1. Purpose
GoBee is a HIPAA-compliant medical courier. Hospitals, laboratories, and patients trust us with sensitive, time-critical material. This training explains what protected health information is, how couriers protect it, and what to do when something goes wrong. It supplements Sections 4 (Incident Reporting) and 5 (Code of Conduct) of the GoBee Employee Manual.
2. What is PHI?
Protected Health Information (PHI) is any information that identifies a patient and relates to their health care. On a courier run, PHI commonly appears as patient names, addresses, and phone numbers; specimen labels and requisition forms; delivery manifests and routing sheets; and the basic facts of a delivery itself, who sent what, to whom, and when. If information could identify a patient, treat it as PHI.
3. The minimum necessary rule
Access and share only the delivery information you need for your assigned run. Read the manifest details for your stops, not for other drivers' runs. Share delivery details only with dispatch and the authorized recipient. When in doubt, share less, and ask dispatch.
4. Your four duties
- Safeguard. Keep packages, labels, manifests, and devices protected at all times.
- Verify. Confirm the recipient before every handoff.
- Document. Record each delivery accurately in the company app, including signature or photo confirmation where required.
- Report. Tell dispatch immediately when anything goes wrong.
5. Chain of custody is a privacy control
Every signature, photo confirmation, and app entry is proof of delivery and a privacy control. An unbroken chain of custody proves a package went only to authorized hands. A gap in the chain is where privacy breaks down. Never skip a custody step, and never falsify one. If a record is wrong, correct it through dispatch and note the correction.
6. Do
- Verify the recipient before every handoff.
- Keep manifests and labels covered in transit.
- Send all status updates through the company app only.
- Follow the secure-placement or redelivery protocol when no authorized recipient is available.
- Keep the vehicle locked and packages out of public view.
- Keep the vehicle clean and presentable; you represent GoBee at every stop.
7. Don't
- Never photograph a label, manifest, or facility record.
- Never send delivery details by personal text or messaging app.
- Never discuss a delivery's contents, sender, or recipient with anyone outside the job, not family, not other drivers, not on social media.
- Never leave a medical item with an unauthorized person or in an unsecured location.
- Never discuss internal issues, policies, or disputes with customers.
8. Devices and the company app
All delivery information stays inside the company app. That is the only channel for delivery data. Never share your login credentials, and never let anyone else use the app under your login. Report a lost or stolen device to dispatch immediately so access can be restricted or data wiped. Close the app when it is not in use for official duties.
9. Vehicles and packages
Keep packages covered and the vehicle locked whenever you step away. Never leave a package unattended in public view. Protect temperature integrity and privacy together: a compromised package is both a clinical and a privacy incident. If a temperature excursion is suspected, hold the item as directed by dispatch and do not deliver it until cleared.
10. What counts as a breach?
A breach is any unauthorized access to, or disclosure of, PHI. Courier examples include a lost or misdirected manifest; a package delivered to the wrong recipient; a lost or stolen device that held delivery data; delivery details discussed with an unauthorized person; and a photographed label shared anywhere.
11. When something goes wrong
- Stop and secure. Retrieve what you can safely, and protect what remains.
- Call dispatch immediately by phone. Do not rely on an app message alone for accidents, injuries, specimen or package incidents, or security events.
- Do not admit fault and do not discuss liability with anyone at the scene. State only the facts.
- Do not hide it. GoBee does not punish employees for reporting incidents in good faith. A hidden incident is far more dangerous than a reported one.
- Do not discuss it outside the job. No customers, no social media, no insurers. The company handles those communications.
- Log it in the app before the end of your shift, facts only: what happened, when, where, and who was involved. A supervisor reviews every reported incident within one business day.
12. Scenarios
No authorized recipient is at the desk. Follow the secure-placement or redelivery protocol. Never leave the item with an unauthorized person.
A friend asks what you delivered to the hospital. Say nothing about contents, sender, or recipient. Neither confirm nor deny details.
You drop a manifest in a parking lot. Retrieve it if safe, call dispatch immediately, and log it. It is an incident, even if you recovered it.
A facility staff member you do not recognize asks to take a package. Verify they are authorized to receive it. If you cannot verify, call dispatch before handing anything over.
13. Training requirement and records
No operator is assigned a solo delivery until HIPAA privacy and security training is complete and documented. Training is refreshed annually and whenever procedures change. Completion is recorded in the employee's file, and any training certificate issued is kept on file. Failure to follow this training may result in disciplinary action, up to and including termination, as described in Section 6 of the Employee Manual.
Finished the slides and this documentation? Record your completion so GoBee can file it.