Misdirected Fax or Testing Results Portal Incident Response Guide

What to do immediately after discovering a misdirected fax or portal result

Act promptly, but do not delete records or wait for every fact before starting the response. Notify your supervisor and the organization’s privacy or security officer according to your incident-response policy. A misdirected fax or test result can expose protected health information (PHI), and HIPAA requires regulated organizations to respond to suspected or known security incidents, mitigate harmful effects where practicable, and document the incident and its outcome. See HHS guidance on HIPAA security incident procedures.

• Record when and how you discovered the incident, what was sent or made available, and the unintended destination.
• Stop any further transmission. For a fax, cancel a pending job if possible; for a portal, revoke or correct the unintended access using approved procedures.
• Preserve relevant evidence, including fax confirmations, portal access records, audit logs, and messages. Do not alter or erase records that may be needed to investigate.
• Assess whether the result is time-sensitive and promptly arrange delivery to the correct clinician or recipient through an approved channel.

Do not assume that a mistaken transmission is automatically a reportable breach—or that a recipient’s promise to delete it automatically resolves the incident. Route the facts to the people responsible for assessing privacy, security, and clinical risk.

How to contain the disclosure and request secure deletion

Contact the unintended recipient promptly using a verified phone number or other reliable contact method. Explain that the material was sent or made available in error, identify it only as needed to locate it, and ask the recipient to stop reviewing, copying, saving, forwarding, or sharing it. Request that they return or securely destroy paper copies and securely delete electronic copies, including downloaded files where feasible, and confirm what actions they took.

For a fax, you can send a brief follow-up to the number contacted in error asking the recipient to call you and arrange proper disposition. For an electronic portal, remove the incorrect user or access permission, disable a misdirected link or credential if applicable, and ask the portal administrator or vendor to help contain access. Keep the deletion request and the recipient’s response as incident documentation; do not treat either as a substitute for a breach risk assessment.

Limit further disclosure while investigating. Share incident details internally only with people who need them to respond, consistent with your organization’s policies and the applicable minimum necessary standard. HIPAA’s minimum-necessary rule has exceptions, including disclosures between health care providers for treatment, but careful, role-appropriate handling remains good incident practice.

Who to notify and what to document

Notify your privacy officer, security officer, supervisor, or designated incident-response team immediately, following your organization’s reporting process. If the fax service, portal, laboratory, or another vendor handled the information, involve the appropriate vendor contact through established channels. A business associate must notify the covered entity of a breach as required by HIPAA and the applicable business associate agreement; follow any shorter contractual reporting deadline.

Document facts and response steps as they become known. Include:

• The discovery date and time, incident date and time if known, reporting person, and how the incident was identified.
• The intended and unintended recipient or destination, the transmission method, and the PHI involved, such as test results, identifiers, and the number of affected individuals.
• Whether the information was encrypted or otherwise secured, whether it was accessed, acquired, viewed, downloaded, printed, retained, or forwarded, and what evidence supports those findings.
• Actions taken to stop access, contact the recipient, request return or secure deletion, preserve records, correct the destination, and deliver the result to the proper recipient.
• Relevant portal audit logs, fax confirmations, access reports, communications, recipient assurances, clinical follow-up, and the results of the organization’s risk assessment and notification decisions.

Keep documentation factual and distinguish confirmed details from estimates or unanswered questions. HIPAA’s Security Rule requires covered entities and business associates to document security incidents and their outcomes; HHS explains that requirement.

How to correct fax, portal, or registration-data errors

Find where the wrong destination originated before resending information. Compare the order, registration record, patient-entered contact details, referral information, fax cover sheet, and portal account settings. Verify the intended recipient using a trusted source, such as a known directory or a phone number already confirmed by the practice—not solely the contact details in the questionable record.

Correct the source record through your organization’s approved workflow, and document what was changed, by whom, and when. Check for related errors, such as a wrong patient match, duplicate account, outdated fax number, misassigned portal proxy, or incorrect recipient permissions. Review relevant audit logs to determine whether other records or users were affected.

Before sending again, have a second authorized person verify high-risk destination changes when feasible. For a fax number that is not routinely used, HHS identifies confirming the number with the intended recipient as a reasonable safeguard; frequently used numbers may also be pre-programmed to reduce misdirection. See HHS guidance on sharing health information by fax, email, or phone.

