What to Do When a Nurse’s Shift-Charting Tablet Sends a Fax to the Wrong Recipient

What should a nurse do immediately after a misdirected fax?

Report the misdirected fax promptly to your supervisor and the organization’s privacy officer or designated incident-response contact, following your facility’s policy. Do not wait to determine whether the fax was read: a mistaken fax containing protected health information (PHI) may be an impermissible disclosure, and the privacy team must assess what happened.

If the transmission is still pending or queued, use the approved workflow to stop it if possible. Preserve the tablet and fax-system details, including the recipient number, transmission time, confirmation or error message, and any available transmission logs. Don’t delete, alter, or forward the fax or related records.

Do not contact the unintended recipient on your own unless your organization directs you to. A privacy officer or other authorized staff member can decide whether and how to request that the fax be secured, returned, or destroyed, and document the response as part of breach mitigation documentation.

What details should be documented in the incident report?

Record objective facts as soon as you can, using your organization’s incident-reporting process. Include the date and time the fax was sent and discovered, the intended and actual fax numbers and recipients, the number of pages, and the kind of information involved. Follow your organization’s rules for documenting patient identifiers; don’t include unnecessary PHI in the incident report.

• Describe how the wrong recipient or number was selected and what the tablet displayed.
• Record whether the fax system showed a successful transmission, failure, cancellation, or other status. A fax transmission confirmation can help establish what the system reported, but it does not by itself show who received, viewed, or secured the pages.
• Note the steps taken to stop further transmission, alert the supervisor and privacy officer, and contact the recipient, if that contact was authorized.
• Document any response from the recipient, including whether they said the fax was received, viewed, secured, returned, or destroyed. Distinguish what you observed from what someone else reported.
• Preserve relevant logs and records according to facility policy, and provide them to the privacy team through approved channels.

Timely, factual documentation helps the organization investigate and evaluate the event. Avoid speculation, blame, or conclusions about whether the incident is legally a breach; that determination belongs to the organization’s privacy team.

How does the privacy team assess the disclosure risk?

Under the HIPAA Breach Notification Rule, an impermissible use or disclosure of unsecured protected health information is generally presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the information was compromised, or an exception applies. The organization—not the nurse acting alone—should conduct and document the breach risk assessment. See the HHS Breach Notification Rule guidance.

The assessment must consider at least four factors: the nature and extent of the PHI, including identifiers and re-identification risk; who received it; whether it was actually acquired or viewed; and how much the risk was mitigated. Relevant facts may include the sensitivity and volume of the information, the recipient’s relationship to the patient, and reliable evidence about whether the recipient secured or destroyed the fax.

The organization should document its reasoning and supporting evidence, including mitigation efforts and the recipient’s response, if any. A fax transmission confirmation alone may not resolve whether the information was viewed; if that remains uncertain, report the uncertainty rather than assuming either outcome. HHS explains the risk-assessment factors and the organization’s documentation responsibilities in its breach notification guidance.

When must affected individuals and regulators be notified?

The organization’s privacy team determines whether notification is required. If the event is a breach of unsecured PHI, a covered entity generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach. The nurse should report the incident promptly but does not personally decide or send the required notices unless assigned that responsibility under organizational policy.

For a breach affecting 500 or more individuals, the covered entity must notify HHS without unreasonable delay and no later than 60 calendar days after discovery; if more than 500 residents of a state or jurisdiction are affected, notice to prominent media outlets serving that area is also required within that timeframe. For breaches affecting fewer than 500 individuals, the covered entity may report to HHS annually, no later than 60 days after the end of the calendar year in which the breach was discovered. See HHS notification requirements and HHS instructions for reporting breaches.

These are federal HIPAA timelines; other applicable laws, contracts, or organizational policies may also matter. The HIPAA minimum necessary standard generally requires reasonable efforts to limit PHI to what is needed for a purpose, but it does not apply to disclosures between health care providers for treatment. In any case, sending a fax to the wrong recipient is not excused simply because the fax contained only a limited amount of information. See HHS guidance on the minimum necessary standard.

How can nurses verify fax recipients and contain the disclosure?

Before sending, compare the fax number on the tablet with a trusted, current source, such as an approved directory or a number confirmed directly with the intended recipient. Take extra care when using a number that is new or not regularly used. HHS identifies confirming an unfamiliar number and programming frequently used numbers as examples of reasonable safeguards against misdirected faxes. See HHS guidance on faxing and other communications.

Use the recipient-selection and cover-sheet steps required by your facility, check the recipient and number before confirming transmission, and verify that the fax is directed to a location where authorized staff can receive it securely. If the fax goes astray, promptly notify the privacy officer and follow instructions about any approved contact with the recipient or further containment. HIPAA requires reasonable safeguards and, where practicable, mitigation of harmful effects from impermissible disclosures; see HHS guidance on safeguards for faxing PHI.

What tablet or fax workflow changes can prevent recurrence?

Share the incident with your supervisor and privacy or compliance team so they can review the workflow, not just the individual error. Depending on the organization’s systems and policies, useful changes may include:

• Using an approved, regularly updated recipient directory and clearly distinguishing similarly named recipients.
• Adding a recipient-and-number confirmation step before transmission, especially for first-time or unusual destinations.
• Using preprogrammed, verified fax numbers where available, and restricting who can edit shared recipient lists.
• Making it easy to review the selected recipient, number, and pages before the final send action.
• Providing clear cancellation instructions and a defined escalation path for queued, failed, or misdirected faxes.
• Reviewing system logs and incident trends to identify interface, directory, or training problems that may have contributed to the error.

HHS describes confirming numbers and preprogramming frequently used numbers as examples of safeguards, not as a single required technical design. The organization should choose controls appropriate to its workflow and equipment. See HHS fax-safeguard guidance.

In short: Report a misdirected fax promptly, preserve the facts, and follow your organization’s instructions. The privacy team evaluates the disclosure, documents mitigation and risk, and determines whether notification is required; verified recipients and carefully designed workflows can help prevent another mistake.

FAQs

Should I contact the unintended fax recipient myself?

Usually, report the incident to your supervisor and privacy officer first, and follow their instructions. An independent call could create confusion or lead to further disclosure. The privacy team can decide whether authorized staff should contact the recipient and how to document any request to secure, return, or destroy the fax.

What information should I include in a misdirected fax incident report?

Include when the fax was sent and discovered, the intended and actual fax numbers or recipients, the number of pages and general types of PHI involved, the system’s transmission status, how the error occurred, and the steps taken after discovery. Record recipient responses and preserve relevant logs. Follow your organization’s rules for protecting patient identifiers and avoid speculation.

How quickly must patients be notified after a reportable breach?

For a breach of unsecured PHI, the covered entity generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach. The organization’s privacy team determines whether notification is required and handles the process. See HHS’s HIPAA Breach Notification Rule guidance.

What should I do if I cannot confirm whether the recipient viewed the fax?

Tell the privacy officer that viewing cannot be confirmed, and provide the available transmission records and any authorized contact results. Do not assume the fax was or was not viewed. Whether it was acquired or viewed is one of the factors the organization considers in its breach risk assessment, along with the information involved, who received it, and mitigation efforts.