Facsimile Transmission of Health Information (Updated) Editor’s note: The following information supplants information contained in the June 2001 practice brief “Facsimile Transmission of Health Information (Updated).”

Facsimile Transmission of Health Information (Updated) Editor’s note: The following information supplants information contained in the June 2001 practice brief “Facsimile Transmission of Health Information (Updated).”

Background

The quality of healthcare is enhanced when patient health information is readily available to healthcare providers. Even in an increasing electronic environment, use of facsimile (fax) machines and fax software remains commonplace. Fax machines scan a document and convert the text to electronic impulses that are then transmitted over telephone lines. The receiving fax converts the electronic impulses back to text.

Providers may choose to fax health information about a patient, for example, when intercampus or regular mail delivery proves too slow. Similarly, hospital transcription and ancillary departments may use fax software to deliver a copy of a dictated report or laboratory result to the physician’s office as soon as the report is transcribed or otherwise made available. Although fax equipment and software can enhance the quality of healthcare by facilitating rapid transmission of health information, this same mode of transmission opens up the possibility that information will be misdirected or intercepted by individuals to whom access is not intended or authorized. In recent years, numerous reports have described events wherein patient health records were inadvertently faxed to a wrong location (e.g., bank or retail store) rather than the intended recipient.

Legal and Regulatory Requirements

Most federal regulatory requirements such as HIPAA, the Medicare Conditions of Participation, and the Confidentiality of Substance Abuse Patient Records do not specifically address the use of fax equipment or copies. However, the Department of Health and Human Services addresses fax use in a limited manner through the following HIPAA guidance: The HIPAA Privacy Rule permits providers to disclose protected health information to another health care provider for treatment purposes. This can be done by fax or by other means. For example:

• A laboratory may fax, or communicate over the phone, a patient’s medical test results to a physician.

• A physician may mail or fax a copy of a patient’s medical record to a specialist who intends to treat the patient.

• A hospital may fax a patient’s health care instructions to a nursing home to which the

patient is to be transferred.

Covered entities must have in place reasonable and appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information that is disclosed using a fax machine. Examples of measures that could be reasonable and appropriate in such a situation include the sender confirming that the fax number to be used is in fact the correct one for the other physician’s office for the other physician’s office, periodically auditing pre-programmed fax numbers and placing the fax machine in a secure location to prevent unauthorized access to the information.

Under the Privacy Rule, a covered entity may use or disclose protected health information pursuant to a copy of a valid and signed Authorization, including a copy that is received by facsimile or electronically transmitted.1

State laws vary and may address the use of fax equipment in licensing or health information laws or regulations, or possibly those related to specific types of diseases, such as sexually transmitted disease or mental health problems.

Many states have adopted rules based on the Federal Rules of Evidence or Rule 803 of the Uniform Rules of Evidence (URE). The URE recognizes that business records created and relied on in the ordinary course of business possess a circumstantial probability of trustworthiness and are admissible as evidence. According to the URE, “a duplicate is admissible to the same extent as an original unless (1) a genuine question is raised as to the authenticity or continuing effectiveness of the original, or (2) in the circumstances it would be unfair to admit the duplicate in lieu of the original.”

A number of states have adopted the Uniform Photographic Copies of Business and Public Records Act, which authorizes the admissibility of reproductions made in the regular course of business without need to account for the original. Some states have adopted the Uniform Business Records as Evidence Act, which also addresses the admissibility of record reproductions.

The Centers for Medicare and Medicaid Services, formerly the Bureau of Policy Development of the Health Care Financing Administration, addressed the subject of transmitting physicians’ orders to healthcare facilities via fax machine. In Letter no. 90-25, dated June 1990, the Bureau states:

The use of fax to transmit physicians’ orders is permissible. When fax is used, it is not necessary for the prescribing practitioner to countersign the order at a later date. Note, however, that fax copies may fade and may need to be photocopied. Healthcare facilities should be advised to take extra precaution when thermal paper is used to ensure that a legible copy of the physician’s order is retained as long as the medical record is retained.

Legislation at the federal and state levels may also affect faxing practices. An amendment to the Federal Rules of Civil Procedure, addressing discovery of electronic records, will be implemented December 1, 2006. It involves the access, use, and preservation of

information, data, and records created or maintained in electronic media. How this new e- discovery rule affects faxed documents is not clear at this time.

Recommendations

1. Establish fax policies and procedures based on federal and state laws and regulations and consultation with legal counsel.

2. Include in your organization’s notice of information practices uses and disclosures of individually identifiable health information made via fax machine or software where appropriate (see the AHIMA practice brief “Notice of Privacy Practices”).

