Teratogen Information Service Fax PHI Policy Checklist

How should staff verify a fax recipient and number before sending PHI?

Use this checklist when your service is subject to HIPAA as a covered entity or business associate, and follow your organization’s privacy policies and any applicable additional requirements. Before sending a protected health information disclosure, confirm the recipient is authorized to receive it and that faxing is appropriate for the purpose.

• Verify the recipient’s name, organization, role, and fax number using a trusted directory or by calling a known, independently verified phone number. For a number that is new or not regularly used, confirm it directly with the intended recipient.
• Check every digit on the fax number before transmission. Use a verified, programmed number for frequent recipients when available, and do not rely on an unconfirmed number supplied in an unexpected message.
• Confirm that someone authorized can receive the fax, particularly when the machine is shared or located in an open area.
• Check the documents and recipient details a second time before pressing send. Review the transmission result and follow your organization’s process for recording or reporting failed transmissions.

HHS identifies confirming an unfamiliar fax number and programming frequently used numbers as examples of reasonable safeguards. HHS guidance on faxing PHI

What information should a teratogen information service include in a fax?

Include only information that supports the communication’s permitted purpose. Depending on the question and recipient, a clinically useful fax may identify the patient and the requesting clinician, describe the relevant exposure, and state the service’s consultation question or response.

• Identify the patient using the organization’s approved identifiers and include a case or reference number if your policy uses one.
• For an exposure consultation, include relevant details such as the substance or product, route, estimated amount, timing and duration of exposure, and gestational age when pertinent.
• Include only relevant medical history, medications, contact information, and follow-up instructions. Exclude unrelated records and unnecessary identifiers.
• Clearly identify the sender and intended recipient, and include the date, page count, and a callback number as appropriate.
• Before sending, confirm the legal and operational basis for the disclosure. A provider-to-provider treatment disclosure may be permitted without authorization, but a teratogen information service should not assume that every consultation or recipient qualifies as treatment.

The HIPAA minimum necessary standard generally calls for reasonable limits on PHI used or disclosed, but it does not apply to disclosures to, or requests by, a health care provider for treatment. Even when that exception applies, limiting the fax to relevant information is a prudent safeguard. HHS Summary of the HIPAA Privacy Rule

What should a PHI fax confidentiality cover sheet contain?

A confidentiality cover sheet can help route a fax and alert anyone who handles it that it contains sensitive information. HIPAA does not prescribe a universal cover-sheet format; treat it as a practical fax transmission safeguard and follow your organization’s policy.

• Intended recipient’s name, organization, and fax number.
• Sender’s name, organization, callback number, and fax number.
• Date, total number of pages, and a brief, non-sensitive subject or reference number if needed.
• A concise confidentiality notice directing an unintended recipient not to review, copy, or disclose the fax, and asking them to contact the sender and securely destroy or return it according to policy.

Keep PHI out of the cover sheet unless it is necessary for routing. A disclaimer does not replace recipient verification, a permitted disclosure basis, or other safeguards. HHS explains that fax disclosures require reasonable safeguards, including confirming the number and protecting access to fax machines. HHS guidance on safeguards for faxing patient information

How can staff secure fax machines and handle incoming faxes?

Place fax machines where unauthorized people cannot readily view or collect documents. Restrict access to stored, printed, and discarded fax pages, and use a secure fax service or device configuration approved by your organization.

• Retrieve incoming faxes promptly under your organization’s policy; HIPAA does not set a universal number of minutes for retrieval.
• Keep incoming and outgoing documents from being left unattended in a shared area. Secure any fax that cannot be collected immediately.
• Check that incoming pages belong to your service and intended recipient. Route them only to staff authorized to handle the information.
• When an expected fax does not arrive, contact the sender through a verified number to confirm the destination and arrange secure retransmission if needed.
• Dispose of misdirected or duplicate pages using approved secure-destruction procedures, and do not leave PHI in trays, recycling, or ordinary waste.

HHS lists prompt retrieval, securing faxes that have not been retrieved, and verifying a missing expected fax as protective practices. HHS cybersecurity awareness guidance on faxing

What steps should staff take after sending a fax to the wrong recipient?

Act promptly under your organization’s misdirected fax response protocol. Notify the privacy or security officer according to policy; staff should not decide on their own that a mistaken disclosure is harmless or that notification is unnecessary.

1. Stop any further transmission and preserve the transmission report, fax documents, and relevant details, including the date, number, intended recipient, actual recipient if known, and information involved.
2. Contact the unintended recipient using a verified number. Ask them not to use, copy, or disclose the fax; request that they securely destroy or return it; and document their response. Do not assume these steps erase the disclosure.
3. Notify the appropriate privacy or security lead promptly and provide the facts needed for a breach notification assessment.
4. Have the responsible organization assess the incident under its policies and applicable HIPAA requirements, document the outcome, and take steps to mitigate harm and prevent recurrence.

An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless an exception applies or the organization documents a risk assessment demonstrating a low probability that the PHI was compromised. That assessment considers the nature and extent of the information, who received it, whether it was acquired or viewed, and how risks were mitigated. Notification is not automatic in every misdirected-fax incident; the covered entity or business associate must assess and document the circumstances under the applicable rule. HHS Breach Notification Rule guidance

When may faxing PHI be appropriate for immediate patient care?

Faxing may be appropriate when it supports patient treatment and the recipient is a health care provider involved in that care. HIPAA permits covered providers to disclose PHI to another provider for treatment without patient authorization, while requiring reasonable safeguards against inappropriate use or disclosure.

For urgent communication, verify the destination as quickly as circumstances allow, alert the receiving provider when practical, send only information relevant to care, and confirm receipt when needed to support safe follow-up. Do not treat urgency alone as permission to disclose PHI to an unrelated recipient or for a non-treatment purpose. Whether a teratogen information service is acting as a covered provider, business associate, or another type of service depends on its circumstances; follow your organization’s guidance on the permitted disclosure basis. HHS guidance on treatment communications by fax

In short, verify the recipient, disclose only what is appropriate, protect fax documents at both ends, and escalate any misdirected fax for assessment. Use your organization’s policies to guide each step.

FAQs.

What should staff do if a fax containing PHI is sent to the wrong number?

Follow your misdirected fax response protocol: stop further transmission, preserve the transmission details, notify the privacy or security lead, and contact the unintended recipient through a verified number to request secure destruction or return and no further use or disclosure. The organization should assess and document whether the incident is a reportable breach; a mistaken fax does not automatically determine the outcome.

Should staff use a confidentiality cover sheet when faxing PHI?

A confidentiality cover sheet is a useful safeguard and may be required by organizational policy, but HIPAA does not prescribe a universal cover-sheet format. Include routing and sender details, a page count, and instructions for an unintended recipient, while avoiding unnecessary PHI on the cover sheet.

How quickly should incoming faxes containing PHI be retrieved?

Retrieve them promptly under your organization’s policy and secure any fax that cannot be collected right away. HIPAA does not establish a universal retrieval deadline in minutes.

Can staff fax PHI for immediate patient care?

Yes, when the disclosure is permitted for treatment and staff use reasonable safeguards. Verify the recipient and number, send only relevant information, and follow your organization’s procedures. A teratogen information service should confirm that the purpose and recipient fit an applicable disclosure basis rather than assume every consultation is treatment.