As ride-sharing arrangements such as Uber and Lyft seek to carve out space for themselves in the health care transportation field, health care entities that consider contracting with them need to consider the HIPAA implications of using these services to arrange rides for their patients.

Both Uber Health (Uber’s dedicated health care platform) and Lyft say they have taken the necessary steps to safeguard protected health information (PHI) as part of the rollout of their new services. But health care organizations will need to do their own due diligence before signing up, says Kenneth Kennedy, an associate with K&L Gates LLP in the Research Triangle office in North Carolina.

“First and foremost, providers should consider the risks associated with health information privacy,” Kennedy said in a webinar hosted by the law firm on April 18. For example, he said “the health care provider’s disclosure to a ride-sharing service such as Uber or Lyft of a patient’s name and address would be a disclosure of protected health information. This raises the question of whether the ride-sharing company is contracting with the health care provider, and if so, does the ride-sharing company have a business associate agreement,” or BAA?

“At this point, the model that is developing seems to be a contract directly with the health care provider or payer, which will require compliance with HIPAA and state privacy laws,” he said.

However, “the chain of information-sharing from the health care provider to the ride-sharing company to the driver” is not clear, Kennedy said. “Uber states that Uber drivers will not notice any difference between Uber Health rides and standard Uber rides in terms of the information obtained,” he said. “Nonetheless, if Uber Health obtains patient names and addresses from a health care provider pursuant to a contractual relationship between the health care provider and Uber…a business associate relationship may have been created.”