Type "HIPAA compliant courier" into a search box and you will find a lot of confident claims. Clinics, laboratories and pharmacies around Washington DC search for the phrase every day because the people who sign vendor contracts are told to. The problem is that the phrase does not mean what most listings imply. This article explains what the federal privacy rules actually say about a courier, where the real risk sits, and what a medical office in Washington DC, Maryland or Northern Virginia should ask before it hands over a sealed package. It is written from a courier's side of the counter, in plain words, and every rule quoted is cited at the end.
What HIPAA says about a courier: the conduit rule
HIPAA applies to covered entities — providers, health plans and clearinghouses — and to their business associates, the companies that handle protected health information on their behalf. The question for a medical courier is which side of that line it stands on.
The Department of Health and Human Services answered it directly. In its guidance on business associates, HHS says a covered entity does not need a business associate contract with organizations that act merely as conduits for protected health information, naming the U.S. Postal Service, United Parcel Service and "certain private couriers." When HHS rewrote the rules in 2013, the preamble to the final rule said the exception was meant to cover only entities providing "mere courier services," and that the test is the transient versus persistent nature of the opportunity to see the information. A courier carries a sealed envelope across town and hands it over; the chance to look inside is brief and incidental. A company that stores patient files, on paper or on a server, has a persistent opportunity, and is a business associate even if it never opens a file.
HHS repeated the point in its cloud computing guidance: the conduit exception is limited to transmission-only services, and any access a conduit has to the information is transient. Two things follow for anyone evaluating a HIPAA-aware courier service in DC.
First, the courier itself is not the compliance risk that the contract template assumes, as long as it is really a conduit. The package is sealed, the driver signs for it, and the contents never enter the courier's system.
Second, the courier stops being a conduit the moment it starts holding health information for you. If you type a patient's name, date of birth and test into the courier's booking form, that courier now "maintains" protected health information in the sense of the regulation, and the whole business associate machinery is triggered: a contract, safeguards, breach reporting, subcontractor flow-down. The practical lesson is the opposite of what people expect. The safest medical courier is the one that asks you for less.
The business associate agreement, in plain words
A business associate agreement (BAA) is the contract that makes a vendor legally responsible for the protected health information it handles for you. The regulation lists what it must contain. The vendor must not use or disclose the information other than as the contract permits; must use appropriate safeguards; must report any use or disclosure the contract does not allow; must make sure any subcontractor that creates, receives, maintains or transmits the information agrees to the same restrictions; and at the end of the contract must return or destroy it where feasible. A business associate that discovers a breach has to notify the covered entity without unreasonable delay and in no case later than 60 calendar days after discovery.
Those are real obligations with real costs, and that is the point of the conduit rule: it spares both sides a contract that would govern information the courier never holds. When a courier offers to sign a BAA for an ordinary sealed-package service, ask what information it will be holding that makes the agreement necessary. Sometimes the honest answer is "none, but your procurement form has a box for it." A short courier handling attestation — a signed description of how sealed packages are carried, who may see the delivery details and how long they are kept — usually satisfies a compliance team better than a BAA that covers nothing.
There is a related rule worth knowing even though it binds you rather than the courier. HIPAA's minimum necessary standard requires covered entities and business associates to make reasonable efforts to limit protected health information to the minimum needed for the purpose. Giving a courier a patient's name when a requisition number would do is the kind of disclosure that rule is about.
"HIPAA certified" is not a thing
The HHS Office for Civil Rights, which enforces these rules, published a short notice about misleading marketing. It says that HHS and OCR do not certify any persons or products as "HIPAA compliant," and that they do not endorse private consultants' materials. A courier can train its drivers, write a handling policy and show you its system; it cannot be certified by the government, because no such certificate exists. When a listing says "HIPAA certified courier," the claim tells you something about the listing. We describe our own handling as HIPAA-aware for exactly this reason.
What a careful courier does instead
Since the law puts the weight on handling rather than certificates, here is what handling looks like when it is done properly. These are our practices; the regulations they rest on are cited at the end.
