HIPAA Fax Cover Sheet Template (Free and Printable)

Download a free, printable confidential fax cover sheet below, or copy the disclaimer wording into your practice's own sheet. A cover sheet is a useful safeguard, but it does not make a fax HIPAA compliant by itself. The procedures around the fax matter more: verifying the number, sending only what's needed, confirming receipt, and handling a misdirected fax. Those are covered further down this page.

Download the HIPAA fax cover sheet template

[Embedded preview: confidential fax cover sheet, page 1]

[Download the template]

There are two versions:

Version	Use it for
General confidential fax cover sheet	Billing correspondence, vendor documents, HR paperwork, and other non-patient business faxes
Cover sheet with PHI disclaimer	Patient records, referrals, lab requests, prior authorizations, and any fax that contains protected health information

To customize: add your practice name, logo, address, phone, and fax number once, then save the file as your default so staff only fill in the per-fax fields.

The template is free. For more forms and checklists, browse our free HIPAA tools and templates.

What to include on a confidential fax cover sheet

Both versions of the template use the same layout. If you're building your own sheet, include these blocks:

Block	Fields	Why it matters
Sender	Practice name, sender name and role, phone, fax number	Tells the recipient who to call if pages are missing. It also gives a wrong recipient a way to reach you.
Recipient	Recipient name, organization, fax number, phone number	Lets the person picking up the fax route it to the right desk. Also gives your staff a number to call to confirm receipt.
Transmission details	Date, time, total pages (including cover), subject line	The recipient can check that nothing is missing. Keep the subject generic, such as "Records request" or "Referral documents."
Confidentiality notice	Short or long disclaimer (see below)	States that the contents are confidential and intended for one recipient.
Received-in-error instructions	Who to notify, how, and what to do with the pages	Gives a wrong recipient clear next steps instead of leaving them to guess.

What to leave off the cover sheet itself: patient names, dates of birth, medical record numbers, diagnoses, and any other PHI. The cover sheet is the page most likely to be seen by someone other than the recipient, whether that's a shared fax tray, a front desk at the receiving office, or the wrong number entirely. "Records for patient Jane Doe, DOB 03/14/1962" belongs in the attached pages, not the subject line.

If you're faxing records in response to a request, confirm you have a valid authorization where one is needed. Our HIPAA release form template covers that step. A HIPAA-compliant form builder for records request and intake forms is planned. That page shows its current status.

HIPAA fax disclaimer: sample wording you can copy

Copy either block into your cover sheet. Both are templates, not legal advice.

Short version

CONFIDENTIAL: This fax is intended only for the person or organization
named above. If you are not the intended recipient, do not read, copy,
share, or use its contents. Please notify the sender immediately at the
phone number above and destroy all pages received.

Long version (for faxes containing patient information)

CONFIDENTIALITY NOTICE: The pages accompanying this cover sheet contain
confidential information, which may include protected health information
(PHI) that is legally protected under applicable federal and state law.
This information is intended only for the use of the individual or
entity named above. If you are not the intended recipient, you are
notified that any review, disclosure, copying, distribution, or action
taken in reliance on the contents is prohibited. If you received this
fax in error, please call the sender immediately at the number listed
above to arrange for return or destruction of the documents, and do not
retain any copies.

Before you use either block: have your privacy officer approve the final wording. State law may add requirements for certain types of records.

Does HIPAA require a fax cover sheet?

HIPAA does not prescribe a specific fax cover sheet or disclaimer wording. The Privacy and Security Rules require covered entities to have reasonable administrative, technical, and physical safeguards to protect PHI.

A cover sheet with a confidentiality notice is one administrative safeguard among several. It works alongside verified numbers, staff training, and a written fax procedure. It does not replace them.

A disclaimer also cannot undo a misdirected fax. If PHI goes to the wrong number, the incident may still be a breach that your practice needs to assess under the Breach Notification Rule. The notice may help by asking the recipient to destroy the pages and call you. It doesn't remove your obligations.

For the full picture, including e-fax considerations, read our guide to HIPAA fax requirements and disclaimers.

Safe faxing checklist for front desk staff

Print this and post it next to the fax machine, or add it to your written procedure.

