcare clients will ask for this documentation during vendor qualification.

Step 7: Sign Business Associate Agreements (BAAs)

With: Each healthcare client (hospital, lab, clinic) Typical cost: Free (legal review $200–$500 recommended) Timeline: Before first pickup

HIPAA requires covered entities (healthcare providers, labs) to have a signed BAA with every Business Associate that handles PHI on their behalf. Most hospital and lab clients will present their own BAA template. Have a healthcare attorney review it before signing — BAAs can include indemnification clauses that create significant liability exposure if there's a breach on your end.

Step 8: Obtain general liability and cargo insurance

From: Commercial insurance carrier Typical cost: $800–$2,500/year Timeline: Same day to 1 week

General liability covers bodily injury and property damage during your operations. Cargo insurance (sometimes called inland marine) covers loss or damage to specimens in transit — a critical gap that standard GL policies don't fill. If a batch of time-sensitive specimens is lost or spoiled during transport, cargo insurance is what covers you. Hospital and lab contracts often specify minimum cargo coverage limits.

3. OSHA bloodborne pathogen requirements

OSHA 29 CFR 1910.1030 (Bloodborne Pathogens Standard) applies to workers who may be exposed to blood or other potentially infectious materials. Medical couriers who handle clinical specimens fall under this standard. Key requirements:

  • Exposure Control Plan: A written plan identifying tasks that involve potential bloodborne pathogen exposure and the controls in place to minimize risk. This can be a short document — the key is that it exists and is updated annually.
  • Personal Protective Equipment: Gloves required when handling specimen containers. If there's any risk of splashing (a leaking container, for example), face protection is required. PPE must be provided by the employer at no cost to employees.
  • Hepatitis B vaccination: Employers must offer Hepatitis B vaccination at no cost to employees with occupational exposure risk. Employees can decline in writing.
  • Training: Annual training required for all employees with occupational exposure. Training must cover how bloodborne pathogens are transmitted, symptoms of infection, the exposure control plan, and what to do after an exposure incident.

For a solo owner-operator, these requirements are lighter — you're not an "employer" under OSHA's definition — but the practical safety measures (gloves, proper containers, not eating/drinking in the vehicle during transport) are worth following regardless.

4. State-by-state medical courier requirements

Federal DOT, OSHA, and HIPAA set the floor. Some states add specimen transport, biohazardous materials, or clinical lab courier requirements on top. This table covers 10 major states.

State Regulating agency Additional requirements Biohazard waste transport Notes
California Cal/OSHA + CDPH Cal/OSHA BBP standard (sharps injury log), CDPH lab regulations DTSC permit required Lab courier relationships may require lab compliance documentation
New York NYS DOH 10 NYCRR Part 58 specimen transport rules for NYS-licensed labs DEC permit required Strictest state lab oversight; courier must meet lab's transport SOP
Texas DSHS Biohazardous waste transport permit for clinical waste disposal runs DSHS permit + manifest Active specimens exempt; waste runs need separate permit
Florida AHCA Lab license provisions for approved courier relationships DEP registration Check each client lab's AHCA license for courier provisions
Pennsylvania DOH 28 Pa. Code Chapter 5 clinical lab standards reference specimen transport DEP permit required Philadelphia has additional local health department requirements
Illinois IDPH Clinical lab regulations reference courier qualification EPA permit required Chicago requires separate city business license for couriers
Ohio ODH Federal baseline + business license OEPA registration Infectious waste transport registration for disposal runs
Georgia DPH Federal baseline + business license EPD permit for biomedical waste Metro Atlanta area may require county-level registration
New Jersey DOH NJ clinical lab improvement regulations cover specimen handling DEP permit + tracking Strict regulated medical waste tracking system
Massachusetts DPH 105 CMR 480 lab regulations reference specimen chain of custody DEP license required Boston requires city courier registration

Most states follow federal baseline (DOT + OSHA + HIPAA + business license). Contact your state health department before transporting anything beyond standard diagnostic specimens.

Form your business entity

Before applying for permits, you need a registered business. LegalZoom makes LLC formation fast and simple.

Form your LLC with LegalZoom →

Affiliate disclosure · no extra cost to you

5. Insurance stack for medical couriers

Insurance is what separates professional medical courier operations from people running specimens in their personal car. Hospital and lab procurement departments verify coverage before awarding contracts.

