Amputee Rehabilitation Program Fax Policy Checklist for Protecting PHI

Amputee rehabilitation programs may need to fax records to coordinate surgical follow-up, wound care, prosthetic fitting, physical therapy, and other treatment. A clear fax policy helps staff send information to the right care team while protecting patients’ protected health information (PHI).

Use this checklist alongside your organization’s policies and applicable state law. HIPAA requires appropriate safeguards for PHI; the specific workflow should reflect your program’s operations and risks. The HHS guidance on faxing PHI between providers identifies verifying the fax number and securing the fax machine as examples of reasonable safeguards.

When may an amputee rehabilitation program fax PHI without authorization?

If the program is a HIPAA covered entity, the Privacy Rule generally permits it to disclose PHI to another health care provider for treatment without the patient’s authorization. That can include sharing relevant records to coordinate care, such as information needed for prosthetic planning, therapy, or a referral. These HIPAA treatment disclosures may be made by fax or other means. See HHS guidance on treatment disclosures by fax.

The minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment. Even so, send information that is clinically appropriate for the purpose, follow any applicable patient restrictions and organizational policies, and use reasonable safeguards to prevent a misdirected or unauthorized disclosure. The rule’s treatment exception is described in 45 C.F.R. § 164.502.

If the disclosure is not for treatment between providers—for example, it is for a different purpose—do not assume the treatment exception applies. Check whether authorization or another Privacy Rule permission is needed, and consult your HIPAA privacy officer when the purpose or recipient is unclear.

How should staff verify fax recipients and numbers?

Before sending, confirm both the recipient’s identity and the destination number. Use a trusted source, such as a number already verified in the organization’s directory or a number confirmed directly with the recipient’s office using an independently verified contact method. Do not rely solely on a number in an unexpected fax, email, or message.

• Confirm the recipient’s name, organization, department, and role in the patient’s care.
• Read the fax number back or compare it with the verified directory entry; check each digit before dialing.
• If a number is new, recently changed, or otherwise uncertain, call the intended office using a known number to verify it.
• Check that any patient-specific routing instructions or restrictions are followed.

Recipient identity verification and number confirmation reduce the chance of sending PHI to the wrong office. HHS specifically identifies confirmation that the fax number is correct as an example of a reasonable safeguard in its faxing guidance.

What should a PHI fax cover sheet include?

Use your organization’s approved cover sheet to help route the fax and alert the recipient to handle it appropriately. Include only the information needed for delivery and follow-up, such as:

• The intended recipient’s name, organization, and department.
• The verified destination fax number.
• The sender’s name, organization, and a callback number.
• The date and time, the total number of pages including the cover sheet, and a brief non-sensitive subject or routing note when useful.
• A confidentiality notice asking an unintended recipient to stop reviewing the material, notify the sender, and follow the sender’s instructions for secure disposition.

A cover sheet supports careful handling, but it does not replace checking the fax number or securing the receiving machine. Avoid placing unnecessary clinical details or sensitive identifiers on the cover sheet; put information needed for care in the appropriate records pages and send them only to the verified recipient.

How can staff secure fax machines and incoming pages?

Place fax machines and multifunction printers in staff-only or otherwise controlled locations where passersby and unauthorized visitors cannot view or collect pages. Limit access to staff who need it for their work, and arrange incoming faxes to be retrieved promptly by an assigned employee.

• Keep outgoing documents face down or otherwise shielded while waiting to be faxed.
• Check the machine’s output tray, memory, and stored documents for PHI; clear or handle them under your organization’s retention and disposal policies.
• Retrieve incoming pages promptly, confirm the intended recipient, and deliver them through an approved secure process.
• Shred or securely dispose of misprints, duplicate copies, and other paper containing PHI according to policy.

HIPAA requires reasonable safeguards to protect PHI, including safeguards against unauthorized access to information handled by fax. HHS discusses securing the fax machine in its guidance for provider faxing.

What checks should staff complete before and after transmission?

