HIPAA Fax Requirements: What the Rules Say About Faxing, Storage and Disclaimers

Faxing PHI is allowed under HIPAA. HIPAA has no fax-specific rule, and no fax machine, number or service is "HIPAA compliant" on its own. Compliance comes from the safeguards around the fax: who can send and see it, how it travels, where it is stored, and whether your vendor contracts cover it. This guide turns the general Privacy Rule and Security Rule requirements into concrete steps for sending, receiving, storing and forwarding faxes. Regulatory points are summarized in plain language. Use the guide as a starting point for your own policy and review it with your privacy officer or counsel. It is not legal advice.

Is faxing HIPAA compliant? The short answer

Yes, you can fax PHI. HIPAA does not ban fax and does not regulate it specifically. What HIPAA expects is reasonable safeguards and a documented process.

Two sets of rules apply:

• The Privacy Rule covers all PHI, including paper. It requires you to disclose only the minimum necessary and to have reasonable administrative, technical and physical safeguards.
• The Security Rule covers electronic PHI (ePHI), which includes faxes received as digital files, stored in a cloud portal or delivered to email.

So "Is a fax HIPAA compliant?" is the wrong question. The useful question is whether your fax process is.

The three common fax setups carry different risks:

Setup	How it works	Main risks
Traditional fax machine	Paper scanned and sent over a phone line to another machine	Wrong number, unattended output tray, machine in a public area, images kept in device memory
Online / cloud fax	Faxes sent and received through a web portal or app; files stored by the provider	Vendor access to PHI, account security, storage and retention at the vendor
Fax-to-email	Incoming faxes delivered to an email inbox as attachments	PHI sitting in email, forwarding, personal accounts, unencrypted email transit

Traditional paper-to-paper fax may fall outside the Security Rule's definition of electronic media. Even so, the Privacy Rule still applies. Most modern machines also store images on internal memory or a hard drive, and that storage is ePHI.

What HIPAA requires when you send a fax

Send the minimum necessary. If a specialist's office needs a referral and the last two visit notes, send those, not the full chart. The minimum necessary standard does not apply to disclosures to a provider for treatment. Trimming the packet still reduces exposure if it goes to the wrong number.

Verify the number before you send. Most misdirected faxes come from a single wrong digit or an outdated directory entry. Practical controls:

• Pre-program numbers for frequent recipients, such as referral partners, labs and payers.
• Re-check pre-programmed numbers on a schedule, for example quarterly, and whenever a partner moves or merges.
• For a new recipient, call to confirm the number, or send a test page without PHI first.
• Have a second person check the number for large or sensitive packets, such as behavioral health or substance use records.

Use a cover sheet. Include sender, recipient, date, page count, a callback number and a confidentiality notice. You can start from our confidential fax cover sheet template.

Control who sends and where. Keep fax machines out of waiting rooms and away from the check-in counter. Limit who can send PHI by fax to trained roles, such as front desk leads, referral coordinators and medical records staff.

Confirm receipt and keep logs. For sensitive documents, call or check that the recipient got every page. Keep the transmission confirmation report, or the online fax log, with the date, number, page count and sender. Logs help you trace a misdirected fax and support an audit.

Receiving faxes: the overlooked risk

Most fax policies focus on sending. Receiving is where PHI often sits exposed: lab results, referrals and records requests piling up in a tray that anyone walking by can read.

• Assign ownership. Name a person per shift, or per location in a multi-site group, who clears the fax tray or online inbox. Set a pickup routine, such as at opening, at midday and before close.
• Restrict access. Put receiving machines in staff-only areas. For online fax inboxes, give each user an individual login with access only to the queues they handle.
• Route quickly and document it. Referrals go to scheduling, records requests to medical records, prior authorizations to the billing team. Record who took each fax and what happened to it, so nothing sits unowned.
• Handle faxes meant for someone else. Staff should know the drill: don't read further than needed to identify the intended recipient, notify the sender, then return or destroy the fax per your policy. Practices with similar names or recycled numbers see this often.

