Compliance 101: The Rules That Keep You Employed
Why Compliance = Competitive Moat
Here's the reality: most people who try to start a medical courier business skip compliance. They figure they'll deal with it later. They never close the contract.
A courier who shows up with certifications in hand closes more deals — not because they're more qualified, but because they're more prepared than the last three people who called. The bar is low. Use that to your advantage.
There are three compliance areas that matter for medical couriers:
HIPAA Training
Required any time you handle packages containing patient information. Complete it directly inside VialRoute — takes 45 minutes and generates a certificate accepted by 90% of physician offices.
OSHA Bloodborne Pathogens
Required for handling lab specimens. Covers exposure prevention, PPE, and incident response. Available directly inside VialRoute — takes 30 minutes.
Background Check & MVR
Clean criminal background and motor vehicle record. Most facilities require these before signing any contract. Pull your own first so there are no surprises.
HIPAA for Couriers
HIPAA applies to medical couriers any time you transport Protected Health Information (PHI) — and you almost always are. Here's what that means in practice:
What Is PHI
Names on lab requisitions, patient IDs, account numbers on envelopes. Don't read, photograph, or discuss the contents of any package.
BAA Requirement
Any client giving you PHI-containing packages must sign a Business Associate Agreement with you before you transport. No exceptions.
Minimum Necessary Rule
Don't look at more information than you need to do your job. You need the destination. You don't need the patient's history.
Breach Protocol
Lost, damaged, or opened package = report immediately and document everything. Date, time, what happened, who you notified. Keep these records permanently.
Get HIPAA certified inside VialRoute:
VialRoute HIPAA Compliance Training →OSHA Bloodborne Pathogens
Any courier handling lab specimens has potential exposure to bloodborne pathogens. OSHA's Bloodborne Pathogen Standard applies — and the training is quick, cheap, and a strong selling point with clients.
Why Couriers Need It
Handling lab specimens = potential exposure. Even sealed packages can leak. Certification shows clients you know how to handle incidents safely.
Protocol
Use secondary containment (biohazard bags inside specimen boxes). Never transport leaking containers — refuse and document. Hand sanitizer after every handling.
Get OSHA Bloodborne Pathogen certified inside VialRoute:
VialRoute OSHA Bloodborne Pathogens Training →PPE Checklist for every run:
Required Personal Protective Equipment
Background Check & MVR
Every medical facility will run a background check and pull your Motor Vehicle Record before signing a contract. Pull your own copies first — so you're never surprised in a client meeting.
Criminal Background
Standard 7-year lookback. Most facilities use third-party screening platforms. If you have a record, misdemeanors 5+ years old rarely disqualify — be upfront with individual clients.
Motor Vehicle Record
No DUI, maximum 2 moving violations in the past 5 years. Pull from your state DMV online for $7–$15.
Chain of Custody
Every pickup needs a signature, timestamp, and manifest number. This is your legal protection. Document every handoff without exception.
Background check platforms clients commonly use:
Checkr ↗ Sterling ↗ HireRight ↗Certification Action Plan
Complete all six items before you make your first outreach call. Total time: 3–4 hours. HIPAA and OSHA certs are included in your VialRoute membership — no extra cost.
Business Associate Agreement (BAA) Template
Use this template with every client who gives you PHI-containing packages. Have an attorney review for your state.
BUSINESS ASSOCIATE AGREEMENT
This Agreement is entered into on [DATE] between:
Covered Entity: [CLIENT NAME] ("Client")
Business Associate: [YOUR COMPANY NAME] ("Courier")
1. PURPOSE: Courier will transport Protected Health Information (PHI) on behalf of Client in connection with medical specimen and document courier services.
2. OBLIGATIONS OF COURIER:
a. Not use or disclose PHI other than as permitted by this Agreement
b. Use appropriate safeguards to prevent unauthorized use or disclosure
c. Report any unauthorized use or disclosure within 24 hours
d. Make PHI available to Client upon request
e. Return or destroy all PHI upon termination
3. PERMITTED USES: Courier may use PHI solely for the purpose of performing courier services as described in the Service Agreement between the parties.
4. TERM: This Agreement shall be effective for the duration of the Service Agreement.
5. TERMINATION: Either party may terminate with 30 days written notice.
Covered Entity Signature: ___________________ Date: _________
Business Associate Signature: _______________ Date: _________
[NOT LEGAL ADVICE — Review with an attorney for state-specific requirements]