Misdirected Fax to a Clinical Data Repository: Incident Response Guide

How should staff contain a misdirected fax incident?

Act promptly, preserve the facts, and follow your organization’s incident-response policy. A misdirected fax containing protected health information (PHI) may be an impermissible disclosure, but the circumstances must be assessed before deciding whether notification is required.

• Stop any remaining pages or repeat transmissions, if possible. Check the fax machine or service to determine whether the document was sent to one recipient or more.
• Notify your supervisor and the designated privacy or incident-response contact promptly. Avoid sending the fax again until the intended recipient and destination number are verified.
• Contact the unintended recipient through a verified phone number. Ask them to stop reading, copying, forwarding, or otherwise using the fax; secure it from further access; and follow your organization’s instructions for returning or securely destroying it.
• Preserve transmission records and the original document as evidence. Do not alter, delete, or destroy incident records, and do not send additional PHI while trying to correct the mistake.

These containment steps support mitigation; they do not automatically undo the disclosure or determine whether a breach occurred. HIPAA requires covered entities to use reasonable safeguards for PHI, including when faxing. HHS describes verifying a fax number and keeping fax equipment in a secure location as examples of safeguards in its faxing guidance.

What details should be documented about the fax and its recipients?

Create a clear, time-stamped incident record and keep it in the approved reporting system. Record facts rather than assumptions, and restrict access to personnel who need the information to investigate and respond.

• Transmission details: date and time sent and discovered, sending department or person, intended recipient and organization, dialed fax number, transmission status, page count, and any available confirmation or error report.
• Information involved: document type, pages sent, categories of PHI, identifiers visible, and the number of individuals whose information may be included. Avoid duplicating PHI in an incident record unless necessary and permitted by policy.
• Recipient and access details: who received the fax, who may have viewed it, whether it was printed, scanned, stored, copied, or forwarded, and what the recipient says happened to each copy.
• Response and decisions: when staff and response teams were notified, containment and mitigation steps, recipient instructions and confirmations, investigation results, risk-assessment reasoning, and the basis for any notification decision.

A fax transmission audit trail—such as sender and destination numbers, timestamps, page counts, and delivery status—can help reconstruct what happened. Preserve available records, but do not assume that every type of fax log has a specific HIPAA retention period; follow applicable documentation rules, organizational policy, and any stricter legal or contractual requirements. HIPAA documentation that is required under the Privacy Rule generally must be retained for six years under 45 CFR § 164.530(j).

How can the intended recipient and affected individuals be identified?

First, confirm the intended recipient with the person or department that requested the transmission. Use a trusted directory or a previously verified contact method to confirm the recipient’s name, organization, fax number, and purpose; do not rely only on the number printed on the disputed fax.

Next, compare the fax cover sheet, pages, routing information, and repository records. If the document relates to a clinical data repository, work with authorized repository personnel to match its contents against the relevant submission, patient, or case records. Review each page and any attachments, since a fax may contain information about multiple individuals.

Build and verify a list of affected individuals using the information actually sent—not just the intended submission list. If you cannot determine the full scope, document what is known, what remains uncertain, and how the organization is working to resolve the uncertainty. Share identifying details only through approved channels and with people who need them to investigate.

When should privacy, security, and compliance teams be notified?

Notify the privacy officer or designated privacy team promptly under your organization’s incident-reporting policy. Involve compliance and legal personnel as appropriate for the organization’s process, especially when PHI may have reached someone without authorization, the recipient’s identity or actions are unclear, or the affected population is uncertain.

Bring in security or IT staff when electronic systems, e-fax services, repository access, routing rules, or stored electronic PHI may be involved. A paper fax incident may still require a privacy assessment even when there is no electronic-system issue.

If a clinical data repository or another service provider handles PHI on behalf of a covered entity, confirm the parties’ roles and consult the business associate agreement (BAA). HHS explains that BAAs address PHI safeguards and reporting responsibilities, including security incidents and breaches; the contract may require reporting sooner or more broadly than HIPAA’s outer deadline. See HHS’s business associate agreement provisions.

How should the incident be assessed and reported under applicable privacy rules?

