Wrong-Recipient Fax in a Rare Disease Referral Inbox: Incident Response Checklist

A referral fax sent to the wrong recipient may expose a patient’s identity, rare-disease diagnosis, and other protected health information (PHI). Act promptly to contain the disclosure, preserve evidence, and involve your privacy or compliance lead. A wrong-number fax is an incident to assess; it is not automatically a reportable breach.

What should staff do immediately after sending a referral fax to the wrong recipient?

• Stop further transmission. Cancel queued pages or retries if possible, and check whether the fax platform sent the complete referral or only part of it.
• Notify the right people promptly. Follow your organization’s incident-response policy and contact the privacy officer, compliance lead, or designated supervisor. If a vendor or business associate sent the fax, notify the covered entity according to your organization’s procedures and agreement.
• Preserve evidence. Keep the transmission confirmation, recipient number, time, page count, cover sheet, and relevant system records. Don’t alter or discard records related to the incident.
• Begin containment. Contact the unintended recipient using a number verified independently, ask them not to read, copy, forward, or otherwise use the fax, and request that they secure and destroy it. Record their response.
• Send the referral to the correct destination. Verify the intended recipient’s fax number through a trusted source before resending, and send only the information needed for treatment.

Do not assume that a fax recall request or a recipient’s assurance resolves the incident. Promptly document mitigation steps, then assess whether the disclosure involved unsecured protected health information and whether it meets the HIPAA breach standard. HHS explains that an impermissible disclosure is presumed to be a breach unless an exception applies or a documented risk assessment shows a low probability that the PHI was compromised. See HHS’s HIPAA Breach Notification Rule guidance.

How should the unintended recipient be contacted and the fax secured?

Call a verified number for the receiving office, such as a number from its official directory or a previously confirmed contact list—not simply the number printed on the misdirected fax. Keep the conversation limited: explain that a fax was sent in error, identify the transmission sufficiently for the recipient to locate it, and ask them to prevent access, further use, or disclosure.

Ask the recipient to secure the paper pages or electronic file, ensure it is not forwarded or retained, and securely destroy or delete it when appropriate. Request confirmation of what happened, including whether anyone viewed, copied, or shared the information. Avoid repeating sensitive details unnecessarily during the call.

Record the contact attempts, dates and times, person spoken to, their account of access or handling, and any containment or destruction confirmation. If the recipient cannot be reached or cannot confirm what happened, document that fact and tell the privacy officer; do not treat silence as proof that the fax was not viewed.

HIPAA allows providers to fax PHI for treatment, but requires reasonable safeguards. HHS gives confirming an unfamiliar fax number and programming frequently used numbers to help prevent misdirected transmissions as examples of safeguards. See HHS guidance on sharing health information by fax.

What details should be recorded in the incident log?

Record enough detail for another reviewer to understand what happened, what information was involved, how the organization responded, and how it reached its decision. Keep the record in the approved secure incident-management system and limit access to people who need it.

• Incident timeline: When the fax was sent, when the error was noticed, when the organization first knew or reasonably should have known of it, and when each response step occurred.
• Transmission facts: The sender, intended recipient, unintended number or destination, page count, delivery status, and any available fax logs or confirmation records.
• Information involved: The categories of PHI on the fax—such as identifiers, diagnosis, referral details, or clinical records—and the number of individuals affected. Avoid copying more sensitive content into the log than needed.
• Recipient and access details: Who received the fax, whether the recipient was a provider or other person, whether anyone viewed or retained it, and whether it was copied, forwarded, or further disclosed.
• Containment and mitigation: Contact attempts, instructions given, the recipient’s response, deletion or destruction confirmation, and any corrective transmission to the intended provider.
• Assessment and decision: The breach risk assessment, factors considered, applicable exception if any, conclusion, reviewer, and any notification decisions and dates.

Pay particular attention to the breach discovery date. Under HIPAA, discovery generally begins on the first day the breach is known or would have been known through reasonable diligence—not when the investigation is finished. HHS also states that covered entities and business associates must document either the notifications made or the basis for determining notification was not required. See HHS’s documentation and breach-notification guidance.

How should the organization assess the risk of PHI compromise?

A readable fax containing PHI that reaches an unintended recipient may be an impermissible disclosure of unsecured protected health information. HIPAA presumes an impermissible use or disclosure is a breach unless an exception applies or the organization demonstrates a low probability that the PHI was compromised through a documented breach risk assessment. A fax incident therefore needs an assessment, but does not automatically require breach notification.

