If you courier lab specimens, pharmacy deliveries, or medical records, you are not a mere delivery service — you are a HIPAA business associate with direct liability, a signed agreement that survives an audit, and a route whose profit depends on whether you price per stop, per mile, or per on-demand STAT call. The distinction matters because HHS guidance is clear: couriers that routinely handle protected health information (PHI) on behalf of a covered entity do not qualify as mere conduits.
Here is the compliance and bookkeeping that separates a medical courier from a generic driver.
HIPAA — Business Associate, Not Conduit
The Privacy Rule requires a Business Associate Agreement (BAA) between a covered entity (hospital, lab, pharmacy) and any service that creates, receives, maintains, or transmits PHI on its behalf. HHS FAQs note that postal and private couriers that are mere conduits — where PHI exposure is incidental and limited, such as a sealed envelope where the courier does not need PHI to do the job — may not require a BAA.
Medical couriers do not fit that exception. When you transport specimens labeled with patient identifiers, deliver prescriptions, or handle requisition forms, you have operational access to PHI — you need the identifiers to deliver correctly, to obtain signatures, and to maintain chain of custody. That operational access makes you a business associate, not a conduit, as the HIPAA Guide analysis emphasizes: healthcare organizations must require medical couriers to sign BAAs and to comply with the Security Rule (administrative, physical, and technical safeguards) before engagement.
What that means in practice:
- No engagement with a covered entity is valid without a signed BAA that specifies how PHI is safeguarded, how breaches are reported, and how subcontractors are handled
- You are directly liable for HIPAA violations as a business associate — not just the covered entity
- Your drivers need HIPAA training, your vehicles need access controls, and your handoff process must document chain of custody — who received what, when, and with what identifier
A courier that treats the BAA as paperwork will be uninsurable; professional and cyber liability carriers ask for it at application and at claim.
Per-Stop Pricing — The Unit Economics
Medical courier work prices three ways, often on the same route:
-
Scheduled route (milk run): Daily pickup and delivery between labs and clinics on a fixed loop at a contracted per-route or per-stop rate. Margin depends on route density — stops per hour — and on whether the contract includes wait time.
-
On-demand STAT: Urgent, often after-hours, priced at a premium (frequently 2–3× the scheduled per-stop rate) plus mileage and wait. STATs are high margin but high variance — you must staff for availability, not just for the run.
-
Dedicated and will-call: An exclusive vehicle or an ad hoc call, priced per mile plus hourly standby.
The bookkeeping mistake is to average them. A route that averages $18 per stop looks healthy until you realize scheduled stops are $12 and STATs are $45 but STATs are only 10% of stops — the average hides that the scheduled contract is underpriced.
Track revenue and direct cost per type: scheduled route revenue and driver hours vs. STAT revenue and on-call hours. That split shows whether the scheduled contract subsidizes the STAT availability you are contractually required to provide.
Route Economics Most Couriers Miss
-
Wait time is billable. Lab drop-offs often involve 15–30 minutes of intake, verification, and temperature logging. If wait is not in the contract, it is absorbed as labor. Price wait separately after a grace period (e.g., first 10 minutes included, then $1.50/minute).
-
Mileage and fuel are not overhead. Fuel, maintenance, and insurance per mile should be a direct cost per route, not a lumped vehicle expense. A route that is 48 miles with 8 stops has a different per-stop vehicle cost than one that is 22 miles with 12 stops.
-
Specimen integrity is a cost. Coolers, temperature data loggers, spill kits, and decontamination are consumable COGS per route. A single compromised specimen that requires re-collection costs more than the cooler's annual supply.
-
Compliance cost is allocable. HIPAA training, BAA administration, and background checks are often treated as overhead. Allocate them per driver per period — a driver who is not HIPAA-trained cannot legally run the route, so training is a direct cost of the service.
Keep Your Courier Records Chain-of-Custody Ready
Every pickup needs a record: patient identifier (minimum necessary), pickup time, delivery time, temperature, recipient signature, and the BAA that authorized the handling. That record is both a bookkeeping entry and a HIPAA audit exhibit. A plain-text, timestamped log that ties the job number to the ledger entry is the courier equivalent of a lab's chain of custody — and it is what proves the route was performed, priced, and compliant.
Simplify Your Financial Management
Medical courier profit is route density plus compliance discipline, not just miles driven. Beancount.io keeps every stop, every wait charge, and every BAA-covered route in plain-text, version-controlled accounting — so per-stop margin and HIPAA readiness are visible, not assumed. Get started for free and keep your medical courier finances as precise as your chain of custody.