Wrong-Recipient Fax Incident Response Guide for the Acute Care for Elders Unit

What should staff do immediately after a wrong-recipient fax?

Act promptly to protect the patient and support timely care. Stop any further fax attempts to the incorrect number, secure the fax machine and any remaining pages, and notify your charge nurse or supervisor and the facility’s privacy officer through the unit’s privacy incident reporting process.

Record what was sent, when it was sent, the number dialed, the intended recipient, and how you discovered the error. Include the patient identifiers and information involved only in the approved incident-reporting system, following your facility’s policy and the HHS minimum necessary guidance where that standard applies.

Do not decide on your own whether the incident is a reportable breach. Promptly escalate it so the designated privacy official can assess the facts while the care team addresses any urgent clinical needs through a verified communication channel.

How can staff contain the fax and request secure destruction?

Contact the unintended recipient using a phone number or contact method verified independently of the misdirected fax. Explain that the fax was sent in error, ask them not to read, copy, use, or further disclose it, and request that they secure any pages or electronic copies while arranging secure destruction under their procedures.

Ask the recipient to confirm what happened, including whether anyone viewed or copied the pages and whether all copies were securely destroyed. Record the person you spoke with, the time, their response, and any follow-up; a request or verbal assurance does not by itself determine whether a breach occurred.

If the recipient cannot be reached, continue reasonable attempts using verified contact information and promptly escalate to the privacy officer. Preserve your own fax records and follow facility instructions; do not send patient information back to the wrong number or make an unverified return transmission.

For paper PHI, HHS describes secure disposal safeguards and gives shredding and similar methods that render information unreadable as examples. The recipient should use a secure method appropriate to the material and its procedures.

Who must be notified and what should be documented?

Notify the charge nurse or supervisor and the facility’s privacy officer promptly, as required by the organization’s privacy incident reporting policy. Include the unit manager, security officer, compliance team, or other designated leaders when policy requires it, or when the facts involve an ongoing exposure, urgent clinical risk, or additional recipients.

Document objective facts and actions rather than assumptions: the patient and information involved, number of pages, intended and actual fax numbers, time sent and discovered, fax transmission confirmation, people contacted, containment steps, responses, and any known viewing, copying, retention, or destruction. Note unanswered calls and later follow-up as well.

HIPAA requires regulated entities to maintain policies for handling security incidents and to document incidents and outcomes under the Security Rule; the organization’s privacy and breach procedures also guide reporting and escalation. See the HHS summary of the HIPAA Security Rule.

Which fax records and communications should be preserved?

Preserve the original transmission report, the fax number dialed, date and time, page count, cover sheet, the exact document sent, and any available machine or system logs. Keep related emails, call notes, incident reports, recipient confirmations, and communications with supervisors or the privacy officer in approved secure systems.

Do not alter or delete the source record, transmission confirmation, or incident communications. Restrict access to people who need the information to investigate, manage care, or meet their responsibilities, and avoid creating unnecessary copies containing protected health information.

Follow the organization’s retention schedule and any applicable state requirements. HIPAA requires certain Privacy and Security Rule documentation to be retained for six years from its creation or the date it was last in effect, whichever is later; that does not make six years a universal retention period for every clinical record or incident-related item. See HHS documentation guidance.

How should staff ensure the intended recipient receives the information?

First verify the intended recipient and fax number using a trusted directory, the patient’s care team, or a phone call to a number already known to be valid. HHS identifies confirming an unfamiliar fax number and securing fax equipment as examples of reasonable safeguards; it also notes that frequently used numbers may be programmed to reduce misdirection. See the HHS guidance on sharing information by fax and other methods.

Once the number is verified, resend only the information needed for the intended purpose, using the facility-approved method. Check the recipient name and number on the cover sheet and fax, then review the fax transmission confirmation. Confirmation that a fax was transmitted does not, by itself, establish that the right person received it.

If the information is time-sensitive for an older adult’s care, contact the treating clinician or intended care team promptly using a verified phone or secure channel while completing the approved transmission. HIPAA permits provider-to-provider disclosures for treatment using fax, phone, or other means with reasonable safeguards, as explained in HHS guidance on provider faxing.

How are breach assessment and patient notification handled?

The facility’s privacy officer or other designated official should lead the breach risk assessment. Under HHS guidance, an impermissible disclosure of protected health information is generally presumed to be a breach unless an applicable exception applies or the organization demonstrates a low probability that the information was compromised through a risk assessment.

The assessment considers the nature and extent of the information, who received it, whether it was actually viewed or acquired, and the extent to which the risk was mitigated. A recipient’s confirmation of secure destruction may be relevant evidence, but it does not automatically resolve the assessment. See the HHS Breach Notification Rule guidance.

If the organization determines that a breach of unsecured PHI occurred, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The covered entity must also notify HHS; breaches affecting 500 or more individuals have additional prompt reporting requirements, and breaches affecting more than 500 residents of a state or jurisdiction require media notice. The privacy officer should determine the applicable requirements and coordinate any patient notification; unit staff should not promise or independently issue a breach notice.

What corrective actions can prevent repeat misdirected faxes?

After the incident review, develop a corrective action plan proportionate to the cause and risk. Possible safeguards include confirming unfamiliar numbers with the intended recipient, maintaining and periodically checking approved fax directories, validating programmed or speed-dial numbers, using a cover sheet, and positioning fax machines so incoming pages are not accessible to unauthorized people.

Review whether staff need refresher training, clearer escalation steps, or a workflow change for urgent transfers and care coordination in the acute care for elders unit. Track assigned actions to completion and evaluate whether they reduce repeat errors, consistent with the facility’s policies and applicable HIPAA requirements.

A reliable response combines prompt containment, complete documentation, a fact-based breach risk assessment, and prevention measures. Staff should escalate the incident, safeguard the fax, and keep the patient’s care moving through a verified channel.

FAQs.

What should staff do if a recipient cannot be reached?

Record each contact attempt and promptly notify the supervisor and privacy officer. Continue reasonable attempts using independently verified contact details, follow the facility’s escalation process, and do not assume that the fax was not received or securely destroyed.

Should the fax be resent to the intended recipient?

Yes, if the information is still needed for care and the intended recipient and fax number have been verified. Use the approved secure process, send only the information needed, and check the transmission confirmation; for urgent care, use a verified phone or secure channel as appropriate.

What records should be retained after a misdirected fax?

Preserve the faxed document and cover sheet, transmission confirmation, relevant system logs, incident report, call notes, recipient responses, and documentation of containment and follow-up. Store them in approved secure systems and follow organizational and applicable legal retention requirements; HIPAA’s six-year rule applies to required documentation, not automatically to every record.

When must affected patients be notified?

The designated privacy official determines whether the incident is a reportable breach of unsecured PHI. If notification is required, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery; the organization should follow its breach response process rather than waiting by default until the deadline.