Coverage type What it covers Typical limits Annual cost
Commercial auto liability Accidents while driving on courier runs $1M CSL $2,500–$5,000/vehicle
General liability (CGL) Bodily injury/property damage at client locations $1M occ / $2M agg $500–$1,500
Cargo / inland marine Lost, damaged, or spoiled specimens in transit $25K–$100K per shipment $300–$1,500
Professional liability (E&O) Errors in handling, mislabeling, chain-of-custody failures $1M per claim $500–$2,000
Cyber / HIPAA breach Data breach notification costs, regulatory fines $500K–$1M $300–$1,000
Workers' compensation Employee injuries (bloodborne pathogen exposure, vehicle accidents) State statutory limits $1,500–$4,000/driver

Total annual insurance for a one-vehicle operation: $5,600–$15,000. Hospital contracts typically require proof of commercial auto ($1M), CGL ($1M/$2M), and cargo coverage before onboarding.

6. Cold chain management and specimen integrity

Specimen integrity is the core value proposition of a medical courier. A compromised specimen means a patient needs to be redrawn, a diagnosis is delayed, and your client lab loses money. Temperature control is the most critical factor.

Ambient specimens (15–25°C / 59–77°F)

Most routine blood draws (CBC, CMP, lipid panels) transport at ambient temperature. An insulated bag is sufficient for short runs (under 2 hours). In extreme weather — summer heat above 95°F or winter cold below 32°F — even ambient specimens need insulated containers with temperature buffering. A simple cooler with no ice packs maintains ambient range in moderate conditions.

Refrigerated specimens (2–8°C / 36–46°F)

Coagulation studies, ammonia levels, certain hormones, and many reference lab tests require refrigeration. Use a validated cooler with gel ice packs — not wet ice, which can freeze specimens and cause hemolysis. Pre-condition gel packs in a refrigerator (not freezer) for 2–8°C transport. Include a calibrated temperature logger or indicator strip to document that the chain was maintained. Labs will reject specimens that arrive outside range.

Frozen specimens (-20°C / -4°F or colder)

Specialty tests (drug levels, some immunology panels, genetic testing) require frozen transport. Dry ice is the standard method — but DOT classifies dry ice as a hazardous material (UN1845, Class 9 Miscellaneous). Quantities over 2.5 kg per package require DOT-compliant marking, labeling, and documentation. Many reference lab pickups involve dry ice. Make sure your DOT training covers Class 9 hazmat handling.

Temperature monitoring and documentation

Invest in digital temperature data loggers ($30–$150 per unit) that record time-stamped temperature readings throughout the transport. Some labs require these logs with every delivery. Single-use temperature indicator strips ($0.50–$2 each) are a lower-cost alternative for routine runs. Document the temperature at pickup and delivery on your chain-of-custody form. If a specimen arrives outside range, notify the lab immediately — some tests can still be run if the deviation was brief and within tolerance.

7. Revenue model and pricing strategies

Medical courier pricing varies by market, route complexity, and urgency. Understanding the common models helps you price competitively while maintaining margins.

Revenue stream Pricing model Typical rate Margin notes
Scheduled route runs Monthly contract, fixed route $800–$3,000/month per route Highest margin — predictable volume, optimized routing
Per-stop pricing Per pickup or delivery $15–$40/stop Good for multi-client routes; stack 6–10 stops per run
STAT / urgent runs On-demand, time-critical $50–$150/run Premium pricing; hospitals expect 30–60 min response
After-hours / weekend Off-peak surcharge 1.5x–2x standard rate Less competition; urgent care and ER volume peaks weekends
Dedicated vehicle/driver Hourly or daily rate $35–$75/hour or $400–$800/day Hospital systems and large labs; guaranteed utilization

A single-vehicle operator running 2 scheduled routes + STAT coverage can realistically generate $4,000–$8,000/month gross revenue. After vehicle costs, insurance, and fuel, net margins of 40–55% are typical for owner-operators.

Scaling from one vehicle to a fleet

The economics shift favorably as you add vehicles. Fixed costs (HIPAA compliance, software, accounting) are spread across more revenue. The key inflection point is typically the third vehicle — at that scale, you can offer 24/7 STAT coverage and bid on hospital system contracts that require guaranteed availability. Most single-vehicle operators reach the three-vehicle milestone within 18–24 months of launch by reinvesting route profits into a second vehicle and hiring a part-time driver.

