Wrong-Recipient Fax Incident Response Guide for Downwinder Health Screening Clinics

A fax sent to the wrong recipient can expose protected health information (PHI), including screening or medical details. Act quickly to stop further disclosure, contact the clinic’s privacy officer, preserve the facts, and assess whether the incident meets the HIPAA Breach Notification Rule’s definition of a reportable breach.

How should a clinic identify and contain a misdirected fax?

Start by confirming what happened and whether any additional pages or transmissions are involved. A fax transmission log, a returned fax, a recipient’s call, or a staff report may reveal that a number was misdialed or selected incorrectly.

• Stop any queued or repeat transmissions to the incorrect number, and do not resend the material until the intended recipient’s number is verified.
• Check the transmission report and cover sheet to identify the fax number used, the number of pages sent, the time, and any delivery status.
• Confirm the intended recipient’s fax number using a trusted source, such as a previously verified directory or a phone call to a known contact number.
• Secure any remaining copies at the clinic and limit access to staff who need to investigate or respond.

Record when the clinic discovered the issue and who reported it. A misdirected fax involving PHI should be promptly referred for privacy review; staff should not decide on their own that the incident is harmless or that patient notification is unnecessary.

What should staff ask the unintended recipient to do?

Contact the unintended recipient promptly using a verified phone number. Explain that the fax was sent in error, ask them not to read, copy, forward, share, or otherwise use the information, and request that they securely destroy it or return it using a method approved by the privacy officer.

Ask the recipient to confirm whether the fax was received, viewed, copied, or shared; whether anyone else may have accessed it; and whether all pages and copies have been destroyed or returned. Document the answers and any written confirmation. A recipient’s cooperation can help mitigate risk, but it does not by itself determine whether a breach occurred.

For future transmissions, HHS recommends reasonable safeguards such as confirming an unfamiliar fax number with the intended recipient and programming frequently used numbers into the fax machine. See the HHS guidance on sending PHI by fax.

Who should be notified about the fax incident?

Notify the clinic’s privacy officer or designated privacy contact and the appropriate supervisor as soon as possible, following the clinic’s incident-response policy. HIPAA requires covered entities to designate a privacy official and maintain safeguards for PHI, as described in 45 CFR § 164.530.

Include the fax-system administrator or service provider when needed to stop further transmissions, secure relevant system records, or investigate a technical problem. If the clinic is acting as a business associate, promptly notify the covered entity according to the business associate agreement and the clinic’s procedures; the covered entity generally handles the decision about required patient and regulator notices.

Keep initial reporting limited to people who need to respond. The privacy officer can coordinate any additional escalation to leadership, legal counsel, or others under the clinic’s policies.

What information should incident documentation include?

Create a factual incident record promptly and update it as information is confirmed. Keep the record secure and separate from informal messages or speculation.

• Incident details: Date and time sent, date and time discovered, sender, intended recipient, incorrect fax number, and how the error was identified.
• Information involved: Number of affected patients, page count, and general types of PHI disclosed. Avoid placing unnecessary PHI in the incident report itself.
• Evidence: Fax transmission logs, confirmation pages, cover sheets, related call records, relevant system information, and copies of communications about containment.
• Recipient response: Whether the fax was received, viewed, copied, or shared; who may have had access; and what containment or destruction steps the recipient confirmed.
• Response and decision: Actions taken, staff and officials notified, the breach risk assessment, its rationale, and any notice decisions and dates.

Preserve relevant records before routine deletion or log rotation, and follow the clinic’s retention and legal-hold procedures. HIPAA requires covered entities to retain documentation required under the Privacy Rule for six years from its creation or the date it was last in effect, whichever is later; see 45 CFR § 164.530(j).

How should the clinic assess exposure and determine reporting obligations?

The privacy officer should determine whether the disclosure was permitted and whether the information was unsecured PHI. Under the HIPAA Breach Notification Rule, an impermissible use or disclosure is generally presumed to be a breach unless an exception applies or a documented breach risk assessment demonstrates a low probability that the PHI was compromised. The assessment must consider the nature and extent of the PHI, who received it, whether it was actually acquired or viewed, and how effectively the risk was mitigated. See 45 CFR § 164.402.

Consider the sensitivity and identifying details in the fax, the recipient’s relationship to the clinic and ability to safeguard the information, the recipient’s account of access or sharing, and the steps taken to contain the disclosure. Document the evidence and reasoning; do not treat a request to destroy the fax as automatic proof that no breach occurred.

If the incident is a breach of unsecured PHI and no exception or low-probability determination applies, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. A breach involving 500 or more individuals must also be reported to the Secretary of HHS without unreasonable delay and no later than 60 days; breaches involving fewer than 500 individuals are reported within 60 days after the end of the calendar year in which they were discovered. Media notice is required for breaches affecting more than 500 residents of a state or jurisdiction. See 45 CFR § 164.404, 45 CFR § 164.408, and the HHS Breach Notification Rule guidance.

Check applicable state law, agreements, and clinic policies as well as federal HIPAA requirements. Do not assume every wrong-number fax requires external notice—or that a small incident is automatically exempt. The facts and documented assessment determine the response.

What steps can prevent future fax misdeliveries?

Build safeguards into the clinic’s routine fax process and review them when staff, equipment, or workflows change.

• Verify unfamiliar or newly updated fax numbers with the intended recipient using a trusted contact method; use approved, preprogrammed numbers for frequent recipients.
• Require staff to check the recipient name and fax number before sending, and use a cover sheet that identifies the intended destination without unnecessarily exposing PHI.
• Use a confirmation page or transmission report to check the destination and delivery status, and make sure staff know how to stop a queued or repeated fax.
• Review fax transmission logs for errors and recurring misdial patterns; restrict access to fax machines, stored documents, and device memory.
• Train staff on the clinic’s incident-reporting process and on applying the minimum necessary standard where it applies. HHS notes that this standard generally limits PHI to what is needed for the purpose, but it does not apply to provider disclosures for treatment purposes; see the HHS minimum necessary guidance.

A reliable response combines prompt containment, a documented assessment, and practical safeguards such as number verification, protected fax transmission logs, and clear staff procedures. Use each incident to identify and correct the process that allowed the misdelivery.

FAQs

What should staff do immediately after discovering a fax was sent to the wrong recipient?

Stop any pending or repeat transmissions, notify the privacy officer and supervisor, and verify what was sent and to which number. Contact the unintended recipient using a verified number, request containment, and preserve the fax transmission logs and related records for review.

Should the clinic ask the unintended recipient to destroy or return the fax?

Yes. Ask the recipient not to use, copy, or share the fax and to securely destroy it or return it through a method approved by the privacy officer. Request confirmation and document whether it was viewed or shared, while recognizing that these steps help mitigate risk but do not automatically resolve the breach assessment.

When must patients or regulators be notified about a misdirected fax?

Not every misdirected fax automatically requires external notice. The covered entity must assess whether the incident is a breach of unsecured PHI under the HIPAA Breach Notification Rule. If notice is required, affected individuals generally must be notified without unreasonable delay and no later than 60 calendar days after discovery; HHS reporting and media-notice requirements depend on the number of people affected and other applicable criteria.

What records should the clinic preserve after a fax incident?

Preserve the fax transmission logs, confirmation page, cover sheet, relevant system records, incident timeline, recipient communications, and the privacy officer’s assessment and decision. Protect the records from routine deletion while the incident is under review and follow HIPAA documentation retention requirements and the clinic’s applicable retention procedures.