Compliance commitments most NEMT platforms won’t put in writing.

Security & Compliance — in writing

DriveBoss publishes its security and compliance commitments in plain language. This page is the full version; the pricing page carries a short summary.

• AWS under a signed Business Associate Agreement (BAA) covering all PHI stored and processed on DriveBoss infrastructure.
• AWS US-region hosting with multi-AZ Aurora MySQL cluster and managed failover.
• 256-bit TLS encryption in transit for every client ↔ server interaction.
• Per-company database segregation and encryption at rest.
• Per-company encryption key on driver-device backup files — backup files emailed between driver devices and dispatch are not readable cross-tenant.
• Minimum 7-year retention on trip-level and billing-level records — meets or exceeds common Medicaid and HIPAA retention expectations.
• Full audit trail, GPS trail, and fraud detection documented in the sections below — so the same controls that protect PHI also defend billing under audit.

Audit Trail & Accountability

An audit doesn't ask what happened. It asks what you can prove. When a broker or Medicaid auditor disputes a trip from eighteen months ago, the operator without records loses by default. DriveBoss keeps the proof — every trip interaction logged, a GPS breadcrumb per trip, every signature tagged by who signed — retained for seven years and exportable the day the letter arrives.

• Every trip interaction logged — who touched it, why, when. Persistent even if the broker loses the trip.
• GPS breadcrumb per trip and per driver-day, mappable.
• Triple-redundant data capture — offline driver app, daily backup file, dispatcher-side restore.
• Auditor CSV export available per-trip, per-driver for a given day, or per-vehicle for a given day.

Fraud & Anomaly Detection

• Automatic fraud detection on suspicious completions — trips completed unusually fast are color-flagged and surfaced to dispatch. Catches device-tap fraud and accidental double-completions before billing.
• Attributed cancellation tracking — rider vs. broker vs. dispatcher cancellations are distinguished per trip, so disputed “no-show” charges can be resolved from the record.
• On-time performance color coding — green/yellow/red flags late trips and late broker transmissions visually.
• Signor-type tagging on passenger signatures (Self / Facility / Parent-Guardian / UTS) — removes ambiguity in post-trip audits.

LOS Compliance — Enforced at Assignment

• DriveBoss prevents LOS mismatches rather than reporting on them after the fact.
• Dispatcher cannot assign a wheelchair trip to an ambulatory-only vehicle — system blocks with an error.
• Override possible only by explicit dispatcher force — logged in the audit trail (who forced, when, which trip).
• Net effect: LOS fraud (“billed for WCH, executed with AMB”) is near-zero, and any override is attributable.

Compliance-Positioned Reports

• Mileage-Fraud & Route-Adherence Audit — defends against Medicaid mileage-padding audits with the optimizer’s own planned route, not Google’s shortest path.
• Broker SLA & Hours-of-Service Compliance — OTP %, # Late PU, # Late DO for broker SLA evidence. Total Hours Logged In vs. Total Hours Worked, both machine-captured.
• Wage-and-Hour, LOS, Rate-Reasonableness Audit — Break Time auto-calculated from app events (strong DOL evidence). Cost formula includes driver rate, fuel estimate, vehicle cost.
• Specialty reports: Patient Care Report (PCR), Post-Incident Acknowledgement Form, New Jersey WMAV Report.