Delaware Privacy Laws Guide for Patient Transport Dispatch Software Vendors

Patient transport dispatch platforms may handle names, pickup locations, trip details, medical information, call recordings, and precise location data. Which rules apply depends on the type of information, who controls it, and what role your company plays in processing it.

This guide reflects Delaware law as of October 26, 2026. The Delaware Personal Data Privacy Act (DPDPA) amendments discussed below are scheduled to take effect January 1, 2027; until then, the current version of the law applies.

What privacy and confidentiality rules apply to patient transport dispatch data in Delaware?

Several rules may apply to dispatch data, and they cover different information and organizations:

• HIPAA: If a vendor creates, receives, maintains, or transmits protected health information (PHI) on behalf of a HIPAA covered entity or business associate, the vendor may be a business associate or subcontractor business associate. HIPAA obligations and an appropriate HHS business associate agreement may apply.
• DPDPA: This law applies to covered controllers and processors handling personal data of Delaware residents, subject to thresholds and data-specific exclusions. Until January 1, 2027, the main thresholds are 35,000 consumers, or 10,000 consumers when more than 20% of gross revenue comes from selling personal data. The thresholds change in 2027.
• Delaware breach law: Chapter 12B requires reasonable data-security practices and can require breach notices when specified personal information is exposed.
• 911 confidentiality rules: Delaware law makes 911 call recordings and information furnished in a call or investigative process confidential, subject to statutory exceptions. Separate health-record confidentiality provisions may also apply to information within their scope.

A vendor is not automatically a HIPAA business associate simply because it handles health-related information. The relevant question is whether it performs services involving PHI on behalf of a covered entity or business associate. Likewise, being a processor under the DPDPA is a role-specific determination: a vendor that decides its own purposes and means for particular processing may act as a controller for that processing. See the Delaware Personal Data Privacy Act, Delaware computer-security breach law, and Delaware 911 and emergency medical dispatch statutes.

When does HIPAA exempt health data from the Delaware Personal Data Privacy Act?

The DPDPA’s exclusion is generally data-specific, not a blanket exemption for a company or its entire dispatch platform. The law excludes PHI under HIPAA. It also excludes certain patient-identifying information and specified data used for federally regulated human-subject research and patient-safety work.

There is a separate, limited exclusion for information used for authorized public, community, or population health activities when it is provided by or to a covered entity, or by or to a business associate under a business associate agreement with a covered entity. The activity and relationship must fit the statutory conditions; a vendor should not assume that every dispatch or analytics use qualifies.

Accordingly, a HIPAA protected health information exemption can cover the PHI a vendor handles in its business associate role, while other personal data handled by the same vendor may remain subject to the DPDPA. For example, dispatch data that is not PHI may still be sensitive personal data if it reveals a person’s health condition or precise location. The vendor must assess the data and processing purpose, not just rely on its HIPAA contract status. See DPDPA § 12D-103 and HHS guidance on covered entities and business associates.

What privacy notice, data minimization, and security duties apply to controllers?

Under the current DPDPA, controllers must limit collection to data that is adequate, relevant, and reasonably necessary for disclosed purposes; avoid incompatible additional purposes unless an applicable exception or consent allows them; and maintain reasonable administrative, technical, and physical security practices appropriate to the information.

Controllers must also provide a reasonably accessible, clear, and meaningful privacy notice. It must describe the categories of personal data processed, processing purposes, how consumers can exercise their rights, categories of third parties with whom data is shared, and a way to contact the controller. Where applicable, the notice must disclose sale or targeted-advertising practices and how consumers can opt out.

Health information and precise geolocation are among the current DPDPA’s sensitive-data categories. A controller generally needs consumer consent before processing sensitive data, subject to statutory exceptions. The law defines consent as a clear affirmative act reflecting freely given, specific, informed, and unambiguous agreement; acceptance of broad terms alone does not qualify. This is the basis for the sensitive personal data opt-in consent requirement when the law applies.

For dispatch operations, controllers should clearly explain why they collect trip details, call information, and location data; avoid collecting or retaining fields that are unnecessary for dispatch or related services; and protect data according to its sensitivity. These steps do not replace HIPAA duties where PHI is involved. See DPDPA §§ 12D-102 and 12D-106.

What contract and security safeguards must dispatch software processors maintain?

When the DPDPA applies, a controller data processing agreement must be binding and describe the processing instructions, nature and purpose, data types, duration, and each party’s rights and obligations. The processor must follow the controller’s instructions and assist with applicable consumer-rights requests, security obligations, breach response, and required assessments.

The agreement must also address confidentiality for people processing the data, deletion or return at the end of services unless retention is required by law, information needed to demonstrate compliance, and subcontractors. The controller must have an opportunity to object before the processor engages a subcontractor, and the subcontractor must be bound by written terms requiring it to meet relevant processor obligations.

Starting January 1, 2027, the DPDPA’s processor-contract terms will expressly require the parties to identify each limited and specific processing purpose with particularity; a generic reference to the overall service contract will not be enough. The law also requires processor cooperation with reasonable assessments, although an independent assessment may be used under the statutory conditions. A vendor that uses data for purposes it determines independently may be a controller for that processing rather than a processor.

When the vendor handles PHI as a HIPAA business associate, a separate or combined business associate agreement should specify permitted uses and disclosures, safeguards, incident reporting, downstream subcontractor protections, and return or destruction of PHI when feasible at termination. A DPDPA data processing agreement does not replace a HIPAA business associate agreement where both apply. See DPDPA § 12D-107 and HHS sample business associate agreement provisions.

How do Delaware’s 2027 sensitive-data amendments affect dispatch vendors?

