Misdirected Fax Incident Response Checklist for Inpatient Addiction Consult Services

What should staff do immediately after a misdirected fax?

Stop further disclosure as soon as you discover the error. Notify your supervisor and the hospital’s privacy officer or incident-response contact promptly, following the organization’s reporting policy. Do not wait to confirm whether the recipient read the fax before reporting it internally.

• Stop or pause additional fax transmissions to the incorrect number, recipient, or destination.
• If the fax is still in progress, use the machine’s cancel function. If your system offers a recall feature, attempt recall and record the result.
• Identify the intended recipient and the unintended recipient using approved contact information. Do not send more patient details while trying to correct the mistake.
• Preserve the fax cover sheet, transmission confirmation, fax transmission logs, the document sent, and any related communications.
• Follow the privacy officer’s instructions for contacting the recipient, assessing the incident, and deciding whether clinical or patient-safety teams need to be involved.

Keep the response focused on limiting further access and preserving facts. Do not alter or delete the original fax record or related electronic records.

How should the unintended recipient be contacted?

Use a verified phone number and, when feasible, speak with someone who can confirm receipt and take steps to secure the document. Explain that a fax was sent in error, but avoid repeating protected health information (PHI) unless the privacy officer directs you to do so and the recipient’s identity is confirmed.

Ask the recipient not to read, copy, share, or otherwise use the fax; to secure it from further access; and to securely destroy it or follow the organization’s approved return process. Request confirmation of what happened, including whether anyone viewed or shared the document and what steps were taken to contain it. A recipient’s confirmation can help with mitigation and the risk assessment, but it does not by itself determine whether notification is required. HHS requires covered entities to take reasonable steps to mitigate harmful effects from impermissible uses or disclosures under the HIPAA Privacy Rule.

Do not ask the recipient to send the fax back through an unverified or insecure channel. Coordinate any return or destruction process with the privacy officer, and document the contact attempts, responses, and agreed actions.

What details and records should be documented?

Create an incident record promptly, using the organization’s approved reporting system. Record facts rather than assumptions, and update the record if new information becomes available.

• Discovery: When and how the error was discovered, who discovered it, and when the privacy officer or supervisor was notified.
• Transmission: The date and time sent, fax number dialed, intended and actual recipients, transmission result, and relevant fax transmission logs or confirmation pages.
• Information involved: The type and amount of information disclosed, such as patient identifiers, diagnoses, treatment details, medications, or other PHI. Note whether the records may be protected by 42 CFR Part 2.
• Access and containment: What the unintended recipient reported about receipt, viewing, copying, sharing, retention, and destruction or return of the document.
• Response: Actions taken to stop further disclosure, contact the recipient, mitigate potential harm, and prevent recurrence.
• Assessment and decisions: The breach-risk assessment, notification decisions, applicable deadlines, and the reasons supporting those decisions.

Retain the original document, cover sheet, fax transmission logs, call notes, emails, and related system records under the organization’s record-retention and incident-response policies. HHS explains that covered entities must document that required notifications were made or retain documentation supporting a decision that notification was not required in its Breach Notification Rule guidance.

How should breach risk be assessed for addiction-treatment information?

Escalate the incident to the privacy officer for a documented HIPAA breach risk assessment. Under the HIPAA Breach Notification Rule, an impermissible disclosure of unsecured PHI is generally presumed to be a breach unless the covered entity demonstrates a low probability that the PHI was compromised. The assessment must consider at least the nature and extent of the PHI, who received it, whether it was actually acquired or viewed, and how effectively the risk was mitigated. See the HHS Breach Notification Rule guidance.

For an inpatient addiction consult service, evaluate the sensitivity and identifying detail of the information, the recipient’s relationship to the patient and ability to keep the information confidential, the recipient’s account of whether the fax was accessed or shared, and the speed and reliability of containment. Addiction-treatment information can carry particular privacy concerns; treat that sensitivity as relevant to the assessment, not as an automatic conclusion that notification is or is not required.

Assess whether the record is subject to 42 CFR Part 2 confidentiality requirements. Part 2 generally applies to records of patients in federally assisted programs that provide substance use disorder diagnosis, treatment, or referral for treatment. A hospital’s inpatient addiction consult service is not automatically a Part 2 program simply because it provides addiction-related care; whether the service meets the regulatory definition depends on how the program, unit, or personnel are organized and identified. The current Part 2 rule also applies HIPAA Breach Notification Rule requirements to breaches of Part 2 records; organizations were required to comply with the applicable final-rule requirements by February 16, 2026, as described in the HHS Part 2 final rule fact sheet.

