Faxing Patient Information Under HIPAA: Safeguards and Penalties

HIPAA does not ban faxing patient records, but the HIPAA rules for faxing patient information require you to treat every fax as a regulated disclosure: send it only for a permitted purpose, send only what’s needed, protect the machine and the pages, and respond fast when something goes to the wrong number. The law is technology-neutral, so faxing sits under the same Privacy Rule and Security Rule that govern any other handling of protected health information.¹ Get it wrong and the consequences run from corrective action plans to six-figure fines.

When You Can Fax PHI Without Patient Authorization

You do not need a signed authorization every time you fax a patient’s records. HIPAA permits covered entities to use and disclose PHI for treatment, payment, and healthcare operations without asking the patient first.² A physician faxing records to a specialist for a referral, a hospital sending claims data to an insurer, or a billing office transmitting information to a clearinghouse all fall within those permitted purposes.

Authorization is required when the disclosure does not fit treatment, payment, or operations. Marketing communications, the sale of PHI, and most research uses need the patient’s written permission. If you cannot place a particular fax cleanly inside a permitted category, get the authorization.

Send Only What’s Needed

Even a permitted disclosure has to be trimmed. HIPAA requires covered entities to make reasonable efforts to limit PHI to the minimum necessary to accomplish the purpose of the disclosure.² If a payer needs a diagnosis code and procedure date to process a claim, faxing 40 pages of treatment notes violates the standard.

There is one important exception. The minimum necessary rule does not apply to disclosures between healthcare providers for treatment.² A referring doctor can fax the full set of relevant records to a treating specialist without paring the file down. Every other kind of fax gets only what the recipient actually needs.

Safeguards for Every Fax

HIPAA requires appropriate administrative, technical, and physical safeguards for PHI.³ The regulations do not spell out a fax-specific checklist, which leaves each organization to decide what is reasonable for its size and risk. A handful of practices have become standard:

Verify the recipient’s number against a pre-programmed directory or a confirmed contact list before you press send. A single transposed digit is how records reach a stranger’s machine.
Include a confidentiality cover sheet. HIPAA does not explicitly require one, but a sheet that names the sender and intended recipient, marks the contents as confidential, and instructs anyone receiving it in error to call and destroy the pages goes directly to the safeguards requirement.
Keep fax machines out of public areas. A machine handling PHI belongs in space restricted to authorized staff, not in a waiting room.
Retrieve incoming faxes promptly. Pages sitting in an output tray are exposed to anyone who walks by, so assign someone to monitor and collect them.
Maintain transmission logs of what was sent, when, and to whom. Those logs become the evidence trail if a fax is later found to have gone astray.

Staff Training

Safeguards work only when the people at the machine understand them. HIPAA requires covered entities to train every workforce member on privacy policies and procedures, including new hires within a reasonable time after they start, and the training must be documented.³ For faxing, staff should know how to verify numbers, what a compliant cover sheet looks like, and exactly what to do when a fax reaches the wrong recipient.

Analog Fax vs. Cloud Fax

The type of fax service you use changes which HIPAA rules apply. A traditional analog machine sends data over standard telephone lines, and HIPAA generally treats that transmission as non-electronic. The Security Rule, which sets detailed technical requirements for protecting electronic PHI, applies specifically to information stored or transmitted electronically.⁴ An analog fax-to-fax call typically does not fall under that rule, though the Privacy Rule’s safeguards still apply in full.

Cloud-based and internet fax services are a different story. When PHI passes through servers, is stored (even temporarily) as electronic data, and can be pulled up in a web portal, it is electronic PHI. That triggers the full Security Rule, meaning the service has to support encryption, access controls, and audit logging.

Encryption

HHS points to specific NIST publications for acceptable encryption. Data in transit has to comply with NIST guidelines for TLS, IPsec VPNs, or SSL VPNs, validated under FIPS 140-2. Data stored on a server should follow NIST Special Publication 800-111.⁵ A cloud fax vendor that cannot confirm its encryption meets those standards is a warning sign.

Audit Controls

The Security Rule also requires mechanisms that record and examine activity in systems containing electronic PHI.⁴ For a cloud fax platform, that means logs showing who sent or opened each fax and when, and unique logins for each user rather than a shared office credential.