Effective January 1, 2027, Delaware’s amendments lower the DPDPA’s main applicability threshold from 35,000 to 10,000 consumers and lower the revenue-based threshold from 10,000 to 5,000 consumers where more than 20% of gross revenue comes from selling personal data. The amended law also brings certain third parties that acquire personal data from a controller within its applicability provisions. Dispatch vendors should reassess coverage using their data volumes, roles, and data-sharing arrangements.

The amendments expand and clarify sensitive data. Categories include health condition, diagnosis, treatment, or status; precise geolocation; neural data; certain financial account and payment-card credentials; and specified government-issued identification numbers. The revised definition also includes inferences made from personal data that are used to reveal or identify a sensitive category.

Controllers must obtain consent to process sensitive data, and the processing must also be reasonably necessary and proportionate to the disclosed purposes. The amendments additionally require an effective way to revoke consent, with processing to cease as soon as practicable and no later than 15 days after the request. A sale of sensitive data faces additional restrictions: it must be strictly necessary to provide or maintain a product or service the consumer affirmatively requested, preceded by a conspicuous notice identifying the data categories, purpose, and recipients, and supported by consent records kept for five years.

These provisions do not mean a dispatch vendor must seek consumer consent for every use of PHI excluded from the DPDPA. They do mean that non-exempt sensitive data and processing outside the relevant exclusion should be reviewed before the amendments take effect. See DPDPA §§ 12D-102, 12D-103, and 12D-106.

What are Delaware’s breach notification deadlines and Attorney General reporting thresholds?

Delaware’s breach law requires a person conducting business in the state that owns or licenses computerized data containing covered personal information to notify affected residents after determining that a breach occurred, unless an appropriate investigation reasonably finds that the breach is unlikely to result in harm. Notice must be made without unreasonable delay and generally no later than 60 days after determining the breach, subject to statutory exceptions, including law-enforcement delay.

Covered personal information includes a Delaware resident’s first name or first initial and last name combined with specified data elements, including medical history, medical treatment, a health-care professional’s diagnosis, health-insurance identifiers, and certain biometric or financial-account information. A dispatch record is not automatically within this definition merely because it concerns a trip; assess whether the exposed data meets the statute’s elements.

The Delaware breach notification 60-day deadline applies to resident notice under the state law. If a vendor maintains computerized personal information it does not own or license, it must notify and cooperate with the owner or licensee immediately after determining that a breach occurred. Separately, a HIPAA business associate must notify its covered entity without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured PHI; the business associate agreement may require faster reporting so the covered entity can meet its own duties.

Attorney General breach notice 500 residents is required when more than 500 Delaware residents must be notified. The Attorney General must receive notice no later than the time resident notice is provided. If reasonable diligence could not identify some affected residents within the initial 60-day period, the law specifies additional timing for notice to those residents and the Attorney General. HIPAA reporting to HHS is a separate requirement and uses its own thresholds and procedures. See Delaware Code §§ 12B-101 and 12B-102 and 45 C.F.R. § 164.410.

How must vendors protect emergency medical dispatch records and call data?

Delaware’s statewide 911 Emergency Medical Dispatch System requires participating public safety answering points to collect call and timing data, dispatch-protocol information, and ANI/ALI information, and to transfer required information to an emergency medical services central database maintained by the Office of Emergency Medical Services. The statute also calls for approved case-entry, case-management, and quality-inspection software.

Delaware law states that text and audio recordings of 911 calls, and information furnished in the call or investigative process, are confidential and generally exempt from public disclosure. The statute permits limited disclosures, including to emergency responders to process calls and provide emergency service, to people within the 911 system as necessary to manage it, and for certain other listed purposes.

For a software vendor, the statutory confidentiality rule makes access controls and restricted use especially important. Use call recordings and related dispatch information only for authorized service purposes; limit access to personnel who need it; protect data in transit and at rest; and apply retention, deletion, logging, and incident-response controls consistent with applicable law and contracts. A vendor should not treat public-records exemptions as permission for its own disclosure or reuse. See Delaware Code §§ 10006 and 10010. Where Delaware’s personal-health-information subchapter governs the records, it generally restricts disclosure without informed consent except where law allows and favors nonidentifiable disclosure when possible; see Delaware Code § 1212.

In short, classify each data set and processing role, separate HIPAA-excluded PHI from other personal data, contract clearly with customers and subcontractors, and prepare for the DPDPA changes effective January 1, 2027. Apply Delaware’s breach deadlines and 911 confidentiality requirements independently where they cover the information.

FAQs

Does the Delaware Personal Data Privacy Act apply to patient data handled by a HIPAA business associate?

The DPDPA excludes PHI under HIPAA, so that information is generally outside the Act’s data-protection requirements. The exclusion does not exempt the vendor’s entire business or every data field it handles. Non-PHI personal data may remain covered, and the vendor may still have HIPAA duties under its business associate agreement.

When must a dispatch software vendor notify Delaware residents of a data breach?

If the vendor owns or licenses computerized data containing personal information covered by Delaware law, it generally must notify affected Delaware residents without unreasonable delay and no later than 60 days after determining that a breach occurred, unless a statutory exception applies. A vendor maintaining data for an owner or licensee must notify and cooperate with that entity immediately after determining a breach; the owner or licensee generally handles resident notice.

When is Attorney General notice required after a Delaware data breach?

When more than 500 Delaware residents must receive notice, the responsible person must notify the Attorney General no later than the time resident notice is provided. The statute also addresses cases where reasonable diligence could not identify certain affected residents within 60 days.

Are emergency medical dispatch calls and related information confidential?

Yes. Delaware law makes text and audio recordings of 911 calls, as well as information furnished in the call or investigative process, confidential and generally exempt from public disclosure. The law authorizes limited disclosures for specified emergency-response, 911-system, law-enforcement, maintenance, quality-control, and court-order purposes.