8. How to land your first medical courier contracts

Compliance gets you in the door — but you still need to find clients. Here's how most medical courier businesses build their initial contract base:

  • Independent clinical labs: Quest Diagnostics and LabCorp have their own courier fleets, but regional and independent labs often use third-party couriers for off-hours pickups, rural routes, and overflow capacity. Call the lab manager or logistics coordinator directly — not the front desk.
  • Physician offices and specialty clinics: Offices that draw blood and ship specimens to outside labs need reliable courier pickup. This is often a daily or twice-daily run. Build a route that serves multiple clinics in one geographic area to make the economics work.
  • Hospitals: Hospital supply chain departments manage courier contracts. Vendor registration is often required (W-9, proof of insurance, HIPAA documentation) before they'll consider you. The procurement process can take 60–120 days — start early.
  • Urgent care centers: High-volume, reliable specimen generators. Often underserved compared to hospital-adjacent clinics. A Saturday/Sunday courier can build a solid base of urgent care center clients who struggle to find weekend pickup coverage.
  • Reference labs and specialty testing: Some specialized testing (toxicology, genetic testing, send-out reference labs) requires couriers with specific chain-of-custody documentation. Higher compliance requirements but less competition for contracts.
  • Veterinary clinics and animal hospitals: An often-overlooked market. Vet clinics send blood, urine, and tissue samples to reference labs (IDEXX, Antech) daily. HIPAA does not apply to animal specimens, simplifying compliance. The pricing and logistics are identical to human specimen transport. Many vet clinics in suburban and rural areas lack reliable courier options.
  • Dental offices and oral surgery centers: Oral pathology specimens (biopsies, tissue samples) require courier transport to pathology labs. Dental offices typically have 1–3 pickups per week — lower volume but easy to add to an existing route. Contact the office manager or oral surgeon directly.

Pro tip: Prepare a one-page "Vendor Qualification Packet" that includes your LLC registration, EIN, insurance certificates, HIPAA compliance summary, DOT training certificates, and a list of specimen types you're qualified to transport. Having this ready to hand over at the first meeting dramatically accelerates the onboarding process.

9. Common mistakes that derail medical courier startups

  • Using a personal auto policy. This is the most common and most serious mistake. The financial exposure from a denied insurance claim after an accident is not theoretical. Commercial auto insurance before you transport your first specimen.
  • Skipping DOT training. DOT Category B transport training is required by federal law. It takes a few hours and costs $100–$300. Operating without it creates a regulatory violation that can void your insurance if there's an incident.
  • Not signing BAAs before starting work. Some new couriers start transporting specimens for a clinic without a formal BAA, assuming the client will send paperwork eventually. Under HIPAA, operating without a BAA is a violation for both parties. Get it signed before the first pickup.
  • Underpricing routes without accounting for vehicle costs. Medical courier rates vary by region but typically run $15–$40 per stop or $35–$75/hour for dedicated routes. Calculate vehicle depreciation, fuel, insurance, and your time before agreeing to a flat-rate contract.
  • No chain-of-custody documentation. If a specimen arrives at the lab in poor condition or is reported missing, a documented chain of custody is your protection. Track pickup times, condition of containers at pickup, delivery times, and recipient signatures for every run.
  • Using wet ice instead of gel packs for refrigerated specimens. Wet ice can freeze specimens on contact, causing hemolysis and destroying the sample. Pre-conditioned gel packs from a refrigerator (not freezer) maintain the 2–8°C range without freezing risk. Labs will reject hemolyzed samples.
  • Not validating cooler performance in your climate. A cooler that holds 2–8°C for 4 hours in a 72°F office may fail within 90 minutes in a vehicle parked in 100°F summer heat. Test your coolers under real-world conditions — in your vehicle, in your climate, during the season you'll be operating. Document the validation.
  • Neglecting the hospital vendor registration timeline. Hospital procurement departments often require 60–120 days to onboard a new vendor — W-9, insurance certificates, HIPAA compliance documentation, background checks, and sometimes a site visit. Start the registration process months before you expect to begin service. Many new operators lose their first potential hospital contract because they assumed they could start immediately after the sales conversation.

Form your business entity

Before applying for permits, you need a registered business. LegalZoom makes LLC formation fast and simple.