The booking asks for a reference, not a patient. Our form takes pickup and drop-off addresses, a staff contact and phone at each end, your requisition or reference number, the package type and a handling note. When you tick "Confidential delivery," you also confirm that the package is sealed and that the booking describes it by reference only. If the description field looks like it contains a patient name, a date of birth or an account number, the form warns you before you send it. None of this is decoration: it is how we stay a conduit.
The task carries one instruction. Every confidential order reaches the driver, our dispatch email and our admin system with a CONFIDENTIAL line: sealed package, do not open, signature required. The driver sees addresses, your reference and the name of the person who signs. Proof-of-delivery photos show a package at a desk or a door, never an open document.
Private recipients are shown to as few people as possible. When the receiver is a private individual — a patient at home rather than an office — you can say so at booking. That person's name, phone and email are then visible only to the dispatcher and the assigned driver, kept out of our emails and lists, and removed from our records 90 days after delivery. We also switch off our dispatch platform's automatic emails for those deliveries, because standard email is not where a patient's name belongs. The address stays, because billing and proof of delivery need it; the identifiers go.
Specimens travel the way the packaging rules describe. For Category B infectious substances, federal transport regulations require a leakproof primary receptacle, a leakproof secondary packaging with absorbent material between the two, and a rigid outer packaging marked "Biological substances, Category B" with the UN3373 diamond, no smaller than 100 millimetres on a side. Samples collected for routine testing not related to the diagnosis of an infectious disease — the regulation's examples include cholesterol, glucose and pregnancy tests and cancer biopsies — fall under a lighter exception, but OSHA's bloodborne pathogens standard still requires any specimen to be placed in a container that prevents leakage during transport, closed before it moves and labelled or colour-coded. Your laboratory's kit normally satisfies all of this. Our job is to keep it upright, sealed, and at temperature. For the full picture see our guide to medical specimen temperature control and the temperature-controlled delivery service page.
Temperature is planned, not hoped for. CDC's storage and handling guidance puts refrigerated items between 2 and 8 degrees Celsius and frozen items between minus 50 and minus 15, says to transport in the passenger cabin rather than a trunk, and recommends a digital data logger for routine transport. For specimens, CDC's laboratory guidance says to make sure they are already at 2 to 8 degrees before they leave and to surround the sealed secondary packaging with cold packs. A courier cannot fix a specimen that left warm; it can refuse to put a cooler in a hot trunk. Tell dispatch at booking whether a package is ambient, refrigerated or frozen.
Everything is logged, and the log shows who looked. Each confidential order has a handoff record: pickup time and package count, each transfer, delivery time and the name of the person who signed. Inside our admin system, opening a private recipient's full details is itself recorded. The chain of custody article explains why that record is the thing an auditor asks for first.
Drivers are bonded, background-checked and trained to carry sealed packages, with HIPAA awareness training as part of it. The bonded drivers post covers what bonding does and does not protect.
Where this matters: the DC, Maryland and Virginia medical map
The Washington region moves an unusual amount of medical material for its size, which is why the question of a HIPAA-aware medical courier in DC comes up so often. DC Health's hospital directory, revised in April 2025, lists fifteen hospitals in the District, thirteen of them still operating, among them Children's National on Michigan Avenue with 326 inpatient beds, MedStar Washington Hospital Center, which describes itself as a 912-bed teaching hospital and the largest private, not-for-profit hospital in the nation's capital, and the university hospitals at Georgetown, George Washington and Howard. Across the line in Bethesda, the NIH Clinical Center calls itself the world's largest hospital entirely devoted to clinical research, with 200 inpatient beds on the NIH campus. To the west, Inova Fairfax Medical Campus is a 928-bed centre and Northern Virginia's only Level 1 trauma centre. To the north-east, the Johns Hopkins Hospital in Baltimore, open since 1889, lists 1,215 licensed beds — and Baltimore is a routine run for us, as the DC to Baltimore corridor post describes.
