Misdirected Fax Incident Response Checklist for a Primary Immunodeficiency Clinic

What immediate steps contain a misdirected fax?

Act promptly to limit further access and preserve the facts. A misdirected fax may expose sensitive clinical information—such as a patient’s diagnosis, infection history, treatment plan, or medication details—but the clinic should assess the actual information involved rather than assume every incident has the same risk.

• Stop any remaining transmission. If pages are still being sent, cancel the job if possible. Save the fax transmission record and other relevant system logs.
• Contact the unintended recipient promptly. Ask them not to read, copy, share, or retain the fax, and to secure it and confirm whether it was viewed or disclosed further. Arrange secure destruction or return according to clinic policy.
• Limit further disclosure. Do not resend the records to another number until staff verify the intended recipient and fax number.
• Notify the clinic’s privacy officer and follow the incident-response procedure. Escalate immediately, even if the recipient says the pages were destroyed. A recipient’s assurance can inform mitigation, but does not by itself determine whether notification is required.
• Preserve evidence and mitigate harm. Keep the fax confirmation, relevant communications, and incident notes; take reasonable steps to prevent additional access or disclosure.

HIPAA permits certain treatment-related disclosures by fax, but requires reasonable safeguards. HHS identifies confirming an unfamiliar fax number and securely locating fax equipment as examples of safeguards. See the HHS guidance on fax and other treatment communications.

Notify the privacy officer and follow clinic escalation procedures

Report the incident through the clinic’s established channel as soon as you discover it. Follow internal procedures for notifying the privacy officer, compliance or security staff, and clinic leadership; involve legal counsel or other designated advisers when the clinic’s policy calls for it. Staff should report the facts and avoid making an independent final determination that the incident is or is not a breach.

If a fax vendor or other business associate was involved, notify the appropriate clinic contact and follow the business associate agreement and incident-response process. HIPAA requires a business associate that discovers a breach of unsecured PHI to notify the covered entity; the agreement may also specify reporting for other security incidents. See the HHS Breach Notification Rule guidance.

What details should the clinic document about the fax incident?

Create a clear, dated incident record and update it as facts become known. Documenting the investigation helps the clinic make and support its breach decision; HIPAA places the burden on the covered entity to show that required notices were provided or that the incident did not constitute a breach.

• Date and time the fax was sent, the error was discovered, and the clinic first learned of it; identify the source of each date.
• Intended recipient, incorrect recipient, fax numbers, number of pages, and transmission-confirmation details.
• Each affected individual and the categories of information involved, such as identifiers, diagnosis, treatment, medication, or other clinical details.
• Whether the unintended recipient acquired, viewed, copied, retained, or further disclosed the fax, and how the clinic verified those facts.
• Containment and mitigation actions, including contact attempts, the recipient’s response, and any confirmation of secure destruction.
• The risk assessment, decision, rationale, approvals, required notifications, and corrective steps.

Record the breach discovery date carefully: HIPAA generally treats a breach as discovered on the first day it is known, or would have been known through reasonable diligence, by the covered entity’s workforce or agent (other than the person committing the breach). See HHS’s explanation of breach discovery and documentation.

How should the clinic assess the risk of PHI compromise?

An impermissible disclosure of unsecured protected health information is generally presumed to be a breach unless the clinic demonstrates a low probability that the PHI was compromised, based on a documented HIPAA breach risk assessment, or an applicable exception applies. Assess the circumstances rather than treating a mistaken fax as automatically reportable or automatically harmless.

HIPAA requires the assessment to consider at least these four factors:

• Nature and extent of the PHI: Identify the types of information and identifiers disclosed and how readily they could identify the patient. For a primary immunodeficiency clinic, consider whether the fax included diagnosis, immune status, infection history, medication, infusion or treatment details, or other sensitive clinical information.
• Recipient: Determine who received the fax, whether they were authorized to access PHI, and the circumstances in which they received it.
• Actual access: Establish whether the fax was viewed, copied, retained, or shared, using available statements and records.
• Mitigation: Document steps taken to limit the risk, including prompt contact, secure handling, and verified destruction where applicable.