Form your LLC with LegalZoom →

Affiliate disclosure · no extra cost to you

Frequently asked questions

Do you need a special license to start a medical courier service?
At the federal level, no specialized courier license is required. You need a standard business license and commercial auto insurance. The complexity comes from what you're transporting: human blood, tissue, and diagnostic specimens are Category B biological substances under DOT/IATA regulations, which imposes packaging, labeling, and training requirements. Some states add their own biohazardous materials transport requirements on top. HIPAA also applies when you transport specimens tied to identifiable patients.
Does HIPAA apply to medical couriers?
Yes, but the extent depends on what you're handling. If you're transporting specimens with patient identifiers — lab requisition forms, labeled tubes, patient paperwork — you're likely a HIPAA Business Associate and should sign a Business Associate Agreement (BAA) with each healthcare client. You don't need to be a covered entity yourself. You do need written HIPAA policies, staff training, and a process for handling potential breaches. Clients (hospitals, labs, clinics) will ask for your HIPAA compliance documentation before hiring you.
What does it cost to start a medical courier service?
A single-vehicle medical courier startup typically runs $10,000–$30,000: a reliable vehicle ($5,000–$20,000 used), commercial auto insurance ($2,500–$5,000/year), an insulated specimen transport bag or container system ($200–$800), business licensing ($100–$500), DOT hazmat training ($100–$300), HIPAA training and policy documentation ($200–$500), and initial operating capital. The vehicle is the biggest variable. Refrigerated transport for temperature-sensitive specimens adds a powered cooler or refrigerated unit ($500–$3,000).
What insurance does a medical courier need?
Commercial auto insurance is mandatory — personal auto policies exclude commercial delivery use. Medical couriers typically carry $1 million in commercial auto liability. You should also carry commercial general liability ($1 million per occurrence) that covers cargo handling. Cargo insurance or inland marine coverage protects against liability for specimens that are lost, damaged, or compromised in transit. Some hospital and lab clients will require proof of all three before awarding a contract. Budget $3,500–$7,000/year for a full insurance package.
What is Category B biological substance transport and does it apply to me?
DOT 49 CFR 173.199 and IATA P650 govern the transport of Category B biological substances — diagnostic specimens, patient samples, and non-infectious biological materials that don't meet criteria for Category A (extreme hazard) classification. Most medical courier work falls here. Requirements include proper secondary containment (leak-proof inner + outer packaging), absorbent material between layers, specific labeling ("Biological Substance, Category B"), and UN3373 marking on the outer package. The driver doesn't need a hazmat endorsement for Category B, but you do need training.
Can I start a medical courier service from home?
Yes. Most medical couriers operate out of their vehicle rather than a commercial location. You need a registered business address (your home address is fine for LLC registration), commercial auto insurance that covers your vehicle for business use, and proper specimen transport equipment. You don't need a commercial facility unless you're storing specimens overnight or processing samples yourself — which would cross into laboratory territory requiring separate state lab licensing.
What are the most important contracts to have in place before operating?
Three documents are standard: a Service Agreement with each client specifying scope, pricing, liability limits, and chain of custody procedures; a Business Associate Agreement (BAA) for HIPAA compliance with each healthcare client; and a Chain of Custody Form used for each pickup and delivery. These protect both you and your client if a specimen is lost, damaged, or shows up in the wrong condition. Many labs and hospitals will provide their own versions of these documents — review them carefully before signing.
How does cold chain management work for medical specimen transport?
Cold chain management is the process of maintaining a specific temperature range from the moment a specimen is collected to the moment it arrives at the lab. Different tests require different temperature ranges, and failure to maintain the correct temperature can render a specimen unusable — meaning the patient must be redrawn and the test is delayed. Ambient transport (15–25°C / 59–77°F) covers most routine blood draws including complete blood counts, comprehensive metabolic panels, and lipid panels. An insulated transport bag is sufficient for short runs under 2 hours, but in extreme weather — summer heat above 95°F or winter cold below 32°F — you need insulated containers with temperature buffering even for ambient specimens. Refrigerated transport (2–8°C / 36–46°F) is required for coagulation studies, ammonia levels, certain hormones, and many reference lab send-out tests. Use a validated cooler with gel ice packs conditioned in a refrigerator (not freezer) to maintain the 2–8°C range. Never use wet ice directly — it can freeze specimens and cause hemolysis, destroying the sample. Include a calibrated temperature data logger ($30–$150) that records time-stamped readings throughout transport. Frozen transport (-20°C or colder) is required for specialty tests including drug levels, some immunology panels, and genetic testing. Dry ice is the standard method. However, DOT classifies dry ice as UN1845 Class 9 Miscellaneous Dangerous Goods — quantities over 2.5 kg per package require compliant marking, labeling, and documentation. Your DOT training must cover Class 9 hazmat handling. Documentation is critical: record the temperature at pickup and delivery on your chain-of-custody form. If a specimen arrives outside range, notify the lab immediately. Some tests have tolerance windows where brief deviations don't invalidate the sample.
