HIPAA and Fax: Are You Compliant? A Medical Office Checklist

Many medical offices assume that because fax has always been an acceptable method for transmitting Protected Health Information (PHI), their fax practices are automatically HIPAA-compliant. That assumption is dangerous. HIPAA has specific requirements for how PHI is transmitted and stored — and a traditional fax machine fails several of them in ways that create real liability.

What HIPAA Actually Says About Faxing

HIPAA doesn't prohibit faxing PHI, but it does require that "reasonable safeguards" be implemented to protect PHI from unauthorized access. The HHS Office for Civil Rights (OCR) has published specific guidance on faxing, requiring:

• Verify fax numbers before sending to prevent misdirection
• Use a cover sheet with a confidentiality notice
• Confirm that the recipient's fax machine is located in a secure area
• Promptly remove faxes from output trays to prevent unauthorized access
• Maintain an audit trail of faxes sent and received

The Compliance Checklist

Use this checklist to assess your current fax compliance:

• ☐ Is your fax machine in a location where unauthorized individuals cannot access the output tray?
• ☐ Are faxes removed from the output tray promptly after receipt?
• ☐ Do you use a HIPAA cover sheet that includes a confidentiality statement?
• ☐ Do you have a policy for verifying fax numbers before sending PHI?
• ☐ Do you maintain a log of all faxes sent and received?
• ☐ Do you have a procedure for handling misdirected faxes?
• ☐ Have you signed a BAA with your fax service provider (if using electronic fax)?
• ☐ Is PHI faxed encrypted in transit (not applicable to traditional machines)?

Where Traditional Fax Machines Fall Short

Even with the best policies, traditional fax machines make compliance difficult:

• No encryption — Traditional PSTN fax transmissions are not encrypted. Interception is theoretically possible, particularly over digital networks. While OCR has historically accepted traditional fax as a "reasonable safeguard," the guidance is evolving.
• No automatic audit trail — Most machines produce a confirmation report, but not a searchable, stored log of every transmission.
• Output tray exposure — Documents sit in the output tray until retrieved. In busy clinics, this can be hours. OCR audit findings have included exactly this scenario.
• No access controls — Anyone with physical access to the machine can retrieve incoming faxes.

How Virtual Fax Resolves Each Issue

Virtual fax (vFax) addresses the compliance gaps inherent in hardware fax machines:

• End-to-end encryption — All transmissions are encrypted in transit
• Automatic audit logging — Every fax sent and received is logged with sender, recipient, timestamp, and page count
• No output tray — Incoming faxes deliver directly to a secure inbox or email; nothing sits unattended
• Access controls — Only authorized users can access the fax inbox
• BAA available — Broadtela signs Business Associate Agreements with covered entities

The OCR Enforcement Environment

HIPAA enforcement has intensified significantly. OCR has levied multi-million dollar settlements for PHI breaches involving fax misdirection and unauthorized access. Small practices have been fined $100,000–$500,000 for what they considered minor incidents. The cost of a vFax service ($10/month) is dramatically lower than the risk of a compliance event.

Taking the Next Step

For medical offices in South Carolina, Georgia, and Colorado ready to upgrade from traditional fax to HIPAA-compliant virtual fax, Broadtela handles the full transition: port your existing fax number (free), configure secure delivery to your authorized staff's email addresses, and provide a signed BAA. Your existing fax number continues working during the transition.