Wrong-Recipient Fax Incident Response Guide for the Inpatient Glycemic Management Team

What should the team do immediately after a fax is sent to the wrong recipient?

Act promptly to contain the disclosure and protect patient care. Notify your supervisor and the facility’s privacy officer or designated incident-response contact, following your organization’s reporting procedure. Do not wait to confirm whether the recipient read the fax before reporting it.

If it is safe and appropriate, contact the unintended recipient using a verified phone number. Ask them not to read, copy, share, or forward the fax; to securely destroy or delete all copies; and to confirm what they did. Record their response. These are practical containment steps, not a substitute for the organization’s breach assessment, and recovery or destruction does not by itself resolve whether a breach occurred.

Keep the original transmission confirmation, cover sheet, and related records; do not alter or discard them. If the clinical information is still needed, first verify the intended recipient and fax number, then resend through an approved channel. For urgent inpatient glycemic management, use an authorized clinical communication method to avoid delaying care. HHS identifies confirming fax numbers and securing fax machines as examples of reasonable safeguards. HHS guidance on fax safeguards

How should the team report the incident internally?

Report the event promptly through your organization’s incident-reporting process, even if you believe the recipient has destroyed the fax or the exposure involved only one patient. Include the privacy officer and, where applicable, compliance, information security, health-information management, and the clinical leader responsible for the inpatient glycemic management team.

Use the approved incident-reporting system and limit access to people who need the information to investigate and respond. Do not put unnecessary patient details in an ordinary email, text, or broadly visible work queue. Follow employer-specific policies for escalation and reporting timeframes; HIPAA requires covered entities to maintain breach-notification policies and train workforce members on them, but the team should not assume a single universal federal deadline for employees to file an internal report. HHS Breach Notification Rule guidance

If a business associate was involved, notify the appropriate organizational contact so the covered entity can coordinate with that business associate under applicable policies and agreements. The HIPAA Security Rule also requires regulated entities to respond to suspected or known security incidents, mitigate harmful effects to the extent practicable, and document incidents and outcomes. 45 CFR § 164.308

What details must be recorded in the incident documentation?

Create a factual, time-stamped record that lets the organization investigate the impermissible disclosure, document mitigation, and support its HIPAA breach risk assessment. Include:

• When the fax was sent, when the error was discovered, and when each response action occurred.
• The sender, intended recipient, unintended recipient, fax numbers used, transmission result, and available confirmation or machine logs.
• The number of pages and the categories of information involved, such as patient identifiers, glucose readings, medication or insulin information, diagnoses, or treatment plans. Use the organization’s secure incident system rather than reproducing unnecessary PHI in an unrestricted record.
• What is known about who received the fax, whether anyone viewed, copied, kept, or shared it, and how that information was established.
• Containment and mitigation actions, including whom the team contacted, the recipient’s response, and any confirmation of secure destruction or deletion.
• The names or roles of people notified internally, investigative findings, the assessment decision and rationale, and any required notifications or corrective actions.

Retain the incident assessment and supporting records under the organization’s document-retention policy. HIPAA requires certain documentation to be retained for six years from its creation or the date it was last in effect, whichever is later. 45 CFR § 164.530(j)

How is a potential HIPAA breach assessed?

A fax that discloses identifiable patient information to an unintended recipient may be an impermissible disclosure. An impermissible use or disclosure of unsecured protected health information is generally presumed to be a breach unless an exception applies or the covered entity or business associate demonstrates, through a documented risk assessment, a low probability that the PHI was compromised. The team should promptly refer the matter to the privacy officer rather than making that determination on its own. HHS definition of a breach

The assessment must consider at least these four factors:

• Nature and extent of the PHI: What identifiers and clinical details were disclosed, and how readily could the patient be identified?
• Recipient: Who received the fax, and what is known about their role and circumstances?
• Acquisition or viewing: Was the fax actually received, viewed, retained, copied, or shared?
• Mitigation: What steps reduced the risk, and what evidence supports the steps taken?

Consider the facts together and document the reasoning. A recipient’s promise to destroy the fax is relevant mitigation documentation, but it does not automatically establish a low probability of compromise. HHS describes the four required factors and the need to retain documentation supporting the assessment. HHS guidance on breach risk assessments

What notification deadlines apply if a breach is confirmed?

If a breach of unsecured PHI is confirmed, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The deadline is not extended simply because the investigation is still underway; escalate promptly so the organization can determine its obligations and meet any applicable deadline. HHS notification requirements

The covered entity must also notify the HHS Secretary. For a breach affecting 500 or more individuals, report to HHS without unreasonable delay and no later than 60 calendar days after discovery. For fewer than 500 individuals, the covered entity may report annually; the report is due no later than 60 days after the end of the calendar year in which the breach was discovered. A covered entity may report a smaller breach sooner rather than waiting until year-end. HHS breach-reporting instructions

Separate from the 500-person HHS reporting threshold, a breach affecting more than 500 residents of a state or jurisdiction requires notification to prominent media outlets serving that area. If a business associate discovers a breach, it must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery; the parties’ agreement or organizational procedure may require earlier notice. HHS guidance on individual, media, and business-associate notices

How can the team prevent wrong-recipient fax incidents?

Build safeguards into the team’s routine fax workflow:

• Verify the recipient’s name, organization, and fax number against an approved directory or by confirming the number directly with the recipient.
• Use preprogrammed, verified numbers for frequent destinations where available, and recheck the number before sending to a new or changed destination.
• Confirm the patient and intended recipient on the cover sheet and review the page count and attachments before transmission.
• Send only the information needed for the clinical purpose, and place fax machines where received pages are not accessible to unauthorized people.
• Check the transmission confirmation and follow up if delivery is uncertain; report and investigate misdirected transmissions promptly.
• Train team members on the organization’s fax, privacy, and incident-reporting procedures, including how to handle urgent glycemic-management communications safely.

HHS specifically identifies confirming the fax number and placing the receiving fax machine in a secure location as examples of reasonable safeguards. Applying these checks, reporting errors promptly, and documenting mitigation can help the team reduce the chance and impact of a wrong-recipient fax incident. HHS fax-safeguard examples

FAQs.

Should the unintended recipient forward the fax to the intended recipient?

Do not ask the unintended recipient to forward it as a workaround. Ask them not to share or further disclose the fax, to securely destroy or delete it, and to confirm their actions. The team should verify the intended recipient’s details and resend the necessary information through an approved channel, following the privacy officer’s direction.

What information should the team document about the fax incident?

Record the timeline; sender and intended and unintended recipients; fax numbers and transmission evidence; the type and amount of PHI involved; whether the fax was received, viewed, kept, or shared; internal notifications; containment and mitigation steps; the recipient’s response; and the organization’s assessment and rationale. Keep the record in the approved secure incident system.

When must affected individuals be notified of a confirmed breach?

The covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a confirmed breach of unsecured PHI. HHS notification guidance

How does the reporting deadline differ for incidents affecting fewer than 500 people?

The covered entity still must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery if the incident is a confirmed breach. For HHS reporting, a breach affecting fewer than 500 individuals may be reported annually, no later than 60 days after the end of the calendar year in which it was discovered; it may also be reported earlier. HHS reporting deadlines