A confidentiality statement on a cover sheet or a recipient’s promise alone does not establish a low probability of compromise. Evaluate all four factors together, document the basis for the conclusion, and consult the privacy officer. See the HHS guidance on breach definitions and risk assessment.

When must affected individuals and regulators be notified?

Notification duties apply when the incident is a breach of unsecured protected health information and no exception applies. If the clinic determines that a breach occurred, it generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. That is the HIPAA breach notification deadline; clinic policy or other applicable law may call for earlier action.

The clinic must also make HHS breach reporting to the Secretary of HHS. For a breach affecting 500 or more individuals, report to HHS without unreasonable delay and within the same 60-day outside limit. For a breach affecting fewer than 500 individuals, keep the required record and report it no later than 60 days after the end of the calendar year in which it was discovered.

Media notice has a different threshold: it is required when a breach affects more than 500 residents of a state or jurisdiction, and must be made without unreasonable delay and no later than 60 calendar days after discovery. This threshold is based on residents of a state or jurisdiction, not simply the total number of affected individuals. See the HHS Breach Notification Rule and 45 CFR § 164.406 on media notice.

Individual notices generally describe what happened, the types of information involved, steps individuals can take, the clinic’s investigation and mitigation, and how to ask questions. Coordinate the decision and notices through the privacy officer, and check applicable state law and clinic policy for any additional requirements.

How can a primary immunodeficiency clinic prevent future fax disclosures?

Use written procedures and practical safeguards for sending and receiving faxes. HIPAA requires reasonable safeguards, but does not prescribe one universal fax workflow; choose measures appropriate to the clinic’s operations and risk. HHS specifically gives confirming an unfamiliar number and pre-programming frequently used numbers as examples of safeguards.

• Verify the recipient’s identity and fax number, especially for new or changed contacts, before sending PHI.
• Use an approved directory or verified speed-dial entries, and require a second check for high-risk or unusually sensitive transmissions when clinic policy calls for it.
• Use a cover sheet that identifies the intended recipient and gives instructions for handling a fax received in error. Treat the cover sheet as one safeguard, not a substitute for checking the number.
• Place fax machines and incoming documents in locations accessible only to authorized staff; retrieve incoming faxes promptly.
• Limit the pages and PHI sent to what is appropriate for the communication, and confirm successful receipt when the situation warrants it.
• Train staff on the clinic’s fax procedures and incident escalation steps, and review incidents for process improvements.

These reasonable safeguards, clear escalation procedures, and consistent documentation help reduce fax errors and support a timely, evidence-based response if one occurs. See the HHS guidance on fax safeguards.

FAQs

What should clinic staff do first after discovering a misdirected fax?

Stop any remaining transmission, notify the privacy officer through the clinic’s escalation procedure, and contact the unintended recipient to limit further access and disclosure. Preserve the fax record and document the actions taken.

How should the clinic document a misdirected fax incident?

Record when the fax was sent and discovered, the discovery date, the intended and unintended recipients, the fax numbers and pages, the PHI involved, whether it was viewed or shared, containment efforts, the recipient’s response, the risk assessment, and the clinic’s decision and follow-up actions.

When must a clinic notify patients about a fax-related breach?

If the incident is a breach of unsecured PHI and no exception applies, the clinic generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. A documented risk assessment may establish a low probability that PHI was compromised; the privacy officer should coordinate that decision.

When is a misdirected fax reportable to HHS or the media?

A reportable breach of unsecured PHI must be reported to HHS. Breaches affecting 500 or more individuals are reported without unreasonable delay and within 60 calendar days after discovery; breaches affecting fewer than 500 individuals are reported by the annual deadline—no later than 60 days after the end of the calendar year in which they were discovered. Media notice is required when the breach affects more than 500 residents of a state or jurisdiction.