The HIPAA Privacy Rule allows healthcare providers to share patient information via fax. Here are guidelines to ensure your faxing practices protect protected health information (PHI):
- When sending a fax, use a cover sheet with the date and time sent, recipient’s name and fax number, and sender’s name, organization, and phone number. Never include a patient’s name or any other PHI on the cover sheet.
- Include a privacy statement on the cover sheet indicating the confidentiality of the information, its intended recipient, and instructions to notify the sender and destroy the fax if received in error.
- Position fax machines in areas inaccessible to patients and visitors.
- Avoid leaving documents containing PHI unattended on the fax machine.
- Regularly check the fax machine for outgoing faxes and incoming faxes.
- If your fax machine can store incoming faxes, disable auto-print and assign staff to regularly check and deliver them.
- Power off fax machines overnight to prevent unauthorized access during off-hours.
- Designate a staff member to monitor manufacturer updates and patches for fax machine security vulnerabilities.
- Always verify the recipient’s fax number before sending PHI, and request confirmation if the fax isn’t received within a specified time.
- Print and maintain fax logs regularly to document all sent and received faxes for record-keeping and audit purposes.
Faxes are an efficient method for sharing patient information with consultants. Educate staff on faxing safety and enforce policies to prevent HIPAA violations due to faxing errors.
