Ocular Prosthetics Practice Fax and PHI Policy Checklist

A written fax policy helps your ocular prosthetics practice protect patient information while coordinating care with referring clinicians, ophthalmologists, ocularists, and other authorized recipients. Use this checklist to define who may fax protected health information (PHI), how staff verify destinations, and what to do when a transmission is uncertain or misdirected.

HIPAA requirements apply to your practice depending on whether it is a covered entity or business associate. Your procedures should reflect your role, the information involved, and any applicable state privacy laws that may impose stricter requirements.

Establish Permitted PHI Faxing Procedures

Define which staff members may send or receive faxes containing PHI and what training they need. Your procedures should explain how staff handle routine treatment coordination, records requests, referrals, and other permitted disclosures, and when they must pause and ask a supervisor or privacy contact for guidance.

The HIPAA Privacy Rule permits a provider to disclose PHI to another healthcare provider for treatment, including coordination of care. A fax may be used for that purpose. The minimum necessary standard does not apply to disclosures to or requests by a healthcare provider for treatment, but your practice should still share information responsibly and limit workforce access according to job duties. Other types of disclosures may be subject to the minimum necessary standard.

• Identify permitted purposes and authorized recipients for PHI faxing.
• Specify who may approve non-routine disclosures and what to do when the purpose or recipient is unclear.
• Train relevant staff to follow the policy and report suspected misdirected faxes promptly.
• Review the procedure periodically and when staff roles, workflows, equipment, or applicable requirements change.

Include fax handling in your practice’s administrative safeguards, such as written procedures, workforce training, assigned privacy responsibilities, and a process for responding to possible privacy incidents. Apply safeguards appropriate to the information and the way your practice uses its fax equipment.

Verify Recipient Identity and Fax Numbers

Before sending PHI, confirm both the recipient’s identity and the destination fax number. A familiar name on a cover sheet or a number saved in a contact list is not enough if the destination has not been verified for the intended recipient and purpose.

• Confirm the recipient’s name, organization, and role in the patient’s care.
• Check the fax number against a trusted source, such as a previously verified record or direct confirmation with the recipient’s office.
• When calling to verify, use a known telephone number rather than relying only on contact details included with an unexpected request.
• Reconfirm a number when it has changed, appears unfamiliar, or is being used for a sensitive or unusual disclosure.

HHS identifies confirming that the fax number belongs to the intended provider’s office as an example of a reasonable safeguard. If you cannot establish the correct destination or the recipient’s authority, pause the transmission and follow your escalation procedure.

Secure Fax Machines and Received Documents

Place fax machines where unauthorized people cannot readily see, collect, or handle patient documents. Keep incoming faxes in a controlled area, and assign staff responsibility for retrieving and routing them promptly.

• Locate equipment in a staff-only or otherwise monitored space rather than an unattended public area.
• Collect incoming pages promptly and deliver them only to authorized personnel.
• Store received records securely and dispose of unneeded pages using your practice’s approved PHI disposal process.
• Limit access to multifunction devices, fax software, stored documents, and any electronic records containing PHI.

For electronic fax systems or multifunction devices that create, receive, maintain, or transmit electronic PHI, consider relevant administrative safeguards, physical safeguards, and technical safeguards as part of your risk management. The HIPAA Security Rule addresses safeguards for electronic PHI; choose measures appropriate to your environment and document your policies and procedures.

Follow Pre-Transmission Verification Steps

Use a consistent pre-send check so staff can catch common mistakes before PHI leaves the practice. For routine treatment communications, the check can be brief, but it should still confirm the correct patient, recipient, number, and documents.

• Confirm the patient and the treatment-related purpose of the disclosure.
• Verify that the recipient and fax number match the intended destination.
• Check that the pages belong to the correct patient and are complete, legible, and in the right order.
• Review the cover sheet and attachment for information intended for a different recipient.
• Use any required approval or escalation process for an unusual request or disclosure.

For disclosures that are subject to the minimum necessary standard, include only the PHI reasonably needed for the purpose. For treatment disclosures between healthcare providers, that standard does not apply; nevertheless, accurate recipient checks and reasonable safeguards remain important.

Review Transmission Confirmations and Delivery

After sending, review the fax transmission confirmation for the destination number, date and time, page count, and delivery status. Record or retain confirmations in line with your practice’s documentation procedures, especially for important care-coordination records or transmissions that require follow-up.

A fax transmission confirmation is useful evidence that a system processed a transmission, but it should not be treated as proof that the intended person received or reviewed the pages. If the report shows a failure, an incomplete page count, or a number you do not recognize, investigate before resending.

• If delivery is uncertain, contact the intended recipient using a verified telephone number.
• If a fax may have gone to the wrong destination, notify the designated privacy contact promptly and follow the practice’s incident response process.
• Document the steps taken to clarify delivery, contain the issue, and address any potential exposure.

Standardize Confidential Fax Cover Sheets

Use a consistent cover sheet that helps the intended recipient route the fax while avoiding unnecessary disclosure. Include the recipient’s name and organization, the verified fax number, the sender’s name and callback number, the date, and the total number of pages including the cover sheet.

A confidentiality notice may ask an unintended recipient to stop reading, protect the pages, and contact the sender. Keep the notice concise and avoid including sensitive clinical details on the cover sheet. A confidentiality notice supports your process but does not replace verifying the number, securing equipment, or following other reasonable safeguards.

As a final review, make sure your policy identifies permitted purposes, assigns staff responsibilities, requires reliable recipient and number checks, protects sent and received documents, and provides a clear response when delivery is uncertain. Applying these steps consistently helps your practice coordinate care while safeguarding PHI.

FAQs

Can an ocular prosthetics practice fax PHI to another healthcare provider for treatment?

Yes. The HIPAA Privacy Rule permits a healthcare provider to disclose PHI to another healthcare provider for treatment, and the disclosure may be made by fax. The practice should still use reasonable safeguards, including verifying the recipient and fax number and protecting documents from unauthorized access.

What safeguards should staff use before faxing patient information?

Staff should confirm the treatment purpose, verify the recipient’s identity and fax number using a trusted source, check the patient and pages, and make sure the cover sheet and attachments are intended for that recipient. Follow the practice’s approval and escalation procedures if the request or destination is unclear.

Where should fax machines be located to protect PHI?

Place fax machines in a secure or monitored area where unauthorized people cannot readily view or collect documents. Retrieve incoming faxes promptly, route them to authorized staff, and store them securely. HHS identifies locating a fax machine securely as an example of a reasonable safeguard.

What information should a fax cover sheet include?

Include the intended recipient and organization, verified fax number, sender’s name and callback number, date, and total page count. You may include a concise confidentiality notice, but avoid unnecessary clinical details and do not rely on the notice in place of other safeguards.