Ask a room of practice managers how long they keep faxed documents and you will hear several different answers, often with HIPAA cited as the reason for each. The confusion is understandable. HIPAA does set a retention period, but not for the thing most people mean. And the question of how long to keep a fax is only half of the problem. The other half is what happens to every copy when that period ends.
This article separates the rules that actually set retention, explains how faxed documents fit into a practice's existing records schedule, and covers disposal of both paper and digital copies.
What HIPAA's retention period covers
Both the Privacy Rule and the Security Rule require a covered entity to retain certain documentation for six years. Under the Privacy Rule's administrative requirements, documentation must be kept for six years from the date of its creation or the date when it last was in effect, whichever is later. The Security Rule's documentation requirements use the same period for its own policies, procedures and records of required actions.
That documentation is about how the practice protects information: its policies and procedures, its risk analyses, its records of required actions and assessments. It is not the medical record. HIPAA does not set a general retention period for patient charts, and faxed clinical documents that become part of the chart follow the chart's schedule.
So a practice ends up with two different retention questions about fax:
- The documents. A faxed referral, result or consult note that belongs in the medical record is kept for as long as the record is kept. That period is set by state law, by payer and program requirements, and by your practice's own policy. It varies, and it is not something this article can state for you.
- The documentation about fax. Your fax policies, the risk analysis that covered your fax service, and records such as a misdirected fax investigation are compliance documentation, and HIPAA's six year period applies to them.
Confirm the medical record periods that apply in your state with your compliance adviser before you configure any automatic deletion.
Where faxed documents actually live
Retention only works if you know where every copy is. Paper fax concentrates copies in one place. Online fax can quietly multiply them. A single incoming referral can exist as:
- the stored copy held by the fax service;
- the email delivered to each designated recipient, and any forwards of it;
- a downloaded file on a workstation;
- the copy attached to the patient's chart; and
- a printed copy, if someone printed it.
Your schedule should say which of those is the copy of record, and what happens to the others. In most practices, the chart is the copy of record for clinical documents, and every other copy is a working copy that should not outlive its usefulness. Our article on naming, filing and tracking faxed documents covers how to make the chart copy easy to find, which makes the working copies easier to let go.
Transmission records are a separate category
The record that a fax was sent or received, with its date, status and delivery confirmation, is not the document itself. It is often the evidence you need when a referral is disputed or a misdirected fax is investigated. Decide its retention deliberately rather than letting it follow the documents. Our guide to electronic fax audit trails and records management explains why the two are worth treating differently.
Disposing of paper copies
The Privacy Rule requires reasonable safeguards for protected health information in any form, and paper is where a lot of fax disposal goes wrong. Practical controls are straightforward:
- Use locked shredding bins near every place faxes are printed, so the convenient option is also the safe one.
- Do not use paper faxes as scrap paper, and do not leave them in recycling.
- If a shredding vendor handles collection, treat their access to documents as part of your vendor review.
Disposing of digital copies and devices
The Security Rule's physical safeguards include two required implementation specifications that apply directly here. Disposal requires policies and procedures for the final disposition of electronic protected health information and of the hardware or media on which it is stored. Media re-use requires procedures for removing that information before media is reused.
Fax hardware is easy to forget in that inventory. Many fax machines and multifunction printers store page images in internal memory or on a hard drive. A leased device returned at the end of its term, or an old machine sent to recycling, can leave with patient documents still on it. NIST's Guidelines for Media Sanitization describe how to make data on storage media infeasible to recover, and they are a useful reference when you write your own disposal procedure or ask a vendor how they handle returned equipment.
If you are retiring a fax machine as part of a move to online fax, add sanitization to the project plan. Our step by step guide to replacing the medical office fax machine includes it as a step.
Email and workstation copies
Fax-to-email puts documents in mailboxes. Decide how long a delivered fax may remain in a mailbox after it has been filed to the chart, and whether downloaded copies on workstations are permitted at all. A short, enforced rule is better than a long one nobody follows.
Write it down as one schedule
A workable fax retention schedule fits on one page. For each category of faxed document, it names the copy of record, how long that copy is kept and under which rule, what happens to working copies and when, and who is responsible. Include the transmission records and the compliance documentation about fax as separate lines. Review it whenever your fax setup changes, and keep the reviewed versions, because those reviews are documentation too.
Where LABUSA eFaaS fits
LABUSA eFaaS stores fax documents with encryption and lets you configure retention to match your own schedule, so the copies the service holds follow your policy rather than a default you did not choose. Every transmission also leaves a queryable record. Where your documents fall under HIPAA or state records rules, the obligation to meet them stays with your practice, and the retention periods are yours to set.
See how this fits a medical office on our medical practices page, review the eFaaS features, try LABUSA eFaaS free for 30 days, or request a workflow consultation. You can also contact our team with questions.