Consider and document at least these four factors:

1. Nature and extent of the PHI: What identifiers and clinical details were included? Could the patient be identified from the information alone or in combination with other information?
2. Who received it: Was the recipient a healthcare provider or another person with duties to protect confidential information, or an unknown individual with no such obligation?
3. Whether it was acquired or viewed: Did the recipient confirm that the pages printed, whether anyone read them, or whether copies were made? Consider what evidence supports the answer.
4. How much the risk was mitigated: Was the recipient promptly reached? Did they secure and destroy the pages and confirm that no further use or disclosure occurred?

For a rare-disease referral, assess the specific contents rather than assuming the diagnosis alone determines the outcome. A rare diagnosis combined with names, dates, location, or detailed clinical history may increase the likelihood of identifying the patient. Weigh that context together with the recipient, evidence of access, and mitigation—not as a separate automatic rule.

HHS describes the presumption, the four factors, and the documentation expected to support a low-probability finding in its HIPAA breach risk assessment guidance. If the organization cannot support a low-probability conclusion or an exception, treat the event as a breach of unsecured PHI and follow applicable notification requirements.

When are individual and federal breach notifications required?

If the incident is a breach of unsecured PHI, the covered entity generally must notify each affected individual without unreasonable delay and no later than 60 calendar days after discovery. The deadline runs from the discovery date, not the date the organization finishes its review. The notice must describe the incident and information involved, steps individuals can take, the organization’s response, and how to obtain more information. HHS provides the applicable requirements in its Breach Notification Rule overview.

The HHS breach reporting threshold changes the timing for reporting to the Secretary of HHS, but it does not mean smaller breaches are exempt from federal reporting:

• 500 or more individuals affected: Notify the Secretary of HHS without unreasonable delay and no later than 60 calendar days after discovery.
• Fewer than 500 individuals affected: Report the breach to the Secretary within 60 days after the end of the calendar year in which it was discovered. The organization may report sooner.

For breaches affecting more than 500 residents of a state or jurisdiction, covered entities must also notify prominent media outlets serving that area, within the applicable 60-day period. A business associate that discovers a breach must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery; the parties should also follow their agreement and established reporting procedures. See HHS instructions for reporting breaches to the Secretary.

What safeguards help prevent wrong-recipient referral faxes?

HIPAA requires reasonable safeguards, not one universal faxing workflow. Choose controls that fit your referral process, fax technology, and the sensitivity of the information. HHS specifically identifies confirming unfamiliar fax numbers and programming frequently used numbers as examples of reasonable safeguards.

• Verify a new or changed fax number by calling a trusted number for the intended recipient.
• Maintain a controlled directory of confirmed referral destinations, and promptly review changes to it.
• Before sending, check the recipient name and number against the referral order; use an independent second check for high-risk or unusually sensitive packets when appropriate.
• Use a cover sheet that identifies the intended recipient and provides a contact number, while avoiding unnecessary PHI on the cover.
• Use fax-machine speed-dial or approved electronic fax address books for frequently used destinations, with a process to check that entries remain current.
• Place fax machines and incoming pages where unauthorized people cannot readily view or collect them; restrict access to electronic fax inboxes.
• Train staff on the organization’s referral workflow, error-escalation steps, and incident-reporting policy, and review recurring errors for process improvements.
• Where practical and approved, use a secure referral exchange instead of fax, while applying safeguards appropriate to that method as well.

In practice, a reliable response combines immediate containment, verified contact with the unintended recipient, a complete incident record, a documented assessment of the four risk factors, and timely notifications when required. Prevention depends on verified destinations, careful pre-send checks, secure handling, and clear staff procedures.

FAQs

Should every wrong-recipient fax be treated as a reportable breach?

No. Treat every suspected misdirected fax as an incident that must be promptly escalated and assessed, but not automatically as a reportable breach. An impermissible disclosure of unsecured PHI is presumed to be a breach unless an exception applies or a documented risk assessment demonstrates a low probability that the PHI was compromised. Whether notice is required depends on the facts and evidence.

What information should be included in a fax incident record?

Include the incident and discovery timeline, sender and destination details, transmission evidence, categories of PHI and number of people affected, recipient identity and access information, containment and mitigation steps, contact attempts and responses, the risk assessment, and the decision and rationale about notifications. Preserve supporting records securely.

How soon must affected individuals be notified after a breach is discovered?

For a breach of unsecured PHI that requires individual notice, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The organization should not wait until day 60 if earlier notice is reasonable and possible.

When must a breach be reported to the federal health department?

A covered entity must report a breach of unsecured PHI affecting 500 or more individuals to the Secretary of HHS without unreasonable delay and no later than 60 calendar days after discovery. For a breach affecting fewer than 500 individuals, it must report within 60 days after the end of the calendar year in which the breach was discovered; it may report earlier.