Which notifications may be required and when?

The privacy officer should determine which rules apply, who is responsible for each notice, and the applicable deadlines. Do not treat the 60-day deadline as a reason to delay a decision or notification that can be made sooner.

• Affected individuals: If the incident is a breach of unsecured PHI or unsecured Part 2 records, the applicable covered entity or Part 2 program generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery.
• HHS: For a breach affecting 500 or more individuals, report to the HHS Secretary without unreasonable delay and no later than 60 calendar days after discovery. For a breach affecting fewer than 500 individuals, the report is due within 60 days after the end of the calendar year in which the breach was discovered.
• Media: A HIPAA breach affecting more than 500 residents of a state or jurisdiction generally also requires notice to prominent media outlets serving that area, without unreasonable delay and no later than 60 calendar days after discovery.
• Business associates or other responsible organizations: If a business associate was involved, follow the applicable agreement and reporting procedures. The covered entity remains responsible for required HIPAA notifications, though responsibilities may be delegated as permitted.
• Part 2 reporting: If the records are both PHI and Part 2 records, the HHS OCR breach portal directs that the incident be reported separately as a HIPAA breach and a Part 2 breach. Confirm the applicable reporting obligations with the privacy officer.

These timelines and reporting thresholds are described in the HHS HIPAA Breach Notification Rule guidance and HHS breach-reporting instructions for HIPAA and Part 2. State law, contracts, or organizational policy may impose additional or stricter requirements, so the privacy officer should review them as well.

How can inpatient addiction consult services prevent repeat fax disclosures?

Use a consistent verification process before sending records, especially when a fax includes addiction-treatment information or other sensitive PHI. Assign responsibility for checking destination details, and make it easy for staff to pause and verify a number when a request or recipient is unfamiliar.

• Confirm the recipient’s name, organization, and fax number against an approved directory or by calling a verified number before sending.
• Use a cover sheet that identifies the intended recipient and provides a confidentiality warning, without placing unnecessary patient details on the cover sheet.
• Check the destination and document pages before sending; for high-risk or unfamiliar destinations, use a second-person verification step where practical.
• Review fax transmission logs and promptly investigate failed, partial, or unexpected transmission results.
• Train staff on the organization’s fax procedures, incident reporting process, and escalation contacts, including the handling of records that may be subject to Part 2.
• Use secure alternatives approved by the organization when available, and follow the minimum necessary standard where it applies. HIPAA does not apply the minimum necessary requirement to disclosures to or requests by a health care provider for treatment, as explained in HHS minimum necessary guidance.

Review misdirected fax incidents for process gaps, such as outdated directories, similar fax numbers, or unclear handoffs. A reliable prevention plan combines recipient verification, usable procedures, staff training, and routine review of fax transmission logs.

FAQs

Should staff ask the unintended recipient to destroy or return the fax?

Yes. Ask the recipient not to use, copy, or share the fax and to securely destroy it or follow an approved return process. Confirm whether it was viewed or further disclosed, and document the response. Coordinate the method with the privacy officer; avoid requesting an insecure return that could create another disclosure.

When must affected individuals be notified of a fax breach?

If the incident qualifies as a breach of unsecured PHI or unsecured Part 2 records, affected individuals generally must be notified without unreasonable delay and no later than 60 calendar days after discovery. A documented assessment may determine that notification is not required under the applicable rule. The privacy officer should review the facts, applicable state requirements, and any law-enforcement delay before deciding.

How does 42 CFR Part 2 affect a misdirected addiction-treatment fax?

Part 2 may impose confidentiality protections when the fax contains records of a patient served by a federally assisted Part 2 program. Whether an inpatient consult service qualifies as a Part 2 program depends on the regulatory criteria; addiction-related information alone does not automatically make every hospital service subject to Part 2. For breaches of unsecured Part 2 records, the current rule applies the HIPAA Breach Notification Rule requirements. Consult the privacy officer to determine applicability and reporting duties.

What evidence should be preserved during the incident response?

Preserve the faxed document and cover sheet, transmission confirmation and fax transmission logs, the number dialed, timestamps, recipient and sender details, related call notes and messages, and records of recall, destruction, or return attempts. Follow organizational retention procedures, keep the incident record factual, and avoid altering original records.