Red Fox Medical Courier operates as a HIPAA Business Associate for every healthcare client we serve. Our end-to-end compliance program covers Business Associate Agreements, driver training, chain-of-custody documentation, and incident response — so your facility stays protected and audit-ready.

Business Associate Agreement (BAA)

We execute a signed BAA with every healthcare partner before the first pickup. Our BAA covers permissible uses and disclosures of Protected Health Information (PHI), breach notification obligations under 45 CFR §164.410, and subcontractor obligations. We maintain executed BAAs on file for a minimum of six years per 45 CFR §164.530(j).

Customizable BAA available upon request
Counter-signed within 1 business day
Reviewed annually by legal counsel

Driver HIPAA Training Program

Every Red Fox driver completes a structured HIPAA training program before handling any healthcare shipment. Training is renewed annually and documented in our personnel records. For a fuller picture of what qualified drivers should know, see our guide to medical courier driver training and certification.

Initial training covers PHI recognition, minimum necessary standard, and permissible disclosures
Practical training on tamper-evident packaging, temperature logs, and chain-of-custody forms
Annual recertification with attestation on file
Background checks conducted on all drivers

Chain-of-Custody Procedures

Every pickup and delivery is documented with a full chain-of-custody record. Our drivers capture electronic proof of pickup, condition photos, and delivery signature — creating an auditable trail from origin to destination.

Timestamped pickup confirmation with driver ID
Condition documentation at pickup and delivery
Electronic signature capture at delivery
Records retained for 6 years; available on request within 48 hours
Temperature logs for cold-chain shipments (2–8°C and frozen)

HIPAA for Lab Specimens

A lab specimen is more than a tube. The label, the requisition and the collection record can all identify a patient, which can make a specimen shipment protected health information in transit. That is why a lab, a pathology group or a clinic needs a courier that works under a signed Business Associate Agreement, not just a driver with a cooler.

What a lab should expect from its courier

A signed BAA before the first pickup. Not after, and not on request.
Minimum necessary handling. The driver needs the pickup, the destination and the handling instructions, and nothing else about the patient.
A record for every handoff. Who picked it up, when, in what condition, and who signed for it.
Temperature documentation when the specimen needs it.
A defined path when something goes wrong, so your privacy officer is not hearing about it second hand.

How Red Fox handles lab specimens

We sign a BAA with every healthcare partner before the first pickup.
Every driver completes HIPAA training before handling a healthcare shipment, and it is renewed every year with an attestation on file.
Background checks are conducted on all drivers.
Each pickup and delivery gets a chain-of-custody record: timestamped pickup confirmation with driver ID, condition documentation, and an electronic signature at delivery.
Cold-chain shipments get temperature logs, for refrigerated (2–8°C) and frozen loads.
Our incident response protocol is described below, in the section on breach notification.

For routes, STAT pickups and temperature handling, see our lab courier services. To get the BAA or certificate of insurance for your vendor file, call 1-813-489-5888 and ask for the compliance package.

Questions labs ask

Is a specimen shipment covered by HIPAA? Often, yes. If the label or paperwork can identify the patient, treat the shipment as PHI and make sure your courier operates under a BAA.

Does Red Fox sign a BAA before the first pickup? Yes. We execute a signed BAA with every healthcare partner before the first pickup.

What records can we get after a pickup? The chain-of-custody record: pickup time and driver ID, condition at pickup and delivery, and the delivery signature. For cold-chain loads, the temperature log.

Incident Response & Breach Notification

In the unlikely event of a breach or loss, Red Fox follows a documented incident response protocol aligned with the HIPAA Breach Notification Rule (45 CFR §§164.400–414). We notify the covered entity within 24 hours of discovery — well ahead of the 60-day regulatory requirement.

Immediate incident isolation and documentation
Written notification to your Privacy Officer within 24 hours
Root cause analysis and corrective action report within 10 business days
Coordination with your legal team for any required HHS reporting

Certifications & Insurance

Red Fox maintains comprehensive coverage appropriate for medical courier operations. Certificates of Insurance are available on request for vendor credentialing packets.

Commercial General Liability: $2,000,000 per occurrence
Commercial Auto: $1,000,000 per occurrence
Workers Compensation: statutory limits
HIPAA compliance attestation available upon request
Credentialing documentation available for hospital vendor portals

Request Our Full Compliance Documentation

Need our COI, BAA template, or HIPAA attestation for a vendor credentialing packet? Call us at 1-813-489-5888 or email info@redfoxmedicalcourier.com and we will send the full compliance package within 1 business day.

HIPAA Compliance — Medical Courier HIPAA Certification