Fax Is Still Here: Doing It Properly Under HIPAA

Fax has been declared dead for twenty years and remains the default way clinical documents move between organisations. Referrals, prior authorisations, lab results and discharge summaries still arrive this way, because the receiving side accepts it and has no obligation to accept anything else.

So the practical question is not how to eliminate fax. It is how to run it without creating the disclosure risk that a physical machine in a shared corridor represents.

Why the machine in the corridor is the problem

A traditional fax deposits protected health information onto paper in a tray, in a space that is usually accessible to more people than should see it. The common failure modes are mundane:

• documents sit in the tray overnight where cleaning staff, contractors and patients pass
• a misdial sends records to a wrong number with no way to recall them
• the confirmation page is the only record that anything was sent
• there is no log of who collected what, or when
• the machine stores images on an internal drive that is never wiped before disposal

None of these are exotic attacks. They are the ordinary operation of the device.

What cloud fax actually changes

Cloud or digital fax replaces the machine with a service: inbound faxes arrive as files or email attachments, outbound are submitted from an application.

Genuine improvements:

• No paper by default. Nothing sits in a tray.
• Access control. Inbound documents land in a destination you can restrict by role, rather than a tray anyone can reach.
• Audit trail. Who sent what, when, to which number, and who opened it.
• Encryption in transit and at rest for the digital legs of the journey.
• Retention and deletion you can configure and enforce.

What it does not change:

• The far end may still be a machine in a corridor. Your transmission is only as private as the recipient's handling. Encryption protects the path, not the printout.
• Misdials still happen, and are still unrecoverable.
• The final hop is often still analogue where the recipient uses a traditional line.

Cloud fax is a real improvement to your side of the exchange. Be precise about that, rather than treating it as end-to-end security it cannot provide.

The controls that matter

A Business Associate Agreement, signed before live traffic

A fax provider handling PHI is a business associate. You need a BAA in place before any real document passes through it, not after. This is not negotiable and not a formality — it is the instrument that makes their obligations enforceable.

Confirm it covers the specific services you use, including any AI features such as OCR or classification applied to document content.

Destination control for inbound

Inbound faxes should arrive somewhere access-controlled, not a shared mailbox everyone can open. The common anti-pattern is routing every inbound fax to a generic address because it is simplest.

Route by number where possible: the referrals line to the referrals team, the billing line to billing. A number per function is cheap and dramatically reduces the audience for each document.

Confirm the number before sending

Misdialled faxes are the most frequent reportable fax incident. Controls that work:

• a verified directory of destinations, so numbers are selected rather than typed
• a confirmation step displaying the recipient name, not just digits
• restricting outbound fax to a trained group
• a cover sheet with a misdirection notice — which does not prevent disclosure but does establish intent and gives the recipient instruction

Retention that is defined and enforced

Decide how long faxed documents remain in the fax platform, as distinct from how long they are retained in the clinical record. Usually the answer is: long enough to confirm delivery and move the document into the record, then delete.

Fax platforms accumulate years of PHI by default because nobody set a policy. That is a breach waiting for a cause.

Logging and review

The audit trail is only useful if someone looks. A monthly review of outbound destinations will show misdials, unexpected recipients, and documents going somewhere they should not. It takes twenty minutes.

Decommission the old machine properly

A multifunction device that has faxed, copied or scanned PHI has an internal drive. Before disposal, lease return or resale, it must be wiped or the drive destroyed — with a certificate. Devices returned at end of lease with intact drives are a documented source of breaches.

Where fax should be replaced

Fax persists where the recipient dictates the channel. Where you control both ends, use something better:

• Direct secure messaging between healthcare organisations
• Portal upload for patient-submitted documents
• Integration where both systems support it

Each fax removed is risk removed. But do not let a replacement project become a reason to delay fixing the fax you will still be running in three years.

The short checklist

• BAA signed with the fax provider, covering all services used
• Inbound routed to access-controlled destinations, by function
• Outbound restricted to trained staff, with a verified destination directory
• Confirmation step showing recipient name
• Retention period set and automatically enforced
• Audit log reviewed monthly
• Old multifunction devices wiped before disposal, with certificates
• Cover sheet with a misdirection notice
• A documented procedure for when a misdial happens — who is told, within what time

The last one matters more than it looks. Misdials will happen. Whether it becomes a reportable incident handled properly or an incident nobody told anyone about depends entirely on whether staff know what to do in the first ten minutes.