Medical courier field guide · United States

HIPAA Procedures for Medical Couriers

Shipment labels, pickup records, proof of delivery, and dispatch messages can reveal information about a patient or a healthcare service. Use the steps below to keep those details limited, secure, and connected to the right shipment throughout a run.

1. Before pickup: know the approved process

Start with the shipment-specific instructions and the customer's standard operating procedure (SOP). Know which dispatch system to use, what information you need to complete the run, who may receive the shipment, and whom to call if details do not match. Use only your assigned account and keep its device locked when it is not in use. If instructions are missing or conflict, pause and ask dispatch for direction before improvising.

2. Viewing: look only at what the task requires

Use the shipment or route identifiers needed to verify pickup, delivery, and custody. Avoid opening a sealed package or reading clinical details unless the assigned task and written procedure specifically require it. Do not copy a patient name, diagnosis, specimen detail, or label into personal notes, a photograph, or an unapproved app. If information appears on a screen or paper record, keep it out of view of bystanders and put it away when the check is complete.

3. Carrying: maintain custody and limit exposure

Keep packages and any accompanying paperwork closed, intact, and under the custody described in the route instructions. Use the designated secure compartment or container; do not leave shipment information visible in a parked vehicle or shared work area. Keep unrelated passengers or people without a work need away from the shipment and its records. If a seal is damaged, a package is exposed, or custody is interrupted, contact dispatch and follow the exception procedure before continuing.

4. Handoff: confirm the destination and record custody

Deliver only to the facility, department, or recipient authorized by the instructions. Follow the customer's identity-check and proof-of-delivery steps, then record the time, location, recipient or approved identifier, and any required signature or scan in the approved system. Do not leave a shipment with an unapproved person or in an unattended location unless the written process explicitly allows it. Resolve a name, location, or package mismatch with dispatch before releasing custody.

5. Storage: keep records in approved places

Enter pickup, transfer, delivery, and exception records in the customer-approved dispatch or proof-of-delivery system. Keep paper manifests and labels with the shipment or in the designated secured return process. Do not forward records to personal email, save them in a personal photo library or cloud drive, or leave them in an unlocked vehicle. Lock the screen when stepping away. Keep or dispose of records only under the applicable contract, SOP, and retention process; do not create your own retention period.

6. Communication: use approved channels and concise updates

Send route updates through the approved dispatch channel and verify the recipient before sharing shipment information. Use the minimum routing detail your procedure calls for; a neutral status such as “pickup complete” or “delivered to receiving” is often enough. Avoid patient names and clinical details in ordinary text messages, personal email, voicemail, public radio, or social posts. If a customer-approved channel requires more detail, follow its access and handling instructions.

7. Incident or uncertainty: secure, report, and document

A lost manifest or device, wrong-recipient handoff, misdirected message, damaged seal, or suspected exposure should be reported promptly through the customer's incident path. Secure what remains, preserve relevant messages and timestamps, and record what you observed and whom you notified. Do not delete evidence, conceal the event, contact the patient on your own, or decide whether an event meets a legal breach definition. The customer's designated privacy or security contact determines the next steps and any required notifications.

A quick shift checklist

  • I know the approved system, recipient, and escalation contact for this run.
  • I have viewed and recorded only the details required by the procedure.
  • The shipment and any paperwork stayed under the required custody.
  • The handoff is documented in the approved system.
  • I reported any mismatch, loss, exposure, or other exception promptly.

Official U.S. references

These federal resources explain the rules and examples behind this operational guide. They do not determine how a particular courier agreement applies.

Use the applicable customer instructions and agreements for each shipment. Return to the resource index at Resources.