HIPAA and fax, what clinics should know

Healthcare moves a surprising amount of information by fax. Referrals, prior authorizations, lab orders and records requests still travel this way because every practice and payer can receive a fax. HIPAA does not ban fax. It asks covered entities to protect health information wherever it goes.

Where the risk really sits

Most fax incidents are not about the telephone line. They are about people. A page prints in a shared tray and the wrong person reads it. A number is mistyped and a document reaches a stranger. A machine is replaced and nobody wipes its memory.

Controls that reduce the risk

• Send and receive with named accounts instead of a shared tray.
• Limit who can see each fax number.
• Keep an activity log of who sent, opened and downloaded each document.
• Store faxes in an encrypted archive with a defined retention period.
• Use delivery receipts to confirm that a document reached the intended number.

Confirm numbers before you send

Keep a list of verified recipient numbers and use it. For first time recipients, call to confirm the number or send a cover page only.

Vendors and agreements

If a service handles protected health information on your behalf, HIPAA expects a business associate agreement with that service. Ask for it before you send real patient documents.

Where an online fax service helps

An online service replaces the tray with access controlled accounts and keeps the records you need to answer questions later. Read how Faxy approaches this on the HIPAA compliant fax page, and talk to your compliance officer about your own policies.