How to Respond to a Misdirected Fax Containing Fungal Isolate Database Information

A misdirected fax can expose confidential research, operational, or health information. Fungal isolate database information is not automatically protected health information (PHI): HIPAA applies when information relates to a person’s health, care, or payment and identifies that person—or could reasonably identify them—and is held or transmitted by a HIPAA-regulated entity. Follow your organization’s privacy and incident-response procedures while the appropriate staff determine which rules apply. HHS OCR’s HIPAA Privacy Rule summary

What to do immediately after receiving a misdirected fax

Stop the information from spreading. Don’t copy, scan, photograph, upload, discuss, or forward the fax unless an authorized person directs you to do so for incident handling. Limit access to people who need to respond.

Secure the pages in a location that others cannot access, and note when and how you received them, the sender details shown on the fax, and who may have seen them. Don’t investigate the database or read more of the fax than necessary to recognize and report the incident.

Contact your supervisor or privacy or compliance officer promptly using your organization’s incident-reporting process. If you are outside the sender’s organization, contact the sender using a phone number you verify independently—not solely a number printed on the fax—and ask how to handle the documents. HHS advises verifying fax numbers, particularly when using a number for the first time. HHS OCR’s fax and other communications guidance

How to keep fungal isolate database information secure

Treat the fax as confidential while its sensitivity is being assessed, even if it appears to contain only isolate codes or laboratory details. It may also include patient identifiers, case details, unpublished research, or other information protected by organizational policy or agreements.

Keep the pages together and out of public view; don’t leave them in a shared fax tray. Avoid sending them through email or another fax as a quick way to return them. If an authorized officer needs to examine or transfer the material, use the method and access controls approved by your organization.

HIPAA’s Privacy Rule protects individually identifiable health information held or transmitted by covered entities and their business associates in paper, electronic, or other form. For electronic PHI, the Security Rule requires safeguards against reasonably anticipated impermissible uses and disclosures, including protections for information in transmission. HHS OCR’s HIPAA Privacy Rule summary and HHS OCR’s Security Rule summary

When and how to notify a privacy or compliance officer

Report the incident as soon as possible under your organization’s privacy incident reporting policy. Don’t wait to determine whether the fax contains PHI or whether it meets the legal definition of a breach; that assessment belongs to the organization’s designated privacy, compliance, or security staff.

Provide the facts you know without forwarding the documents through an unapproved channel. Include the time received, where the fax was found, the apparent sender and intended recipient if shown, whether anyone viewed or copied it, and what steps you took to secure it. Follow instructions about preserving, returning, or destroying the fax, and keep a record of your report.

HIPAA requires regulated entities to have procedures for identifying and responding to security incidents, mitigating harmful effects where possible, and documenting incidents and their outcomes. HHS OCR’s Security Rule summary

How to assess whether the fax incident requires breach notification

A misdirected fax does not automatically require HIPAA breach notification. The organization must first determine whether the information is PHI and whether an impermissible use or disclosure of unsecured PHI occurred. Database information that does not identify an individual or relate to that individual’s health, care, or payment may not be PHI, though other confidentiality obligations may still apply.

Under HIPAA, an impermissible use or disclosure of PHI is generally presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI was compromised through a risk assessment. The assessment must consider at least the nature and extent of the PHI, who received it, whether it was actually acquired or viewed, and how much the risk was mitigated. HHS OCR’s Breach Notification Rule guidance

For example, the organization may need to establish whether the fax included identifying information, whether the recipient was authorized to receive it, and whether the recipient returned or securely destroyed it without further disclosure. Do not make the notification decision yourself; promptly give the facts to the officer responsible for the assessment and follow applicable organizational policy.

How to return or securely destroy the documents

Don’t mail, refax, or destroy the pages on your own initiative. Ask the privacy or compliance officer—or, if you are an unintended recipient outside the organization, the sender through a verified contact channel—whether to return the original, arrange an approved secure transfer, or destroy it.

If destruction is authorized, use your organization’s approved method and document what was destroyed and when. HHS says paper PHI should be shredded or otherwise destroyed so it is essentially unreadable, indecipherable, and cannot be reconstructed before it is placed in ordinary trash. HHS also notes that an organization’s procedures may direct workforce members to return PHI for disposal or permit them to destroy it securely. HHS OCR’s guidance on disposing of PHI and HHS OCR’s disposal FAQs

How to prevent future misdirected faxes

Organizations can reduce fax transmission errors by maintaining verified recipient numbers, confirming unfamiliar numbers before sending, and using approved fax cover sheets and workflows. Restrict access to fax machines and retrieved pages, train staff on confidential document handling, and include a clear process for reporting misdirected faxes.

HHS identifies confirming an unfamiliar fax number and programming frequently used numbers into fax machines as examples of reasonable safeguards for faxing PHI. HHS OCR’s fax and other communications guidance

In short, secure the fax, report it promptly, and let the designated officer decide whether to return or destroy it and whether further notification is required.

FAQs

What should I do first after receiving a misdirected fax?

Secure the pages, prevent further access or sharing, and report the incident promptly through your organization’s privacy or compliance process. If you are outside the sender’s organization, contact the sender using a verified number and ask for instructions.

Should I return or destroy the fax documents?

Neither without direction. Follow your organization’s procedure or the privacy officer’s instructions. If secure destruction is approved, use an authorized method that prevents the information from being read or reconstructed, and document the action.

Who should be notified about the incident?

Notify your supervisor or the designated privacy, compliance, or security officer according to your organization’s incident-reporting policy. An outside recipient should contact the sender through a verified channel and avoid sharing the fax with anyone else.

Could a misdirected fax require breach notification?

Possibly, if it involved an impermissible disclosure of unsecured PHI and the organization cannot demonstrate a low probability that the information was compromised. The organization must assess the facts, including what information was involved, who received it, whether it was viewed, and how the risk was mitigated. A privacy or compliance officer should make that determination.