• Verify the number before every send. Check it against the requesting office's letterhead or a phone call, not a sticky note. Program frequent recipients, such as your top referral partners, labs, and payers, into speed dial, and review those entries on a set schedule.
• Send the minimum necessary. Include only what the recipient needs for the stated purpose. For example, a prior authorization request may need the last visit note, not the full chart.
• Call ahead for sensitive records. For behavioral health, substance use, HIV, or reproductive health records, confirm that someone is standing by at the receiving machine.
• Confirm receipt. Check the transmission report. For records that matter, call to confirm that all pages arrived.
• Keep machines out of public view. Fax machines and shared printers shouldn't face the waiting room. Don't leave incoming faxes sitting in a shared tray.
• Know the misdirected-fax steps in advance. Write down who to tell (your privacy officer or supervisor), how fast, and how to contact the wrong recipient to request destruction. Use your practice's incident process. Don't improvise.

More checklists and procedures for front desk and admin teams are in our operations library for practice managers.

Keeping fax follow-ups from falling through the cracks

The cover sheet is rarely what goes wrong. Follow-up is. Common gaps include:

• Nobody calls to confirm that a records packet arrived.
• A specialist's office never sends back the consult note, and nobody chases it.
• A misdirected fax gets mentioned at the front desk but never reaches the privacy officer.

A practice can use Chanty to coordinate this work internally. Turn the message where the issue came up into an assigned task with an owner and a due date, for example "Confirm receipt of records sent to Dr. X's office by Thursday." Then track it on the Kanban board until it's closed. Tasks and Kanban are available on all plans.

For multi-location groups, a team channel with pinned messages keeps the current fax procedure, the approved cover sheet file, and the speed-dial list in one place. Every location then works from the same version. If you link files from Google Drive, Dropbox, or other integrations, that storage sits outside Chanty's BAA.

Compliance framing: if staff will discuss PHI in these threads, use a Business or Enterprise plan with a signed BAA. Do not put PHI on the Free plan, because no BAA is available there. See how the BAA works on Business and Enterprise plans, and read more about HIPAA-compliant chat for staff.

Chanty is internal team chat for staff. It does not send or receive faxes today, and it isn't used to send records to patients or outside providers.

Online fax in Chanty: what's planned

A HIPAA-oriented online fax tool is planned. It is not available yet. Check the HIPAA-compliant online fax (planned) page for current status.

If you need e-fax now, our HIPAA fax rules guide (linked above) lists what to ask any e-fax vendor:

• Will they sign a BAA?
• How are faxes encrypted in transit and at rest?
• What audit logs are available?
• How long are faxes retained?

FAQ

Is a fax cover sheet required by HIPAA?

HIPAA doesn't require a specific cover sheet. It requires reasonable safeguards for PHI, and a cover sheet with a confidentiality notice is one such safeguard.

What should a HIPAA-compliant fax cover sheet say?

Include:

• Sender and recipient contact details
• Date and page count
• A generic subject line
• A confidentiality notice
• Instructions for anyone who receives it in error

Using a cover sheet doesn't make a fax compliant on its own. Your procedures do most of the work.

Can I put the patient's name on the fax cover sheet?

No. Keep patient names, dates of birth, and other identifiers on the attached pages. The cover sheet is the page most likely to be seen by the wrong person.

Does a confidentiality disclaimer protect us if a fax goes to the wrong number?

Not by itself. A disclaimer may prompt the recipient to destroy the pages and contact you, but the incident may still need a breach assessment.

What do I do if we send a fax with PHI to the wrong recipient?

Tell your privacy officer right away and follow your practice's incident process. Typically that means:

1. Contact the wrong recipient to request destruction.
2. Document what was sent.
3. Let the privacy officer assess whether notification is required.

Is faxing PHI allowed under HIPAA?

Yes, faxing PHI is generally permitted when reasonable safeguards are in place. Those safeguards include verifying numbers, sending the minimum necessary, and securing machines.

Can I use this template for non-medical confidential faxes?

Yes. Use the general confidential version for HR, legal, billing, or vendor documents that don't contain PHI.

Does Chanty send faxes?

No. Chanty is internal team chat and task coordination for staff. An online fax tool is planned but not available yet.