Business Associate Agreements With Fax Vendors

Any third party that creates, receives, maintains, or transmits PHI on behalf of a covered entity is a business associate, and a written business associate agreement (BAA) has to be in place before PHI moves to that vendor.² The BAA obligates the vendor to safeguard the information, report security incidents, and comply with the applicable parts of HIPAA.⁶

Cloud fax providers almost always qualify, because they store PHI on their servers even temporarily. HIPAA does include a “conduit exception” for services that merely transport information without accessing it, but HHS has read that exception narrowly. It fits entities like the U.S. Postal Service or a telephone company, which carry sealed envelopes or voice signals without opening them. A platform that routes, stores, or provides portal access to faxed documents goes well beyond conduit status. If a fax vendor will not sign a BAA, use another vendor.

Receiving and Disposing of Faxed PHI

Incoming faxes deserve the same protection as any other patient record. Authorized staff should retrieve them promptly and either file them in the patient’s chart or place them in secure storage with restricted access. A stack of faxes on an open counter undoes every safeguard the sending office put in place.

When a faxed document is no longer needed, disposal has to render the PHI essentially unreadable and impossible to reconstruct. HHS does not mandate one specific method, but shredding, burning, pulping, and pulverizing all satisfy the standard.⁷ Tossing a fax into an open recycling bin is not compliant disposal, even if the bin’s contents are shredded later. A professional document destruction vendor is itself a business associate and needs a signed BAA.

When a Fax Goes to the Wrong Number

Misdirected faxes are one of the most common HIPAA incidents, and they escalate quickly. A breach is generally defined as an impermissible use or disclosure that compromises the security or privacy of PHI.⁸ A fax containing patient records that reaches a wrong number fits that definition unless you can demonstrate a low probability that the information was actually compromised.

If you discover a misdirected fax, contact the unintended recipient right away and ask them to destroy the pages. Document everything: the date of the error, the number that received it, when you notified the recipient, and how they responded. Report the incident to your organization’s privacy officer, who will assess whether it qualifies as a reportable breach.

Notification Deadlines

When a misdirected fax does qualify as a breach of unsecured PHI, notification duties start. The covered entity has to notify each affected individual without unreasonable delay and no later than 60 calendar days after discovering the breach.⁹ The organization must also report the breach to the HHS Secretary. Breaches affecting 500 or more individuals are due to HHS within the same 60-day window, and prominent local media must be notified as well. For breaches affecting fewer than 500 people, the HHS report can be submitted by the end of the calendar year in which the breach was discovered.¹⁰

Penalties for Faxing Violations

The Office for Civil Rights (OCR) at HHS investigates complaints and can impose civil monetary penalties across four tiers based on the violator’s level of fault. The current inflation-adjusted amounts are:¹¹

Tier 1, did not know: the entity was unaware and could not reasonably have known. $145 to $73,011 per violation, with a calendar-year cap of $2,190,294.
Tier 2, reasonable cause: the violation resulted from reasonable cause rather than willful neglect. $1,461 to $73,011 per violation, same $2,190,294 annual cap.
Tier 3, willful neglect, corrected: willful neglect corrected within 30 days of discovery. $14,602 to $73,011 per violation, capped at $2,190,294 per year.
Tier 4, willful neglect, not corrected: willful neglect not corrected within 30 days. $73,011 to $2,190,294 per violation, with a $2,190,294 annual cap.

Criminal penalties also exist under federal law for knowingly obtaining or disclosing PHI. Fines can reach $50,000 with up to one year of imprisonment, rising to $250,000 and up to ten years when the violation involves intent to sell the information or cause harm. Criminal cases go to the Department of Justice rather than OCR.

Most faxing violations sit in the lower tiers because they come from carelessness rather than malice. But “we didn’t know” is not a free pass. An office that has never trained staff on fax procedures, never verified fax numbers, and has no written policy will struggle to show it exercised reasonable diligence. The tier structure rewards the offices that take fax compliance seriously before something goes wrong.

1
eCFR. 45 CFR Part 164 – Security and Privacy
2
eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information General Rules
3
GovInfo. 45 CFR 164.530 – Administrative Requirements
4
eCFR. 45 CFR Part 164 Subpart C – Security Standards for the Protection of Electronic Protected Health Information
5
HHS.gov. Guidance to Render Unsecured Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals
6
HHS.gov. Business Associate Contracts
7
HHS.gov. What Do the HIPAA Privacy and Security Rules Require of Covered Entities When They Dispose of Protected Health Information
8
U.S. Department of Health and Human Services. Breach Notification Rule
9
eCFR. 45 CFR 164.404 – Notification to Individuals
10
HHS.gov. Submitting Notice of a Breach to the Secretary
11
Federal Register. Annual Civil Monetary Penalties Inflation Adjustment