Protecting patient privacy on every run
Welcome to GoBee's HIPAA training. This is required before your first solo delivery, and refreshed every year.
It takes about 10 minutes. Tap Next to begin, or swipe left.
Why this training exists
GoBee's business is trust. Hospitals, laboratories, and patients rely on us with sensitive, time-critical material.
One careless moment, a photographed label, a package discussed with the wrong person, a manifest left behind, can cost a client, cost GoBee its reputation, and expose a patient.
Privacy is not paperwork. It is part of the delivery itself.
What is PHI?
PHI means Protected Health Information: any information that identifies a patient and relates to their health care.
On a courier run, PHI shows up as:
- Patient names, addresses, and phone numbers
- Specimen labels and requisition forms
- Delivery manifests and routing sheets
- Who sent what, to whom, and when
If it could identify a patient, treat it as PHI.
The minimum necessary rule
Access and share only the delivery information you need for your assigned run. Nothing more.
- Read the manifest details for your stops, not for other drivers' runs.
- Share delivery details only with dispatch and the authorized recipient.
- When in doubt, share less, and ask dispatch.
Your four duties
- Safeguard. Keep packages, labels, manifests, and devices protected at all times.
- Verify. Confirm the recipient before every handoff.
- Document. Record each delivery accurately in the company app.
- Report. Tell dispatch immediately when anything goes wrong.
Chain of custody protects privacy
Every signature, photo confirmation, and app entry is not just proof of delivery. It is a privacy control.
An unbroken chain of custody proves a package went only to authorized hands. A gap in the chain is where privacy breaks down.
Never skip a custody step, and never falsify one. If a record is wrong, correct it through dispatch and note the correction.
DO
- Verify the recipient before every handoff.
- Keep manifests and labels covered in transit.
- Send all status updates through the company app only.
- Follow the secure-placement or redelivery protocol when no authorized recipient is available.
- Keep the vehicle locked and packages out of public view.
DON'T
- Never photograph a label, manifest, or facility record.
- Never send delivery details by personal text or messaging app.
- Never discuss a delivery's contents, sender, or recipient with anyone outside the job, not family, not other drivers, not on social media.
- Never leave a medical item with an unauthorized person or in an unsecured location.
Devices and the company app
- All delivery information stays inside the company app. That is the only channel for delivery data.
- Never share your login credentials, and never let anyone else use the app under your login.
- Report a lost or stolen device to dispatch immediately so access can be restricted.
- Close the app when it is not in use for official duties.
Vehicles and packages
- Keep packages covered and the vehicle locked whenever you step away.
- Never leave a package unattended in public view.
- Protect temperature integrity and privacy together: a compromised package is both a clinical and a privacy incident.
- Keep the vehicle clean and presentable. You represent GoBee at every stop.
What counts as a breach?
A breach is any unauthorized access to, or disclosure of, PHI. Courier examples:
- A lost or misdirected manifest
- A package delivered to the wrong recipient
- A lost or stolen device that held delivery data
- Delivery details discussed with an unauthorized person
- A photographed label shared anywhere
If something goes wrong
- Stop and secure. Retrieve what you can safely, and protect what remains.
- Call dispatch immediately by phone. Do not rely on an app message alone.
- Do not hide it. GoBee does not punish employees for reporting incidents in good faith. A hidden incident is far more dangerous than a reported one.
- Do not discuss it outside the job. No customers, no social media, no insurers. The company handles those communications.
- Log it in the app before the end of your shift, facts only: what happened, when, where, and who was involved.
Three scenarios. What do you do?
1. No authorized recipient is at the desk.
Follow the secure-placement or redelivery protocol. Never leave the item with an unauthorized person.
2. A friend asks what you delivered to the hospital.
Say nothing about contents, sender, or recipient. Neither confirm nor deny details.
3. You drop a manifest in a parking lot.
Retrieve it if safe, call dispatch immediately, and log it. It is an incident, even if you recovered it.
You are ready to record completion
To recap:
- PHI is any information that identifies a patient and relates to their care.
- Minimum necessary: only the delivery information your run requires.
- Safeguard, verify, document, report.
- When something goes wrong, call dispatch immediately and log it.
This training is required before your first solo delivery and refreshed every year. Your completion is recorded in your employee file.
Record my completion →