Online fax, fax-to-email and encryption

Cloud fax vendors and business associates. An online fax provider that creates, receives, maintains or transmits PHI on your behalf is generally a business associate. That means you need a signed business associate agreement (BAA) before using it for PHI. The "conduit exception" covers transmission-only services, such as telephone carriers, that don't store PHI beyond temporary transmission. Cloud fax providers usually store faxes, so the exception typically doesn't apply.

Fax-to-email. Once a fax lands in an inbox, it is ePHI in your email system. The email provider then needs safeguards and a BAA too. Personal Gmail or Yahoo accounts set up "temporarily" by a front desk are a real risk: they have no BAA, no central access control and no offboarding. For a starting point on email and other common tools, see which popular tools are HIPAA compliant.

Encryption is addressable, not optional. Under the current Security Rule, encryption of ePHI in transit and at rest is an "addressable" implementation specification. "Addressable" doesn't mean you can skip it. You must assess whether it is reasonable and appropriate, implement it if so, or document why not and what equivalent measure you use instead. For cloud fax and email, encryption is the expected default in practice.

Questions to ask any fax vendor:

1. Will you sign a BAA, and on which plan?
2. How are faxes encrypted in transit and at rest?
3. Do you support individual user accounts, role-based access and two-factor authentication?
4. Do you keep audit logs of who viewed, downloaded or forwarded each fax?
5. What are your retention defaults, and can we set our own retention and deletion?
6. What happens to our faxes if we cancel the account?

Confirm answers against the vendor's current documentation and contract.

How to store faxes so storage meets HIPAA

Paper faxes

• Keep them in locked cabinets or rooms, with access limited to the roles that need them.
• Don't leave them in open bins at the front desk overnight.
• Shred them through a secure method, such as cross-cut shredding or a shredding vendor under a BAA, when retention ends.
• When a fax machine or copier is retired, wipe or destroy its internal storage.

Digital faxes

• Store them in encrypted storage with role-based access.
• Give every person a unique login. No shared "frontdesk@" account.
• Keep audit logs of access.
• Back up files and test restores.
• Remove access promptly when staff leave.

Retention. HIPAA itself does not set how long you keep medical records. That comes from state law and payer or program rules. HIPAA does require you to keep your HIPAA documentation, such as policies, risk assessments and certain records, for six years. Once a fax is filed into the medical record, the medical record retention schedule governs it.

Common storage gaps. Watch for faxes saved to a shared drive folder everyone can open, PDFs left on a reception desktop, and years of fax attachments sitting in an email inbox. Once a fax is filed into the chart or the right system, delete the stray copies.

Fax cover sheet disclaimers: required or best practice?

HIPAA does not require a cover sheet or specific confidentiality notice wording. A disclaimer is best practice, not a regulatory requirement.

Be clear about what a disclaimer does. It does not prevent a breach and does not make a misdirected fax compliant. What it does is tell a wrong recipient what to do, which helps you get the document back or destroyed quickly.

A typical notice includes:

• A statement that the fax contains confidential information intended only for the named recipient
• An instruction not to read, copy or share it if received in error
• An instruction to notify the sender and destroy the document
• A phone number to call

Sample text to adapt:

CONFIDENTIALITY NOTICE: This fax may contain confidential health information intended only for the recipient named above. If you received it in error, do not read, copy or share it. Please call [practice phone number] immediately and destroy all pages. Thank you.

Add this text to the cover sheet template mentioned above, and have your privacy officer or counsel approve the final wording.

What to do when a fax goes to the wrong number

1. Contact the recipient right away. Ask them to destroy or return all pages, and request written confirmation, such as an email or signed attestation, where possible.
2. Log the incident and notify your privacy officer the same day. Record the date, what was sent, the wrong number, who sent it and the steps taken so far.
3. Run the breach risk assessment. The privacy officer decides whether notification is required. The assessment considers the nature and extent of the PHI, who received it, whether it was actually viewed or acquired, and how far the risk was mitigated.
4. Fix the cause. Common causes are a wrong pre-programmed number, an outdated provider directory, a rushed manual entry at a busy check-in, or a partner who changed numbers. Correct the source and note the fix in the incident log.

