Faxing Protected Health Information (PHI)

Why Faxing Still Matters in Healthcare

Despite the rapid adoption of electronic health records (EHRs) and secure messaging platforms, fax remains a common method for transferring patient data between hospitals, clinics, labs, and insurance companies. Many legacy systems only accept faxed documents, and some providers rely on the familiarity and perceived simplicity of the technology.

Because PHI is highly sensitive, every fax transmission must comply with the privacy and security rules of the Health Insurance Portability and Accountability Act (HIPAA) and any applicable state regulations.

Legal Framework Governing Faxed PHI

HIPAA Privacy Rule: Requires covered entities and business associates to safeguard PHI during any transmission, including fax. The rule does not forbid faxing, but it mandates reasonable safeguards.

HIPAA Security Rule: Applies to electronic PHI (ePHI) and includes technical, physical, and administrative safeguards. Faxing is considered an electronic transmission, so the Security Rules requirements apply.

HITECH Act: Strengthens enforcement and expands breach notification requirements, meaning a faxrelated breach can trigger costly reporting obligations.

State Laws: Some states impose stricter privacy protections. Always verify local regulations before establishing a fax workflow.

Core Requirements for Faxing PHI

• Authentication: Verify the identity of the receiving party before sending. Use known fax numbers or secure fax directories.
• Encryption: While traditional analog faxes are not encrypted, many modern fax servers support TLS encryption for internetbased fax (FoIP). Prefer encrypted transmission whenever possible.
• Access Controls: Limit who can send and receive faxes containing PHI. Implement rolebased permissions on fax machines and servers.
• Audit Trails: Maintain logs that record date, time, sender, recipient, and content description for each faxed document.
• Retention & Disposal: Store received faxes securely for the required retention period and destroy them in a HIPAAcompliant manner (e.g., shredding).
• Transmission Minimum Necessary: Only fax the information required for the intended purpose.

BestPractice Workflow

1. Verify Recipient Information

Maintain an uptodate directory of authorized fax numbers. Use a doublecheck process: confirm the number verbally or through a secure portal before sending.

2. Use a Secure Fax Solution

Consider a cloudbased or onpremises fax server that offers:

• Endtoend encryption (TLS for outbound/inbound)
• User authentication (username/password, smart cards)
• Digital signatures to ensure integrity
• Automated audit logs

3. Apply the Minimum Necessary Standard

Before scanning or printing, redact any data not essential to the recipients purpose. Use redaction tools that permanently remove information.

4. Secure Physical Devices

If using a traditional analog fax machine:

• Place it in a locked area with controlled access.
• Configure autodial features to only approved numbers.
• Set the machine to Do Not Print until the user manually confirms each receipt.

5. Train Staff Regularly

Conduct quarterly training covering:

• HIPAA privacy and security basics.
• Proper use of fax equipment.
• Incident reporting procedures.

6. Monitor and Audit

Review fax logs monthly for unusual activity, such as:

• Unexpected highvolume outbound faxes.
• Faxes sent to unknown numbers.
• Repeated failed transmission attempts.

Investigate any anomalies promptly.

Common Risks and How to Mitigate Them

Mitigation: Implement a verification step in the workflow and use fax cover sheets that clearly label the intended recipient and content.

Mitigation: Transition to internetbased fax services that encrypt data over the network. If analog fax must be used, limit exposure by keeping the line dedicated to trusted parties only.

Mitigation: Store incoming faxes in a locked, accesscontrolled inboxeither a physical tray with restricted access or a secure electronic repository.

Mitigation: Use fax solutions that automatically retain logs for at least six years (the standard HIPAA retention period) and back them up securely.

Technology Options

Traditional Analog Fax Machines

Simple to use but lack encryption and detailed auditing. Suitable only when a secure, dedicated line is available and strict administrative controls are enforced.

FaxoverIP (FoIP) Gateways

Convert analog fax to digital packets that travel over the internet. When paired with TLS, they provide strong encryption and can integrate with EHRs for automated routing.

CloudBased Secure Fax Services

Examples include eFax Corporate, SRFax, and FaxLogic. Benefits:

• Endtoend encryption.
• Webbased inbox with rolebased access.
• Automatic audit trails and compliance reports.
• Integration with popular EMR/EHR platforms via APIs.

Hybrid Solutions

Combine a physical fax machine for legacy needs with a secure fax server that captures each transmission digitally for archiving and audit purposes.

Incident Response for FaxRelated Breaches

In the event a fax containing PHI is sent to an unauthorized party, follow these steps:

1. Contain: Stop further transmissions to that number.
2. Assess: Determine what information was disclosed and the potential impact.
3. Notify: Report the breach to the Office for Civil Rights (OCR) within 60 days if it meets the definition of a reportable breach. Inform affected individuals as required.
4. Mitigate: Offer identitytheft protection services where appropriate.
5. Review: Update policies, retrain staff, and adjust technical controls to prevent recurrence.

Sample Fax Cover Sheet for PHI

--------------------------------------------------------------          CONFIDENTIAL  PROTECTED HEALTH INFORMATION--------------------------------------------------------------To: __________________________   Fax #: ______________________From: ________________________   Department: __________________Date: _________________________   Confidentiality Notice:Subject: ______________________   This fax contains PHI and is                                 intended solely for the use of                                 the individual(s) named above.                                 If you are not the intended                                 recipient, please destroy this                                 fax and notify the sender                                 immediately.--------------------------------------------------------------        

Using a standard cover sheet reinforces the privacy notice and helps the recipient handle the fax correctly.

Key Takeaways

• Faxing is permissible under HIPAA if reasonable safeguards are in place.
• Prefer encrypted, internetbased fax solutions over analog machines.
• Implement strict verification, access controls, and audit logging.
• Train staff regularly and conduct periodic risk assessments.
• Maintain a documented incidentresponse plan for faxrelated breaches.