If you courier lab specimens, pharmacy deliveries, or medical records, you are not a mere delivery service — you are a HIPAA business associate with direct liability, a signed agreement that survives an audit, and a route whose profit depends on whether you price per stop, per mile, or per on-demand STAT call. The distinction matters because HHS guidance is clear: couriers that routinely handle protected health information (PHI) on behalf of a covered entity do not qualify as mere conduits.
Here is the compliance and bookkeeping that separates a medical courier from a generic driver.
HIPAA — Business Associate, Not Conduit
The Privacy Rule requires a Business Associate Agreement (BAA) between a covered entity (hospital, lab, pharmacy) and any service that creates, receives, maintains, or transmits PHI on its behalf. HHS FAQs note that postal and private couriers that are mere conduits — where PHI exposure is incidental and limited, such as a sealed envelope where the courier does not need PHI to do the job — may not require a BAA.
Medical couriers do not fit that exception. When you transport specimens labeled with patient identifiers, deliver prescriptions, or handle requisition forms, you have operational access to PHI — you need the identifiers to deliver correctly, to obtain signatures, and to maintain chain of custody. That operational access makes you a business associate, not a conduit, as the HIPAA Guide analysis emphasizes: healthcare organizations must require medical couriers to sign BAAs and to comply with the Security Rule (administrative, physical, and technical safeguards) before engagement.
What that means in practice:
- No engagement with a covered entity is valid without a signed BAA that specifies how PHI is safeguarded, how breaches are reported, and how subcontractors are handled
- You are directly liable for HIPAA violations as a business associate — not just the covered entity
- Your drivers need HIPAA training, your vehicles need access controls, and your handoff process must document chain of custody — who received what, when, and with what identifier
A courier that treats the BAA as paperwork will be uninsurable; professional and cyber liability carriers ask for it at application and at claim.
Per-Stop Pricing — The Unit Economics
Medical courier work prices three ways, often on the same route:
-
Scheduled route (milk run): Daily pickup and delivery between labs and clinics on a fixed loop at a contracted per-route or per-stop rate. Margin depends on route density — stops per hour — and on whether the contract includes wait time.
-
On-demand STAT: Urgent, often after-hours, priced at a premium (frequently 2–3× the scheduled per-stop rate) plus mileage and wait. STATs are high margin but high variance — you must staff for availability, not just for the run.
-
Dedicated and will-call: An exclusive vehicle or an ad hoc call, priced per mile plus hourly standby.
The bookkeeping mistake is to average them. A route that averages $18 per stop looks healthy until you realize scheduled stops are $12 and STATs are $45 but STATs are only 10% of stops — the average hides that the scheduled contract is underpriced.
Track revenue and direct cost per type: scheduled route revenue and driver hours vs. STAT revenue and on-call hours. That split shows whether the scheduled contract subsidizes the STAT availability you are contractually required to provide.
Route Economics Most Couriers Miss
-
Wait time is billable. Lab drop-offs often involve 15–30 minutes of intake, verification, and temperature logging. If wait is not in the contract, it is absorbed as labor. Price wait separately after a grace period (e.g., first 10 minutes included, then $1.50/minute).
-
Mileage and fuel are not overhead. Fuel, maintenance, and insurance per mile should be a direct cost per route, not a lumped vehicle expense. A route that is 48 miles with 8 stops has a different per-stop vehicle cost than one that is 22 miles with 12 stops.
-
Specimen integrity is a cost. Coolers, temperature data loggers, spill kits, and decontamination are consumable COGS per route. A single compromised specimen that requires re-collection costs more than the cooler's annual supply.
-
Compliance cost is allocable. HIPAA training, BAA administration, and background checks are often treated as overhead. Allocate them per driver per period — a driver who is not HIPAA-trained cannot legally run the route, so training is a direct cost of the service.
Keep Your Courier Records Chain-of-Custody Ready
Every pickup needs a record: patient identifier (minimum necessary), pickup time, delivery time, temperature, recipient signature, and the BAA that authorized the handling. That record is both a bookkeeping entry and a HIPAA audit exhibit. A plain-text, timestamped log that ties the job number to the ledger entry is the courier equivalent of a lab's chain of custody — and it is what proves the route was performed, priced, and compliant.
