The Compliance Risks of Using Personal Devices in NEMT Operations

Smartphones have made it remarkably easy to put powerful transportation tools into the hands of drivers. They have also created compliance and security questions that NEMT providers should not ignore.

Allowing employees to use their own phones or tablets for dispatching and trip management may initially seem like an easy way to reduce equipment costs. But when those devices are used to access passenger information, addresses, trip details, or other sensitive data, the organization needs to consider how that information is being protected.

Convenience doesn’t eliminate responsibility

A personal device is still a personal device even when an employee uses it for work.

The organization may have significantly less control over how that device is configured, who else can access it, what applications are installed, whether appropriate security updates have been applied, and what happens to locally stored information when an employee leaves the company.

Those issues become particularly important in an industry where transportation information can include individually identifiable healthcare information.

Simply instructing employees to keep information confidential isn’t a substitute for appropriate technical and administrative safeguards.

Think about access—not just the device

One of the most important questions for an NEMT provider should be: Does this employee actually need access to this information?

Drivers, dispatchers, billing personnel, managers, and administrators perform different jobs. There is rarely a good reason for every user to have identical access to every part of a transportation-management platform.

Providers should consider role-based permissions, unique user accounts, appropriate authentication requirements, and procedures for promptly terminating access when an employee no longer needs it.

Shared accounts should also be avoided. When several employees use the same credentials, determining who actually accessed or changed information can become considerably more difficult.

Mobile technology can still be an advantage

None of this means mobile devices should be avoided.

Quite the opposite.

Mobile technology can make NEMT operations considerably more efficient by giving drivers immediate access to the information they need while providing dispatchers with better information from the field.

The key is implementing that technology thoughtfully.

Mobility Route’s approach is to provide purpose-built mobile tools while giving transportation providers control over user access and the information available to different members of their organization.

Technology should make an NEMT operation more efficient without unnecessarily creating new compliance risks.

As mobile technology becomes even more central to transportation operations, providers should periodically review not only what their devices can do—but who can access their systems, what information they can see, and how that access is being protected.