Behind the hospitals sit the laboratories. By our count of the certificate types in CMS's September 2026 laboratory statistics, there are roughly 557 CLIA-registered laboratories in the District, 5,126 in Maryland and 7,469 in Virginia — around thirteen thousand across the three jurisdictions, from hospital labs to the single-physician offices with a waiver certificate. Virginia's Department of Health Professions counted 1,744 licensed pharmacies and 16,147 pharmacists in its 2024 third-quarter license tally. Every one of those labs, pharmacies and practices moves something by hand: a specimen to a reference lab, a prescription to a homebound patient, records to a specialist, a cooler to a research site.
That volume is also why the conduit question is not academic here. Research hospitals, federal health agencies and the contractors around them run compliance programmes that ask vendors hard questions. The honest answers are the ones in this article.
Questions to ask a medical courier before the first run
Instead of "are you HIPAA compliant," which cannot be answered truthfully with a yes, ask these.
What do you need in the booking, and what do you tell me to leave out? The right answer names a reference number and leaves out patients.
Who sees the recipient's name, and where is it stored? You want: the dispatcher and the assigned driver; stored in our system for a defined time; kept out of email.
What does the driver's task say about a confidential package? It should say sealed, do not open, signature required, and nothing about the contents.
How do you handle refrigerated and frozen packages, and can you show the temperature log? The right answer talks about 2 to 8 degrees, cold packs, the cabin not the trunk, and a logger.
What happens if a package is lost, delayed or misdelivered? You want a same-day phone call, a note on the order and an incident record.
Will you sign a BAA? A conduit should explain why it does not need to, and offer a handling attestation instead.
Can I see the handoff record for a delivery? Yes should be the answer, and it should take a minute, not a week.
How to book a confidential medical delivery with us
Open the booking form, tick "Confidential delivery," confirm the sealed-and-reference-only line, and describe the package by type and reference. If the receiver is a patient at home, tick "The receiver is a private individual." For a specimen that needs to move now, the STAT medical courier page explains the fastest options; for scheduled lab routes and daily runs, see the medical courier service page and the medical practices industry page; for prescriptions, the pharmacy courier page. Our full handling policy, written for compliance teams, is on the confidential and medical deliveries page, and the short version is in our privacy policy. For how to compare providers more generally, start with how to choose a medical courier in Washington DC and the complete guide to Washington DC courier service.
Sources used in this article. Conduit rule: U.S. Department of Health and Human Services, Office for Civil Rights, FAQ 245, "Are entities such as the US Postal Service, United Parcel Service and certain private couriers business associates?"; Federal Register, "Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules" (78 FR 5566, January 25, 2013), preamble discussion of conduits; HHS, "Guidance on HIPAA & Cloud Computing." Definitions and contract terms: 45 CFR 160.103 (business associate); 45 CFR 164.504(e) (business associate contracts); 45 CFR 164.410 (breach notification by a business associate); 45 CFR 164.502(b) (minimum necessary). Certification: HHS OCR, "What You Should Know About OCR HIPAA Privacy Rule Guidance Materials" (misleading marketing claims). Packaging and specimens: 49 CFR 173.199 (Category B infectious substances) and 49 CFR 173.134 (definitions and exceptions); OSHA, 29 CFR 1910.1030 (bloodborne pathogens). Temperature: CDC, Vaccine Storage and Handling Toolkit (July 2026) and CDC Infectious Diseases Laboratories, "Specimen Storage and Shipping Guidance." Hospitals and laboratories: DC Health, Hospital Directory (revised April 15, 2025); NIH Intramural Research Program and NIH Clinical Center pages; MedStar Washington Hospital Center, "About our hospital"; Inova Fairfax Medical Campus page; Children's National Hospital, main campus page; Johns Hopkins Medicine, fast facts sheet; CMS, "Laboratories by Certification Types" (September 2026; our sum of the certificate columns per state); Virginia Department of Health Professions, Current License Count, Q3 FY2024. Figures are quoted as published by those sources; this article is general information, not legal advice.