What technology and software do medical couriers use?
Technology differentiates professional medical courier operations from casual delivery services. The right tech stack improves route efficiency, proves compliance, and gives clients visibility into their specimens. Route optimization software is the highest-ROI investment. Medical courier routes involve multiple time-sensitive pickups with specific delivery windows — a lab may need specimens by 2:00 PM for same-day processing, while another client has a 4:00 PM cutoff. Route optimization tools like Route4Me, OptimoRoute, or OnFleet calculate the most efficient sequence of stops considering traffic patterns, time windows, and priority levels. Cost: $30–$150/month. GPS tracking with client-facing visibility is increasingly expected by hospital and lab clients. Real-time GPS lets the lab see when their courier is approaching, enabling them to prepare receiving. It also provides proof of delivery timing for SLA compliance. Fleet tracking solutions like Samsara, Verizon Connect, or GPS Trackit run $20–$40/month per vehicle. Electronic chain-of-custody documentation replaces paper logs. Apps like SpecimenCare, CourierTracker, or custom-built solutions on platforms like GoCanvas capture pickup/delivery timestamps, recipient signatures, temperature readings, and photos of specimen condition — all linked to a barcode or specimen ID. This creates an auditable digital trail that satisfies HIPAA documentation requirements and protects you if a specimen is later disputed. Digital temperature monitoring systems with cloud connectivity (LogTag, Tempsen, or DicksonOne) automatically upload temperature data to a dashboard, eliminating manual logging and providing real-time alerts if a cooler goes out of range during transport. Accounting and invoicing software integrated with your route data streamlines billing. Most medical courier contracts are invoiced monthly based on stop counts or route completions.
How do I handle a HIPAA breach or specimen loss incident?
A HIPAA breach or specimen loss is the most serious operational event a medical courier can face. How you handle it determines whether you keep the client — and whether you face regulatory penalties. Immediate response (first 60 minutes): Stop and assess. If a specimen is lost, damaged, or compromised, document everything immediately — time of discovery, last known location, condition of transport containers, what may have gone wrong. Notify your client lab or healthcare facility verbally within one hour. They need to know so they can re-order the test or notify the patient's physician. Written notification (within 24 hours): Send a written incident report to every affected client. Include: date and time of incident, specimens affected (by type and volume, NOT patient names in the notification), root cause if known, and corrective actions you're taking to prevent recurrence. HIPAA breach assessment: If the incident involved protected health information (PHI) — patient names on labels or requisition forms — you must perform a breach risk assessment under 45 CFR 164.402. The four-factor test evaluates: the nature and extent of PHI involved, who received or accessed it, whether PHI was actually acquired or viewed, and the extent to which risk has been mitigated. If the assessment determines that a breach occurred, HIPAA requires notification to the covered entity (your client) without unreasonable delay, and no later than 60 days from discovery. Your BAA with each client will specify your breach notification obligations — many hospital BAAs require notification within 24–48 hours, faster than the HIPAA 60-day maximum. Failing to notify per your BAA terms is both a HIPAA violation and a breach of contract. Corrective action: Document what you changed to prevent recurrence. This might be new container protocols, additional training, revised route procedures, or equipment upgrades. Your HIPAA compliance documentation should include an incident log that tracks every event and corrective action.

Find the exact permits required in your area

Business license requirements, local transport permits, and state biohazardous materials rules vary by jurisdiction. StartPermit's free permit finder shows you the specific agencies, fees, and forms for your city and state — so you start compliant from day one.

Find my medical courier permits

Related Guides

Official Sources

Stop guessing about permits

Know exactly what permits your business needs

Get a personalized permit report with every license, registration, and permit required for your business — with costs, timelines, and official application links.

Get Your Permit Report — $9.99
Ready in ~60 seconds Secure payment via Stripe 50 states, 4,000+ jurisdictions