Incident Response Guide for Misdirected Faxes and Telemedicine Video Recordings

What counts as a misdirected fax or telemedicine recording incident

A misdirected fax or telemedicine recording incident occurs when protected health information (PHI) is sent, shown, stored, or made accessible to someone who is not authorized to receive it. Examples include faxing a patient report to the wrong number, emailing a visit recording to the wrong person, or leaving a recording accessible through a link that was shared too broadly.

A telemedicine recording may contain PHI when it identifies a patient and relates to their health care. HIPAA’s Security Rule applies to electronic PHI created or stored through telehealth technologies, including recordings and transcripts. See HHS guidance on telehealth technologies and electronic PHI.

An unauthorized disclosure is not automatically a reportable breach. Under the HIPAA Breach Notification Rule, an impermissible use or disclosure of unsecured PHI is presumed to be a breach unless an exception applies or the organization demonstrates, through a documented risk assessment, a low probability that the PHI was compromised. HHS explains the breach definition and notification requirements.

What immediate steps should you take after discovering a disclosure

Act promptly to contain the incident, preserve relevant evidence, and notify the people responsible for privacy and security. Follow your organization’s incident response and breach notification policies; do not wait for a complete investigation before escalating the incident internally.

• Stop further disclosure. Halt a fax job if possible, correct an address or recipient setting, disable a misconfigured share link, or restrict access to the recording.
• Notify the right internal contacts. Contact your privacy officer, security lead, supervisor, or incident response team. If a vendor or business associate is involved, notify the organization that manages the relevant relationship.
• Request containment from the recipient. Ask the unintended recipient not to read, copy, share, or otherwise use the information and to return or securely destroy it. Request confirmation, but do not assume that deletion or a promise not to use the information automatically resolves the incident.
• Preserve evidence. Record when the incident was discovered and retain relevant transmission records, access logs, messages, and recipient communications. Avoid actions that erase evidence needed to determine what happened.
• Limit further sharing. When communicating about the incident, disclose only the information needed for the response. The minimum necessary standard generally limits many uses and disclosures, although it does not apply to disclosures to health care providers for treatment. See HHS guidance on the minimum necessary standard.

How should organizations secure or retrieve misdirected fax and video files

For a fax, contact the receiving office promptly using a verified phone number. Ask the recipient to stop handling the pages, secure them from view, and return or destroy them using an approved method. Record who you spoke with, when you spoke, what actions they agreed to take, and whether you received confirmation.

For a video recording, revoke public or unintended access, disable shared links, and restrict permissions to authorized users. Check the platform, cloud storage, email, and any connected transcription or recording service for additional copies or access. Preserve logs and other evidence while securing the file; coordinate with your security team before deleting system records that may be needed for the investigation.

If a vendor created, received, maintained, or stored the recording for the organization, follow the applicable business associate agreement (BAA) and incident response process. A BAA should describe the vendor’s obligations, including reporting security incidents; HHS explains that vendors storing telehealth PHI may be business associates. See HHS guidance on telehealth vendors and business associate agreements.

How do you assess the scope and risk of exposed health information

Determine what information was involved, whose information it was, who received or could access it, and whether it was acquired or viewed. For a fax, review the number dialed, transmission result, page count, and contents. For a recording, check its sharing settings, access history, download activity, storage locations, and any copies or transcripts.

For an impermissible disclosure of unsecured PHI, the HIPAA risk assessment must consider at least four factors:

• Nature and extent of the PHI: Identify the information and identifiers involved and consider how readily a person could be identified.
• Who received or accessed it: Determine whether the recipient was known, bound by confidentiality duties, or otherwise likely to misuse the information.
• Whether it was actually acquired or viewed: Review available evidence, such as fax delivery records, access logs, or recipient statements.
• How effectively the risk was mitigated: Document steps such as retrieving the fax, restricting access, or obtaining confirmation that a file was securely destroyed.

Consider the factors together; no single factor automatically determines the outcome. A recipient’s assurance or a successful retrieval request may help show mitigation, but it does not, by itself, establish that notification is unnecessary. HHS describes the risk assessment factors and the organization’s burden to document its decision.

When must affected individuals and regulators be notified

If the organization determines that an incident is a breach of unsecured PHI, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The notice must describe the breach, the types of information involved, steps individuals can take to protect themselves, the organization’s response, and how to contact the organization. HHS summarizes individual notice requirements.

The covered entity must also notify the Secretary of HHS. For a breach affecting 500 or more individuals, submit notice without unreasonable delay and no later than 60 days after discovery. For a breach affecting fewer than 500 individuals, the covered entity may report to HHS annually, no later than 60 days after the end of the calendar year in which the breach was discovered. If a breach affects more than 500 residents of a state or jurisdiction, notice to prominent media outlets serving that area is also required.

A business associate that discovers a breach must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery. A BAA may require faster reporting or set additional procedures, so check the agreement and promptly notify the covered entity of a potential incident. HHS explains business associate and covered entity notification duties.

These are federal HIPAA timelines. State law, other applicable rules, or contractual obligations may impose additional requirements, so involve your privacy officer or legal counsel when assessing notification duties.

What documentation should an incident response record include

Create a security incident log entry and maintain a clear record of the response. Include enough detail to support the investigation, risk assessment, notification decision, and any corrective action.

• Date and time the incident occurred, was discovered, and was reported internally.
• How the incident happened, including the fax number, destination, platform, account, link, or device involved.
• The type and amount of PHI involved and the individuals whose information may have been affected.
• Who received or could access the information, what they said or did, and any evidence that it was viewed, acquired, copied, or shared.
• Containment and mitigation steps, including access restrictions, retrieval or destruction requests, and the recipient’s response.
• The risk assessment, its supporting evidence, and the rationale for deciding whether the incident was a breach requiring notification.
• Notifications made or planned, including recipients, dates, delivery methods, and copies of notices; or documentation supporting the decision that notification was not required.
• Corrective actions, responsible owners, completion dates, and any updates to policies, training, or technical safeguards.

HIPAA places the burden on covered entities and business associates, as applicable, to demonstrate that required notifications were made or that an impermissible disclosure did not constitute a breach. Keep the supporting risk assessment and response records with the incident file. HHS describes this documentation responsibility.

In short, contain the disclosure, investigate and document what happened, assess the risk using the required factors, and make any required notifications within the applicable timelines.

FAQs

Is a misdirected fax automatically a reportable breach?

No. A misdirected fax containing unsecured PHI is an impermissible disclosure that is presumed to be a breach unless an exception applies or the organization documents a risk assessment showing a low probability that the PHI was compromised. The organization should investigate and record its decision rather than assume the fax is—or is not—reportable.

What should you do if a telemedicine recording is sent to the wrong recipient?

Immediately restrict access or revoke the link, notify your privacy or security lead, and contact the unintended recipient using verified contact information. Ask the recipient not to access, copy, or share the recording and to securely delete or return it. Preserve access logs and other evidence, determine whether the recording was viewed or downloaded, and document the risk assessment and response.

How quickly must patients be notified of a reportable breach?

For a reportable breach of unsecured PHI, affected individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery. The 60-day limit is a maximum, not a reason to delay notice when the organization can notify sooner.

What details should be documented during breach response?

Record when and how the incident occurred and was discovered, the PHI and individuals involved, who could access the information, evidence of viewing or acquisition, containment and mitigation steps, the risk assessment and rationale, notification decisions and dates, and corrective actions. Preserve supporting records such as fax reports, access logs, and recipient communications.