Facsimile Transmission of Health Information (Updated)

Background

Providers may choose to fax health information about a patient, for example, when intercampus or regular mail delivery proves too slow. Similarly, hospital transcription and ancillary departments may use fax software to deliver a copy of a dictated report or laboratory result to the physician's office as soon as the report is transcribed or otherwise made available. Although fax equipment and software can enhance the quality of healthcare by facilitating rapid transmission of health information, this same mode of transmission opens up the possibility that information will be misdirected or intercepted by individuals to whom access is not intended or authorized. In recent years, numerous reports have described events wherein patient health records were inadvertently faxed to a wrong location (e.g., bank or retail store) rather than the intended recipient.

Legal and Regulatory Requirements

The HIPAA Privacy Rule permits providers to disclose protected health information to another health care provider for treatment purposes. This can be done by fax or by other means. For example:

• A laboratory may fax, or communicate over the phone, a patient's medical test results to a physician.
• A physician may mail or fax a copy of a patient's medical record to a specialist who intends to treat the patient.
• A hospital may fax a patient's health care instructions to a nursing home to which the patient is to be transferred.

Covered entities must have in place reasonable and appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information that is disclosed using a fax machine. Examples of measures that could be reasonable and appropriate in such a situation include the sender confirming that the fax number to be used is in fact the correct one for the other physician's office for the other physician's office, periodically auditing pre-programmed fax numbers and placing the fax machine in a secure location to prevent unauthorized access to the information.

Under the Privacy Rule, a covered entity may use or disclose protected health information pursuant to a copy of a valid and signed Authorization, including a copy that is received by facsimile or electronically transmitted.¹

Many states have adopted rules based on the Federal Rules of Evidence or Rule 803 of the Uniform Rules of Evidence (URE). The URE recognizes that business records created and relied on in the ordinary course of business possess a circumstantial probability of trustworthiness and are admissible as evidence. According to the URE, "a duplicate is admissible to the same extent as an original unless (1) a genuine question is raised as to the authenticity or continuing effectiveness of the original, or (2) in the circumstances it would be unfair to admit the duplicate in lieu of the original."

A number of states have adopted the Uniform Photographic Copies of Business and Public Records Act, which authorizes the admissibility of reproductions made in the regular course of business without need to account for the original. Some states have adopted the Uniform Business Records as Evidence Act, which also addresses the admissibility of record reproductions.

The Centers for Medicare and Medicaid Services, formerly the Bureau of Policy Development of the Health Care Financing Administration, addressed the subject of transmitting physicians' orders to healthcare facilities via fax machine. In Letter no. 90-25, dated June 1990, the Bureau states:

The use of fax to transmit physicians' orders is permissible. When fax is used, it is not necessary for the prescribing practitioner to countersign the order at a later date. Note, however, that fax copies may fade and may need to be photocopied. Healthcare facilities should be advised to take extra precaution when thermal paper is used to ensure that a legible copy of the physician's order is retained as long as the medical record is retained.

Legislation at the federal and state levels may also affect faxing practices. An amendment to the Federal Rules of Civil Procedure, addressing discovery of electronic records, will be implemented December 1, 2006. It involves the access, use, and preservation of information, data, and records created or maintained in electronic media. How this new e-discovery rule affects faxed documents is not clear at this time.

Recommendations

1. Establish fax policies and procedures based on federal and state laws and regulations and consultation with legal counsel.
2. Include in your organization's notice of information practices uses and disclosures of individually identifiable health information made via fax machine or software where appropriate (see the AHIMA practice brief "Notice of Privacy Practices").
3. Obtain a written authorization for any use or disclosure of individually identifiable health information made via fax machine or software when not otherwise authorized by the individual's consent to treatment, payment, and healthcare operations, or federal or state law or regulation.
4. Take reasonable steps to ensure the fax transmission is sent to the appropriate destination. Pre-program and periodically audit and test destination numbers whenever possible to eliminate errors in transmission from misdialing and outdated fax numbers. Periodically remind those who are frequent recipients of individually identifiable health information to notify you if their fax number is to change (for example, include a reminder in medical staff newsletters or include it as part of the credentialing process, remind transcriptionists who often automatically fax reports to physician offices). Train staff to double check the recipient's fax number before pressing the send key.
5. Provide education and training to workforce members on the organization's fax policies and procedures. Take reasonable operational safeguards to alert staff of faxing procedures. For example, brightly colored stickers may be affixed to fax machines reminding staff of key fax policy issues (e.g., does the information really need to be faxed, is there a cover sheet, verify recipient's fax number, who to call if an incoming fax has been received in error).
6. Require that all fax communications be sent with a cover sheet that contains the sender and recipient's name and contact information, confidentiality disclaimer statement, and instructions of what to do if the document is received in error (see "Sample Confidentiality Notice," below).
7. If a facsimile transmission fails to reach the recipient, check the internal logging system of the facsimile machine to obtain the number to which the transmission was sent. If the sender becomes aware that a fax was misdirected, contact the receiver and ask that the material be returned or destroyed. Investigate misdirected faxes as a risk management occurrence or security incident; include the accidental disclosure of patient health information in the accounting of disclosures log. Mitigate the accidental disclosure and determine the need to contact the patient, organization's legal counsel, and risk management carrier.
8. Place fax machines in secure areas.
9. Establish guidelines to address retention of information transmitted via facsimile and whether it should become part of the patient's health record (e.g., is the document part of a designated record set or a business record?).
10. Take precautions to preserve the quality of faxed documents. Fax copies may fade and may need to be photocopied. Extra precautions are necessary when thermal paper is used to ensure legible copies are retained as long as the medical record is retained.

Prepared by:

This practice brief was originally prepared in 1996 by Mary D. Brandt, MBA, RHIA, CHE, and was previously updated in 2001 by Gwen Hughes, RHIA.

Acknowledgments

Note

References

Hughes, Gwen. "Notice of Privacy Practices." AHIMA practice brief. 2002. Available online in the FORE Library: HIM Body of Knowledge at www.ahima.org.

Letter No. 90-25. Bureau of Policy Development, Health Care Financing Administration, June 1990. In Tomes, Jonathan P., Healthcare Records Management, Disclosure and Retention: The Complete Legal Guide. Chicago, IL: Probus Publishing Company, 1993.