How to deliver time-sensitive results to the correct recipient

Do not let the privacy investigation delay clinically necessary communication. Contact the ordering or treating clinician promptly through a verified number or approved secure channel, and follow your organization’s critical-result escalation process. Confirm the recipient’s identity and receipt, then send the written result through the correct fax or portal workflow as required.

If the treating clinician cannot be reached, escalate according to laboratory and clinical policy, including any required alternate contact or on-call procedure. Document who was contacted, when, what was communicated, whether receipt was confirmed, and any further clinical direction. HIPAA permits providers to share PHI for treatment purposes by fax, email, phone, or other means when they use reasonable safeguards; see HHS’s treatment-communication guidance.

Use an approved secure method appropriate to the information and your organization’s procedures. For electronic delivery, apply access control and safeguards for transmission; encryption may be part of those protections, but do not assume that one technology alone makes a disclosure permissible or settles whether a breach occurred. The Security Rule addresses access control, audit controls, and transmission security.

How to assess breach and notification requirements

Have the privacy or compliance team determine whether the incident involved an impermissible use or disclosure of PHI and whether an exception applies. Under the HIPAA Breach Notification Rule, an impermissible use or disclosure is generally presumed to be a breach unless the organization demonstrates a low probability that the PHI was compromised through a documented risk assessment, or establishes that a defined exception applies. The assessment must consider at least the nature and extent of the PHI, who received or used it, whether it was actually acquired or viewed, and the extent to which the risk was mitigated. See HHS’s Breach Notification Rule guidance.

A request to delete or return the material, a recipient’s assurance, or proof that access was revoked can inform the assessment, but none alone guarantees that notification is unnecessary. Keep the assessment and its rationale with the incident record. Apply any stricter state law, contractual term, or organizational requirement as well.

If the organization determines that a breach of unsecured PHI occurred, covered entities must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. HHS must also be notified: breaches affecting 500 or more individuals are reported without unreasonable delay and within 60 days; breaches affecting fewer than 500 are reported within 60 days after the end of the calendar year in which they were discovered. A breach affecting more than 500 residents of a state or jurisdiction also requires notice to prominent media outlets serving that area. See HHS’s current notification guidance and HHS instructions for reporting breaches to the Secretary.

How to prevent future misdirected test results

Use safeguards that address the failure point identified in the incident. For fax workflows, verify unfamiliar destinations, maintain and review approved fax directories, use cover sheets, and check transmission confirmations. For portals, validate patient and recipient identity, review access permissions, use appropriately configured account controls, and monitor audit logs for unexpected access.

Build verification into registration, order entry, referral, and result-release workflows. Use role-based access control so staff can access only the information needed for their duties, and use a second check for destination changes or other higher-risk transmissions where practical. Protect electronic transmissions using your organization’s approved security measures, including encrypted transmission where appropriate.

Review incident documentation and audit logs for recurring causes, then update procedures, system configurations, and workforce training. A dependable response combines prompt containment, reliable delivery of the result to the right recipient, careful documentation, and a documented HIPAA breach risk assessment when required. These steps also help reduce the chance of another misdirected test result.

FAQs.

What should I do first after discovering a misdirected test result?

Report it immediately through your organization’s incident-response process, stop further access or transmission if possible, preserve relevant evidence, and assess whether the correct clinician needs the result urgently. Do not wait to notify the appropriate privacy or security contact while trying to resolve the error yourself.

How should I ask an unintended recipient to handle the information?

Contact them through a verified channel, ask them to stop reviewing, copying, saving, or sharing the information, and request that they return or securely destroy copies and confirm the steps taken. Record the request and response, but let your organization’s privacy or compliance team assess the incident independently.

What details should be documented in the incident report?

Document when the incident occurred and was discovered, the intended and unintended recipients, the PHI and number of people involved, the delivery method, whether the information was secured or accessed, evidence such as audit logs or fax confirmations, containment and mitigation steps, recipient responses, clinical follow-up, and the risk assessment and notification decision.

When must patients or regulators be notified?

Notification depends on whether the incident is a breach of unsecured PHI and the outcome of the required assessment or applicable exception. When notification is required, affected individuals generally must be notified without unreasonable delay and no later than 60 calendar days after discovery. HHS reporting deadlines differ by the number of individuals affected, and media notice is required for breaches affecting more than 500 residents of a state or jurisdiction. The organization’s privacy or compliance team should determine and document which requirements apply.