What to Do if an Ambulance ePCR Is Faxed to the Wrong Recipient

An ambulance electronic patient care report (ePCR) may contain protected health information (PHI), such as a patient’s name, condition, treatment, or transport details. If it is faxed to an unintended recipient, act promptly to contain the disclosure and report it through your organization’s incident process. Do not decide on your own whether it is a reportable breach; that determination belongs to the organization’s privacy or compliance team.

Report the suspected disclosure to a supervisor or privacy officer

Notify your supervisor, privacy officer, or designated privacy and security contact as soon as you discover the misdirected fax. Follow your organization’s incident-reporting policy, even if you believe the fax was not received or the recipient will destroy it.

Share the essential facts through an approved reporting channel: that an ePCR may have gone to the wrong recipient, when it was sent or discovered, and what you know about the destination. Avoid including additional patient details in an unapproved email, text, or voicemail. HIPAA requires organizations to maintain breach-notification procedures and document whether notification was required. See the HHS Breach Notification Rule guidance.

Contact the unintended recipient and request secure destruction

Coordinate with your supervisor or privacy officer before contacting the recipient, unless your organization’s policy directs you to act immediately. Use a verified phone number or another approved method. Explain that the fax was sent in error, ask the recipient not to read, copy, share, or otherwise use it, and request that they securely destroy the pages and any copies.

Ask the recipient to confirm whether the fax arrived, whether anyone viewed or copied it, and whether all copies have been securely destroyed. Record the response and when you received it. A request to destroy the document can help mitigate risk, but it does not by itself determine whether the incident is a breach. HHS recommends reasonable safeguards when PHI is faxed, including confirming the destination number. See HHS guidance on faxing PHI.

Document the fax details and mitigation steps

Complete the incident report and preserve relevant records according to your organization’s procedures. Useful risk mitigation documentation includes:

• The date and time the fax was sent, when the error was discovered, and who discovered it.
• The intended recipient and the fax number actually dialed, recorded securely.
• The fax transmission report or system log, including whether it shows successful delivery, failure, or an uncertain result.
• The type of information and number of patients involved, without placing unnecessary PHI in a broadly accessible report.
• Attempts to contact the recipient, their responses, whether the pages were viewed or copied, and any confirmation of secure destruction.
• Steps taken to stop further transmission, alert the appropriate staff, and prevent a repeat error.

Keep the original fax record and related communications in the approved incident file; do not alter or delete them to conceal the mistake. HHS explains that a covered entity or business associate must be able to demonstrate either that required notifications were made or that notification was not required, such as through a documented risk assessment. See the HHS guidance on breach documentation.

How the organization assesses whether the incident is a breach

A misdirected ePCR is not automatically a reportable breach, but an unauthorized disclosure of PHI is generally presumed to be a breach unless an exception applies or the organization demonstrates a low probability that the PHI was compromised. The organization—not the individual employee—should complete and document the HIPAA breach assessment.

Under the HIPAA Breach Notification Rule, the organization assesses at least four factors: the nature and extent of the PHI, who received it, whether it was actually acquired or viewed, and how effectively the risk was mitigated. The organization also considers whether an exception applies. A paper ePCR that is readable by an unauthorized recipient may be unsecured PHI; fax transmission alone does not render the information unreadable or indecipherable. See 45 CFR § 164.402 and HHS breach assessment guidance.

When and how affected individuals must be notified

If the organization determines that the incident is a breach of unsecured PHI requiring notification, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after the breach’s discovery date. The discovery date is generally the first day the breach is known, or would have been known through reasonable diligence, to the organization; completing the investigation does not automatically restart that deadline. See 45 CFR § 164.404.

The organization is responsible for deciding whether notice is required and arranging it under its policies. Individual notices generally must be written in plain language and describe what happened, the types of PHI involved, steps individuals can take, the organization’s response, and how to ask questions. Depending on the number of people affected and other circumstances, the organization may also need to notify HHS and, in certain cases, the media. See the HHS summary of the Breach Notification Rule.

What to do if the recipient cannot be reached

Tell your supervisor or privacy officer that you could not reach the recipient, and document each attempt, including the time, method, and outcome. Ask the privacy officer to decide next steps, such as contacting the recipient’s organization through a verified main number, privacy office, or secure channel.

Preserve the fax transmission report and any system logs. If delivery status is unclear, report that uncertainty rather than assuming the fax failed. Do not keep sending the ePCR to unverified numbers or use a less secure channel to share patient details. The privacy officer can continue the investigation, assess the risk, and determine what containment and notification steps are required.

In short, report the suspected disclosure promptly, preserve the fax and incident records, and support reasonable efforts to contain the information. Let your organization’s privacy officer complete the HIPAA breach assessment and determine whether notifications are required.

FAQs

What should I do first after an ambulance ePCR is faxed to the wrong recipient?

Immediately report the suspected disclosure to your supervisor or privacy officer under your organization’s incident policy. Then follow their instructions for contacting the recipient, requesting secure destruction, and documenting the event.

What information should be documented about the fax incident?

Record when the fax was sent and discovered, the intended and actual destination, the transmission status, the types of information involved, and whether the recipient viewed or copied it. Also document contact attempts, destruction confirmation, mitigation steps, and relevant fax logs or reports in the approved incident file.

Does every misdirected ePCR fax count as a reportable breach?

No. A misdirected fax may involve an impermissible disclosure, but the organization must assess whether an exception applies or whether it can demonstrate a low probability that the PHI was compromised. The documented assessment considers the information involved, who received it, whether it was viewed or acquired, and how the risk was mitigated.

How soon must affected individuals be notified after a breach is discovered?

When notification is required for a breach of unsecured PHI, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The organization determines whether notification is required and manages the notice process.