Anal Cancer Screening Clinic Fax Policy: PHI Compliance Checklist

When Can a Clinic Fax PHI for Treatment?

A HIPAA-covered clinic may fax protected health information (PHI) to another health care provider for treatment without obtaining the patient’s authorization. This HIPAA treatment disclosure may include relevant records or test results needed to provide care. HHS guidance on treatment communications confirms that treatment information may be shared by fax when the clinic uses reasonable safeguards.

The minimum necessary standard does not apply to disclosures to, or requests by, a health care provider for treatment purposes. Even so, a clinic can follow its own policies for sending information appropriate to the care being coordinated. If the fax is for a purpose other than treatment, check the applicable HIPAA permission or authorization requirements. HHS’s Privacy Rule guidance explains the standard and its exceptions.

Checklist:

• Confirm the recipient is a health care provider involved in the patient’s care.
• Verify the disclosure’s treatment purpose and follow clinic policy.
• Use reasonable safeguards to prevent an unintended disclosure.

How to Verify Fax Recipients and Numbers

Before sending PHI, confirm the recipient and destination number—especially if the number is unfamiliar, recently supplied, or not used regularly. Call the recipient using a trusted number from your directory or another verified source, rather than relying only on a number included in an unexpected request. HHS identifies confirming a new fax number with the intended recipient as a possible reasonable safeguard.

Use approved, regularly maintained contacts or preprogrammed numbers where practical, and have staff double-check the displayed number before transmission. A fax transmission confirmation can help document that a transmission was attempted or completed, but it does not by itself prove that the correct person received or reviewed the pages.

Checklist:

• Match the recipient’s name, organization, department, and fax number.
• Independently confirm unfamiliar or changed numbers before sending.
• Review the number entered or selected before pressing “send.”
• Retain the transmission confirmation according to clinic policy and investigate failed or uncertain transmissions.

HHS guidance on physician-to-physician faxes also identifies number verification and secure fax-machine placement as examples of safeguards.

What Safeguards Should a Fax Cover Sheet Include?

HIPAA does not prescribe one mandatory fax cover-sheet template or a specific disclaimer. A cover sheet is a practical safeguard, but it cannot replace verifying the fax number, limiting access, and following clinic procedures. Keep the cover sheet discreet and avoid unnecessary patient details that could expose sensitive information if it is misdirected.

Consider including the intended recipient and organization, destination fax number, sender and callback number, date, and total page count. A brief confidentiality notice can ask an unintended recipient to contact the sender promptly and follow instructions to secure or dispose of the pages. Do not rely on a notice alone to prevent or resolve an improper disclosure.

Checklist:

• Include clear routing details and a sender callback number.
• State the number of pages, including the cover sheet.
• Use a concise notice explaining what to do if the fax arrives in error.
• Keep patient identifiers and clinical details off the cover sheet unless needed for routing.

How to Secure Fax Machines and Incoming Documents

Place fax machines and output trays where people without a work-related need cannot casually view or collect PHI. Limit access to authorized staff, assign responsibility for monitoring incoming faxes, and retrieve pages promptly. Route received documents to the appropriate care team and store them in approved records systems or secure files.

Train staff to check the recipient and page count, handle misdirected incoming documents under clinic policy, and dispose of unneeded paper securely. Written procedures should address both incoming and outgoing faxes. HHS identifies secure fax-machine placement as an example of a reasonable safeguard; safeguards should fit the clinic’s circumstances.

What to Do When PHI Is Sent to the Wrong Number

Stop further transmission and promptly notify the clinic’s privacy or security officer according to internal policy. Record the facts, such as the recipient number, time, pages involved, type of PHI, and steps taken. If appropriate under the clinic’s procedures, contact the unintended recipient through a verified channel, request that the information not be used or shared, and arrange for its secure return or destruction. Do not send another copy of the PHI to the mistaken number.

The clinic must assess the incident under the HIPAA Breach Notification Rule; an impermissible disclosure is generally presumed to be a breach unless an exception applies or a documented breach risk assessment shows a low probability that the PHI was compromised. The assessment considers the information involved, who received it, whether it was actually acquired or viewed, and how the risk was mitigated. HHS breach guidance describes this assessment and applicable notification obligations. A wrong-number fax does not automatically mean that notification is required; the clinic’s privacy officer should determine the required response and document it.

How Fax Procedures Apply to Anal Cancer Screening Results

Anal cancer screening communications may contain sensitive PHI, including anal cytology or HPV test reports, pathology findings, referrals for high-resolution anoscopy (HRA), and findings from a digital anorectal examination. Fax results only to a verified care provider or other recipient authorized to receive them, and use safeguards appropriate to the disclosure.

For follow-up care, send the report and clinical details the receiving provider needs to act on the result, such as the result interpretation, recommended follow-up, or referral information. Anal cytology findings may lead to follow-up such as HRA or biopsy, depending on the clinical plan. The CDC’s anal cancer guidance discusses anal cytology and follow-up for abnormal results, including HRA and biopsy where available. Follow current clinical guidance and the treating clinician’s plan; do not use a fax policy to determine screening eligibility or interpret results.

A consistent policy—verify the recipient, safeguard the transmission and documents, and promptly escalate errors—helps protect PHI while supporting timely follow-up care.

FAQs

Can a clinic fax PHI to another provider for treatment without patient authorization?

Yes. HIPAA permits a covered provider to disclose PHI to another health care provider for treatment without the patient’s authorization. The clinic must still use reasonable safeguards, including confirming the recipient and fax number.

How should staff verify an unfamiliar fax number before sending PHI?

Staff should confirm the number directly with the intended recipient using a trusted contact method, then check the number entered or selected before sending. A number supplied in an unexpected request should not be treated as verified on its own.

What should staff do if they receive a misdirected fax containing PHI?

Staff should promptly notify the clinic’s privacy or security officer and follow internal procedures to secure the pages and arrange their return or secure disposal. They should not copy, forward, or otherwise share the information, and should document the incident as directed by policy.

Which anal cancer screening results may be sent by fax for follow-up care?

When the recipient is verified and authorized to receive the information, relevant results may include anal cytology or HPV testing reports, pathology findings, and clinical findings from a digital anorectal examination. A referral or follow-up plan, such as a recommendation for HRA, may also be sent when needed for care.