A courier that handles PHI is part of your HIPAA compliance chain, not outside it. If a breach happens during transport — a lost specimen, misdirected paperwork, an unsecured handoff — your courier’s response process becomes part of your facility’s own breach response.
A business associate agreement is the starting point
Any courier handling PHI should be operating under a signed business associate agreement (BAA), which defines exactly what happens if something goes wrong on their end.
What a courier’s incident response should include
A courier should be able to tell you, before you sign, how quickly they’d notify you of a suspected breach and what documentation they’d provide to support your own reporting obligations.
Questions to ask before you sign
- Is a BAA in place? Not optional for a courier handling PHI.
- What’s the notification timeline? How fast you’d be told if something went wrong.
- What documentation is provided? Chain-of-custody records that support your own compliance reporting.
- How are incidents investigated? Whether the courier has an actual process, not an improvised one.
Talk to us about HIPAA compliance
Red Fox Medical Courier operates HIPAA/HITECH compliant with documented chain of custody on every run. Request a quote to discuss your compliance requirements.