Wrong-Recipient Faxed Refill Request: Database Incident Response Checklist

What to do immediately after a refill request is faxed to the wrong recipient

Act promptly to limit further access and protect patient care. A refill request may contain protected health information (PHI), such as a patient’s name, contact details, medication, and treatment information.

1. Stop additional transmissions. Pause any related fax batch or automated workflow until you confirm the correct destination.
2. Notify your privacy or security officer and supervisor. Follow your organization’s incident-reporting procedures, even if the recipient says the fax was not read.
3. Contact the unintended recipient using a verified phone number. Ask them not to use or disclose the fax, to securely destroy it or return it through an approved method, and to confirm whether anyone viewed, copied, or retained it. Avoid sending more patient details in a follow-up fax.
4. Preserve evidence. Keep the fax transmission report, relevant cover sheet, incident notes, and communications with the recipient. Do not alter or delete records.
5. Complete the refill workflow safely. Confirm the intended recipient’s fax number through a reliable source, then resend only as appropriate under your organization’s procedure. Do not let the privacy response unnecessarily interrupt urgent patient care.

HIPAA permits providers to fax PHI for treatment, but requires reasonable safeguards. HHS identifies confirming an unfamiliar fax number and keeping fax equipment in a secure location as examples of safeguards. See HHS guidance on faxing patient information.

How to document the misdirected fax and response

Create a factual, access-restricted incident record according to your organization’s policy. Record when the fax was sent and discovered, who sent or discovered it, the intended and unintended destinations, and how the error occurred. Preserve available fax logs and transmission confirmations.

Document what PHI was involved, including the number of patients and pages and the types of information visible, such as identifiers, medication details, or diagnosis information. Record when and how you contacted the recipient, what they reported about viewing or retaining the fax, and any destruction, return, or other mitigation they confirmed.

Also record who was notified internally, the assessment and decision made by the privacy officer, any required notifications, and corrective steps. HHS says covered entities and business associates must be able to document either that required notifications were made or why notification was not required, such as a risk assessment showing a low probability that the PHI was compromised. See the HHS Breach Notification Rule guidance.

When a wrong-recipient fax may be a reportable breach

A refill request sent to an unintended recipient may involve an impermissible disclosure of PHI. Under HIPAA, an impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless the covered entity or business associate can demonstrate a low probability that the PHI was compromised through a documented risk assessment, or a narrow exception applies.

A routine fax transmission should not, by itself, be treated as proof that the information was secured under the HIPAA breach-notification standard. Assess the actual facts, including what the recipient received and whether they could retain the information. Do not assume that a recipient’s promise to destroy the fax automatically resolves the reporting question.

A recipient’s identity matters, but being a health care professional does not automatically authorize that person to receive a particular patient’s information. The circumstances of the disclosure and the four-factor assessment determine whether the incident meets the breach standard. The applicable covered entity or business associate should make and document that determination under its policies. See HHS guidance on the definition of a breach and its exceptions.

How to assess the risk of PHI compromise

For a HIPAA breach risk assessment, address at least the following four factors and evaluate their combined effect:

1. Nature and extent of the PHI: Identify the information disclosed, including identifiers and details that could reveal a patient’s health or treatment.
2. Who received it: Determine whether the recipient was a person or organization with a legitimate role, whether they were authorized to access the information, and what safeguards they had.
3. Whether it was acquired or viewed: Ask whether the fax was received, read, copied, or retained. Consider available transmission records and the recipient’s account.
4. How effectively the risk was mitigated: Document prompt contact, the recipient’s actions, confirmed destruction or return, and any other steps that reduced the chance of further use or disclosure.

Consider the evidence supporting each answer rather than relying on assumptions. The assessment must support any conclusion that there was a low probability of compromise. HHS describes these four factors in its breach-notification guidance.

What HIPAA notification deadlines apply

If the incident is a reportable breach of unsecured PHI, affected individuals generally must be notified without unreasonable delay and no later than 60 calendar days after discovery. The 60-day notification deadline is a maximum, not a reason to wait when notice can be provided sooner.

The covered entity must also notify HHS. For a breach affecting 500 or more individuals, notice to HHS is due without unreasonable delay and no later than 60 calendar days after discovery. For a breach affecting fewer than 500 individuals, the covered entity may report to HHS annually, no later than 60 days after the end of the calendar year in which the breach was discovered. A breach affecting more than 500 residents of a state or jurisdiction also requires notice to prominent media outlets serving that area. See HHS notification requirements.

If a business associate is involved, it must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery under HIPAA; the business associate agreement may require faster reporting. The covered entity remains responsible for ensuring required individual notices are provided, unless it delegates the task as permitted. Check the agreement and applicable organizational procedures promptly. See HHS guidance on business associate contracts.

How to prevent future fax transmission errors

• Verify unfamiliar or changed fax numbers with the intended recipient using a trusted contact method before sending.
• Use approved, maintained address books or pre-programmed fax numbers, and periodically review them for accuracy.
• Require staff to verify the recipient and number against the refill workflow before transmission; consider a second-person check for higher-risk situations.
• Use a cover sheet that identifies the intended recipient and requests appropriate handling, while avoiding unnecessary PHI on the cover sheet.
• Place fax machines and incoming documents where unauthorized people cannot readily view or collect them, and retrieve received faxes promptly.
• Train staff on fax safeguards and incident reporting, and review misdirected-fax events to address recurring causes.

These steps support reasonable fax transmission safeguards; HHS specifically identifies confirming the correct number and securing fax equipment as examples. In short, stop further exposure, document the facts, assess the risk, meet any applicable notification deadlines, and strengthen the workflow that led to the error. See HHS guidance on fax safeguards.

FAQs

What should you do first after a refill request is faxed to the wrong recipient?

Stop related transmissions and notify your organization’s privacy or security officer promptly. Then contact the unintended recipient through a verified phone number, ask them not to use or disclose the fax, and request secure destruction or return and confirmation of what happened. Preserve the transmission records.

When is a misdirected fax considered a reportable breach?

It may be a reportable breach when it discloses PHI impermissibly and the PHI was unsecured. Such a disclosure is generally presumed to be a breach unless a documented risk assessment demonstrates a low probability of compromise or a HIPAA exception applies. The organization should assess the facts and document its decision.

What factors should a HIPAA risk assessment consider?

Consider the nature and extent of the PHI, who received it, whether the PHI was actually acquired or viewed, and how much the risk was mitigated. Evaluate the factors together and retain the evidence supporting the conclusion.

How soon must affected individuals be notified?

If notification is required, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of the breach. Other reporting requirements may also apply, including notice to HHS and, in certain larger breaches, the media.