HIPAA fax compliance checklist

Policy

• Written fax procedure covering sending, receiving, storage and disposal
• Approved list of frequent recipients, with numbers re-verified on a schedule
• Defined roles that may send PHI by fax

People

• Staff training at onboarding and refreshed periodically
• Named owner for incoming faxes per shift or location

Technology

• BAA with any online fax provider and with the email provider, if you use fax-to-email
• Encryption in transit and at rest, or a documented alternative
• Individual logins, role-based access and audit logs
• Fax machines in staff-only areas

Storage and disposal

• Retention schedule based on state law and payer rules
• Secure shredding for paper; secure deletion for digital copies
• Wiping of device storage when machines are retired

Incidents

• Misdirected fax procedure that staff know
• Incident log and breach risk assessment steps owned by the privacy officer

For related templates, see our free HIPAA tools and templates. To collect intake or request details online instead of by fax, see our planned HIPAA-compliant form builder.

Coordinating fax follow-up with your team

A fax rarely ends when it prints. It creates internal work:

• A referral that needs scheduling
• A records request with a deadline
• A prior authorization form to complete
• A missing page to chase from the sender

When that follow-up lives in sticky notes or personal text threads, items get dropped.

Chanty is a staff chat for this kind of administrative coordination, used alongside your EHR and fax setup, not in place of them. Someone posts "Referral from cardiology received, route to scheduling," turns it into a task, and assigns it with an owner and a deadline. The team can see when it's done. A good habit is to reference the fax by date, sender or log ID rather than pasting more PHI than the task needs.

HIPAA with a signed BAA is available on Chanty's Business and Enterprise plans, not on Free. That BAA covers Chanty only, not your fax vendor, email system or third-party integrations. Your practice remains responsible for configuring roles and access, offboarding users and setting staff policies. Learn more about HIPAA-compliant chat for staff and how Chanty handles security, HIPAA and the BAA.

Chanty's own fax tool is planned and not available today. For updates, see online fax for healthcare (planned).

To coordinate fax follow-up in a staff chat, start with Chanty.

FAQ

Is faxing HIPAA compliant?

Faxing PHI is permitted under HIPAA. Whether your faxing is compliant depends on your safeguards: minimum necessary content, verified numbers, controlled access, secure storage, and BAAs with any vendor that handles the faxes.

Are fax machines HIPAA compliant?

No device is HIPAA compliant by itself. A fax machine can be part of a compliant process if it sits in a staff-only area, only trained staff use it, output is picked up promptly, and internal storage is wiped before disposal.

What is a HIPAA compliant fax service?

Usually it means an online fax provider that will sign a BAA and offers safeguards such as encryption, individual logins, access controls and audit logs. The label alone doesn't make you compliant. You still need policies, training and correct configuration.

Is fax to email HIPAA compliant?

It can be, if the email system has appropriate safeguards and its provider has signed a BAA with you. Faxes delivered to email are ePHI. Avoid personal email accounts and limit forwarding.

Do online fax providers need to sign a BAA?

Generally yes, if they create, receive, maintain or transmit PHI on your behalf, which includes storing faxes. The conduit exception is narrow and typically doesn't cover services that store PHI.

Are faxes more secure than email?

Not inherently. Each has different risks. Fax risks include wrong numbers and unattended trays. Email risks include forwarding and unsecured accounts. Security depends on the setup and safeguards, not the channel name.

Does HIPAA require a fax cover sheet or confidentiality disclaimer?

No specific cover sheet or disclaimer wording is required. A cover sheet with a confidentiality notice is widely used best practice. It helps a wrong recipient respond, but it does not prevent a breach.

How long do we need to keep faxed medical records?

Medical record retention is set by state law and payer or program rules, not by HIPAA. HIPAA separately requires keeping HIPAA documentation for six years. Check with your privacy officer or counsel for your state.

Is a misdirected fax a HIPAA breach?

It may be. An impermissible disclosure is generally presumed to be a breach unless a documented risk assessment shows a low probability that the PHI was compromised, or a regulatory exception applies. Report it to your privacy officer right away.

Can we fax medical records to a patient or another provider?

Generally yes. Disclosures to another provider for treatment are permitted. Patients have a right of access, which can include receiving records in the form they request if you can readily produce it. Verify the number and the identity of the recipient, and follow your release and authorization procedures.