3. Obtain a written authorization for any use or disclosure of individually identifiable health information made via fax machine or software when not otherwise authorized by the individual’s consent to treatment, payment, and healthcare operations, or federal or state law or regulation.

4. Take reasonable steps to ensure the fax transmission is sent to the appropriate destination. Pre-program and periodically audit and test destination numbers whenever possible to eliminate errors in transmission from misdialing and outdated fax numbers. Periodically remind those who are frequent recipients of individually identifiable health information to notify you if their fax number is to change (for example, include a reminder in medical staff newsletters or include it as part of the credentialing process, remind transcriptionists who often automatically fax reports to physician offices). Train staff to double check the recipient’s fax number before pressing the send key.

5. Provide education and training to workforce members on the organization’s fax policies and procedures. Take reasonable operational safeguards to alert staff of faxing procedures. For example, brightly colored stickers may be affixed to fax machines reminding staff of key fax policy issues (e.g., does the information really need to be faxed, is there a cover sheet, verify recipient’s fax number, who to call if an incoming fax has been received in error).

6. Require that all fax communications be sent with a cover sheet that contains the sender and recipient’s name and contact information, confidentiality disclaimer statement, and instructions of what to do if the document is received in error (see “Sample Confidentiality Notice,” below).

7. If a facsimile transmission fails to reach the recipient, check the internal logging system of the facsimile machine to obtain the number to which the transmission was sent. If the sender becomes aware that a fax was misdirected, contact the receiver and ask that the material be returned or destroyed. Investigate misdirected faxes as a risk management occurrence or security incident; include the accidental disclosure of patient health information in the accounting of disclosures log. Mitigate the accidental disclosure and determine the need to contact the patient, organization’s legal counsel, and risk management carrier.

8. Place fax machines in secure areas. 9. Establish guidelines to address retention of information transmitted via facsimile and

whether it should become part of the patient’s health record (e.g., is the document part of a designated record set or a business record?).

10. Take precautions to preserve the quality of faxed documents. Fax copies may fade

and may need to be photocopied. Extra precautions are necessary when thermal paper is used to ensure legible copies are retained as long as the medical record is retained.

Sample Confidentiality Notice

The documents accompanying this fax transmission contain health information that is legally privileged. This information is intended only for the use of the individual or entity named above. The authorized recipient of this information is prohibited from disclosing this information to any other party unless required to do so by law or regulation and is required to destroy the information after its stated need has been fulfilled.

If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or action taken in reliance on the contents of these documents is strictly prohibited. If you have received this information in error, please notify the sender and the privacy officer immediately and arrange for the return or destruction of these documents.

Prepared by:

Alicia Blevins, RHIA, CHP Nancy Davis, MS, RHIA Beth Hjort, RHIA, CHPS Chrisann Lemery, MS, RHIA Wendy Mangin, MS, RHIA Debra Mikels Cindy Nicholas, RHIA, CHP

This practice brief was originally prepared in 1996 by Mary D. Brandt, MBA, RHIA, CHE, and was previously updated in 2001 by Gwen Hughes, RHIA.

Acknowledgments

AHIMA’s Privacy and Security Practice Council Lydia Washington, MS, RHIA, CPHIMS Jill Callahan Dennis, JD, RHIA Cheryl Smith, BS, RHIT, CPHQ

Note

1. Department of Health and Human Services. “Health Information Privacy and Civil Rights Questions & Answers.” Privacy of Health Information/HIPAA, Answer IDs 482, 356, and 475. Available online at http://healthprivacy.answers.hhs.gov/cgi- bin/hipaa.cfg/php/enduser/std_alp.php.

References

AHIMA. “Facsimile Transmission of Health Information Position Statement.” May 1994.

Hughes, Gwen. “Notice of Privacy Practices.” AHIMA practice brief. 2002. Available online in the FORE Library: HIM Body of Knowledge at www.ahima.org.

Letter No. 90-25. Bureau of Policy Development, Health Care Financing Administration, June 1990. In Tomes, Jonathan P., Healthcare Records Management, Disclosure and Retention: The Complete Legal Guide. Chicago, IL: Probus Publishing Company, 1993.

Article citation: Davis, Nancy, et al.. “Facsimile Transmission of Health Information.” (AHIMA Practice Brief, updated August 2006).

Copyright ©2006 American Health Information Management Association. All rights reserved. All contents, including images and graphics, on this Web site are copyrighted by AHIMA unless otherwise noted. You must obtain permission to reproduce any information, graphics, or images from this site. You do not need to obtain permission to cite, reference, or briefly quote this material as long as proper citation of the source of the information is made. Please contact Publications at permissions@ahima.org to obtain permission. Please include the title and URL of the content you wish to reprint in your request.