Before transmission, match the documents to the correct patient and treatment purpose. Confirm the recipient and fax number, review the pages for unintended records or extra attachments, and check that each page is legible and properly oriented. Use an approved machine or service and follow your program’s procedures for handling PHI.

After sending, review the fax transmission confirmation report. Check that it shows a successful transmission to the intended number and the expected page count; if it reports an error, pause and investigate before trying again. A confirmation report helps document the transmission attempt, but it does not by itself establish that the intended clinician received, reviewed, or acted on the pages.

Record or retain transmission details as your organization’s policy requires, such as the date and time, recipient, destination number, pages sent, and outcome. If the pages are urgent for patient care, use an approved follow-up method to confirm receipt with the intended office.

How should staff respond to a misdirected fax?

If you discover that a fax containing PHI went to the wrong number, promptly notify your supervisor and HIPAA privacy officer or designated incident contact. Do not wait to determine on your own whether the event is reportable. Follow the organization’s incident-response procedure and document the facts, including what was sent, the destination, when it occurred, and any steps taken to contain the disclosure.

Where appropriate, contact the unintended recipient using a verified number. Ask them to stop reviewing or sharing the fax, securely destroy or return it as directed, and confirm what happened. Record the response. Then support the program’s assessment of the event; contacting the recipient does not by itself settle whether the disclosure requires notification.

Under the Breach Notification Rule, an impermissible disclosure of unsecured PHI is generally presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI was compromised through a documented breach risk assessment. The assessment considers the nature and extent of the PHI, who received it, whether it was actually acquired or viewed, and how the risk was mitigated. The HHS Breach Notification Rule guidance explains the standard. The privacy officer should determine notification obligations and any applicable deadlines.

Do the same safeguards apply to electronic faxing?

Yes. Electronic faxing still involves PHI, so the Privacy Rule’s safeguards apply. When PHI is created, received, maintained, or transmitted electronically, the HIPAA Security Rule also requires appropriate administrative safeguards, physical safeguards, and technical safeguards for electronic protected health information (ePHI). HHS describes these protections in its summary of the HIPAA Security Rule.

Use access controls for fax accounts and stored messages, verify recipients and destination numbers, protect transmitted information against unauthorized access, and handle downloaded, printed, or stored pages securely. Choose security measures based on your organization’s risk analysis and applicable Security Rule requirements; do not assume that every electronic fax method has the same protections.

Review the service arrangement as well. A vendor that creates, receives, maintains, or transmits PHI on the program’s behalf may be a business associate and may require a business associate agreement. The conduit exception is limited to transmission-only services, including only temporary storage incident to transmission. See HHS guidance on cloud services and the conduit exception.

A dependable fax policy combines verified recipients, careful document review, secure handling, transmission follow-up, and prompt incident escalation—whether staff use paper fax machines or electronic fax services.

FAQs.

Can PHI be faxed to another provider for treatment without patient authorization?

Generally, yes. HIPAA permits covered entities to disclose PHI to another health care provider for treatment without patient authorization. Staff should still verify the recipient and fax number, use appropriate safeguards, and follow organizational policy and any applicable patient restrictions. See HHS guidance on provider-to-provider faxing.

What steps should staff take before sending PHI by fax?

Confirm the treatment purpose and recipient, verify the fax number using a trusted source, check that the documents belong to the correct patient, and review the pages for unnecessary or misfiled information. Use the approved cover sheet and fax method, then check the transmission confirmation report after sending.

What should staff do if a fax containing PHI is sent to the wrong number?

Notify the supervisor and HIPAA privacy officer promptly, document what happened, and follow the organization’s incident-response process. When appropriate, contact the unintended recipient using a verified number and request secure disposition of the fax. The privacy officer should assess whether the incident is a breach and determine any notification obligations under the HHS Breach Notification Rule guidance.

Do electronic faxes require the same safeguards as paper faxes?

Yes. Privacy safeguards apply to PHI in any form, and the Security Rule applies when the information is electronic ePHI. Programs should verify destinations, restrict access, protect transmission and storage, and assess whether the service provider is a business associate. See the HHS Security Rule summary.