Do not assume that every misdirected fax is automatically reportable—or that a recipient’s promise to destroy it eliminates the need for assessment. The privacy team should determine whether the disclosure was permitted, whether a HIPAA breach exception applies, whether the PHI was unsecured, and whether any other applicable federal or state privacy rules or contract terms impose additional duties.

Under the HIPAA Breach Notification Rule, an impermissible use or disclosure of PHI is generally presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI was compromised, based on a risk assessment. The assessment must consider at least the nature and extent of the PHI, the person who received it, whether it was actually acquired or viewed, and the extent to which the risk was mitigated. HHS summarizes these factors in its Breach Notification Rule guidance.

Record the evidence and reasoning behind the conclusion. A security incident risk assessment for systems and a Breach Notification Rule assessment are related but distinct: the latter applies the rule’s breach definition and required factors to the disclosure. HHS places the burden on covered entities and business associates to document that required notifications were made or why notification was not required.

If a breach of unsecured PHI is confirmed, the covered entity generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. HHS must also be notified; for breaches affecting fewer than 500 individuals, the covered entity may report to HHS annually, within 60 days after the end of the calendar year. Breaches affecting more than 500 residents of a state or jurisdiction also require notice to prominent media outlets serving that area. A business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovery, subject to any earlier BAA deadline. See HHS’s notification requirements and BAA guidance.

The HIPAA minimum necessary standard generally limits PHI used, disclosed, or requested to what is needed for the purpose, but it does not apply to disclosures to or requests by a health care provider for treatment. Apply the rule that fits the fax’s purpose and the organization’s role; HHS describes the standard and its exceptions in its minimum necessary guidance.

What corrective actions can reduce the risk of repeat fax disclosures?

After containment and assessment, identify the cause—such as a transposed digit, outdated directory entry, similar recipient names, unclear workflow, or unattended fax output—and choose corrective actions that address it.

• Verify fax numbers against an approved directory and confirm unfamiliar or changed numbers with the intended recipient using a trusted contact method.
• Use an approved, current recipient list or carefully controlled speed-dial entries, and periodically review them for accuracy.
• Use a cover sheet that identifies the intended recipient and provides instructions for misdirected faxes, without unnecessarily repeating sensitive information.
• Place fax equipment and received pages where unauthorized people cannot readily view or collect them. Use secure, access-controlled e-fax workflows where appropriate.
• Train relevant staff on recipient verification, secure handling, minimum-necessary practices where applicable, and the organization’s incident-reporting process.
• Review recurring errors and update procedures, directories, or technical controls. Document the changes and check whether they reduce repeat incidents.

HHS identifies confirming a fax number and securing fax equipment as examples of reasonable safeguards, while HIPAA requires covered entities to maintain appropriate safeguards and mitigate known harmful effects. See HHS fax guidance and 45 CFR § 164.530.

In short, contain the disclosure, establish exactly what was sent and who could access it, notify the appropriate teams, and document a reasoned assessment. Use the findings to strengthen fax safeguards and prevent a similar incident.

FAQs

What should staff do immediately after discovering a misdirected fax?

Stop any further transmission, notify the designated privacy or incident-response contact, and preserve the fax and available transmission records. Contact the unintended recipient through a verified number, ask them to stop using or sharing the fax and secure it, then follow your organization’s instructions for return or destruction. Record the actions and times.

Should the unintended recipient be asked to securely destroy or return the fax?

Usually, staff should ask the recipient to prevent further access and follow the organization’s instructions for secure destruction or return. Confirm what was done and document it. The appropriate method depends on the circumstances and policy; asking for destruction or return does not by itself determine whether the disclosure requires breach notification.

How is the risk of a fax disclosure assessed?

For a potential HIPAA breach, assess the nature and extent of the PHI, who received it, whether the information was actually acquired or viewed, and how effectively the risk was mitigated. Document the facts, any applicable exception, and the reasoning for the conclusion. HHS describes the required factors in its Breach Notification Rule guidance.

When may a misdirected fax require breach notification?

When an impermissible disclosure involves unsecured PHI, the HIPAA Breach Notification Rule generally presumes a breach unless the covered entity or business associate documents a low probability that the PHI was compromised through the required assessment, or establishes that an exception applies. If the disclosure is determined to be a breach, applicable notices must be provided within the required timeframes. The facts, organizational roles, BAA, and any stricter applicable laws or requirements matter.