Every medical practice has a version of the story. A referral meant for a cardiology office goes to a florist whose number differs by one digit. A lab requisition goes to the right clinic but lands in a tray where a visitor can read it. A records packet for one patient includes a page that belongs to another. None of these takes a sophisticated attacker. They take a busy afternoon and a process that depends on nobody ever mistyping a number.
This article looks at why faxes go astray in a medical office, what the federal rules expect a practice to do about it, and which controls reduce the chance of it happening again. For the broader picture of how HIPAA applies to fax, see our guide to electronic fax and HIPAA compliance.
Why medical faxes go to the wrong place
Misdirected faxes almost always trace back to a small number of ordinary causes. Knowing which ones apply to your office tells you where to put your effort.
- Manual entry. A number typed from a referral form, a sticky note or a phone message is the single most common source of error. Transposed digits and a missed area code both produce a fax that completes successfully to someone else.
- Stale directories. Specialists move, payers consolidate fax lines and hospital departments change numbers. A speed dial entry or a printed list that nobody owns drifts out of date quietly.
- Reused cover sheets. A cover sheet saved from the last fax to a similar office carries the old recipient's name and number, and the person sending trusts it.
- Mixed batches. When several patients' documents are scanned or sent in one session, a page from one packet can slip into another. The fax reaches the right office but carries the wrong patient's information.
- Unattended receiving machines. A fax that arrives correctly can still be seen by the wrong person if it sits in a shared tray near a reception desk or a hallway.
The first four are sending problems. The last is a receiving problem, and it is the one practices most often overlook, because the fax technically went where it was supposed to go.
What the rules expect
HIPAA does not prohibit fax. What it requires is that a covered entity reasonably protect the information it sends. The Privacy Rule's administrative requirements say a covered entity must reasonably safeguard protected health information from any intentional or unintentional use or disclosure that violates the rule. A misdirected fax is a textbook unintentional disclosure, so the question an assessor asks is whether your safeguards were reasonable for the risk.
When a fax does go to the wrong recipient, the breach notification rule decides what happens next. Its definitions, including the narrow exceptions for things such as a good faith, unintentional access by a workforce member, are set out in 45 CFR 164.402. Whether a particular misdirected fax is a reportable breach is a judgment your privacy officer makes under that rule, using the facts of the incident. This article does not make that determination for you, and no vendor can.
For faxes sent and received electronically, the Security Rule adds technical expectations, including audit controls and transmission security. Those matter less for preventing a typo than for answering the question every investigation starts with: what exactly was sent, when, and where.
Controls before a fax is sent
The most effective controls remove manual steps rather than asking staff to be more careful.
Keep one verified directory
Maintain a single list of the numbers your office sends to regularly: referral partners, payers, pharmacies, labs and hospitals. Give one person ownership of it. When a number is added, confirm it with the receiving office by phone rather than copying it from an inbound document. Review the list on a schedule, and remove entries you no longer use.
Confirm new recipients before the first send
For any number not already in the directory, make a quick call to confirm the number and the department before sending clinical information. It takes a minute and catches the transposed digit before it matters.
Send the minimum the recipient needs
A referral rarely needs the whole chart. Sending only what the receiving office needs reduces the harm if the fax goes astray. Our article on minimum necessary access for shared fax inboxes covers the same principle on the receiving side.
Use a cover sheet, but do not rely on it
A cover sheet with a confidentiality notice, the intended recipient, a callback number and a page count is good practice. It helps an unintended recipient do the right thing and helps the intended one notice a missing page. It does not prevent a misdirected fax, and it does not change whether an incident is a breach.
Separate patients in every batch
Send one patient's documents per transmission where you can, and check the page count against the packet before sending. A second person's review is worth adding for high sensitivity documents, such as behavioral health or substance use records.
Controls when a fax arrives
The receiving side of a misdirected fax problem is visibility. If incoming faxes print to a machine anyone can walk past, the safeguard depends on someone collecting them promptly. Moving incoming faxes to named inboxes that only the right staff can open removes the tray entirely. Our guide to routing incoming faxes to the right team explains how practices divide incoming traffic so each document has an owner.
What to do when a fax goes to the wrong recipient
A written procedure turns a stressful moment into a checklist. A workable one has five steps.
- Stop and contain. Do not resend until you know what went wrong. If the error is in a directory entry, correct it immediately so the next send does not repeat it.
- Contact the recipient. Call the number that received the fax, explain that it was sent in error, and ask that it be destroyed and not shared. Ask for confirmation in writing if the recipient is willing.
- Record the facts. Note what was sent, the number it reached, the time, who sent it and what the recipient said. A transmission record makes this step factual rather than reconstructed from memory.
- Escalate to your privacy officer. The breach assessment and any notification decision belong to them, under your practice's policy.
- Fix the cause. Decide which control failed and change the process, not only the person.
How online fax changes the risk
Online fax does not make a mistyped number impossible, and it is worth being clear about that. What it changes is how many of the causes above remain in play. Numbers can be chosen from saved contacts instead of typed. Incoming faxes go to designated email recipients instead of a shared tray. And every transmission leaves a record, which turns the first hour of an investigation from guesswork into a lookup. Our article on electronic fax audit trails covers what that record is good for.
LABUSA eFaaS provides encrypted transmission and storage, named accounts and access control, a queryable record of every transmission with status and delivery confirmation, and retention you configure to match your own schedule. Where your documents fall under HIPAA, the obligation to meet it stays with your practice, and those features are the material your own assessment can use. You can read how eFaaS works, see how it fits a medical office on our medical practices page, try LABUSA eFaaS free for 30 days, or request a workflow consultation. If you have questions first, contact our team.