Updated
What HHS says about faxing health information
HHS answers questions about faxing in its HIPAA FAQs, and its Office for Civil Rights enforces HIPAA's privacy and security rules. These are the points that matter for a cover sheet.
- A doctor's office may fax a patient's information to another provider for treatment.
- The office must have reasonable safeguards to protect the information.
- HHS's examples of safeguards are about the number and the machine. Confirm the fax number is right, keep the fax machine in a secure place, and pre-program numbers you use often.
- HIPAA doesn't require removing every risk of an incidental disclosure, HHS says. It requires reasonable safeguards to limit it. In our reading, a fax sent to a wrong number isn't that kind of incidental slip, so checking the number matters most.
None of these FAQs mentions a cover sheet or a confidentiality notice.
Why offices use a cover sheet anyway
A cover sheet with a confidentiality notice is a simple safeguard, and some organizations require one. Texas Health and Human Services, for example, gives its staff a fax transmittal form with a confidentiality notice for faxing a person's health information. It's Form 1131, dated January 2004 on its page. That's one agency's rule for its own staff, not a federal requirement, so check what your practice, hospital or the office you're faxing expects.
What to put on a medical fax cover sheet
- The office or person it's for and their fax number, plus your name and a phone number they can call.
- The date and the total number of pages, counting the cover sheet.
- What it is, such as a records request, a referral, lab results or a prior authorization. The medical design has a box for each.
- Just enough to match the pages to the patient, usually the name and date of birth, or a record number.
- A confidentiality notice. The medical design prints one, and the confidential cover sheet page has other wordings.
The medical records request example shows these filled in. If your office also faxes insurance claims or school forms, our fax cover sheets by use have a design for each, starting with the medical one.
Before you send
- Confirm the fax number with the recipient, especially if you don't fax them often.
- Take out any pages the recipient didn't ask for.
- Check the confirmation report to see that it arrived, or call if it's urgent.
This page explains what HHS's public guidance says. It isn't legal advice. Your practice's privacy officer or compliance team decides what your office needs.
Questions
Is there an official HIPAA fax cover sheet?
We found no HHS fax cover sheet for HIPAA, and the HHS fax guidance we read doesn't mention one. HHS also says it does not recognize private "certifications" of Security Rule compliance, so be wary of any template sold as certified. A cover sheet with a confidentiality notice is one safeguard some offices use, alongside checking the fax number.
Does HIPAA require a fax cover sheet?
The HHS guidance on faxing that we read does not list a cover sheet. It asks for reasonable safeguards and gives examples such as confirming the fax number and keeping the machine in a secure place. Your practice or organization may still require one, so check its policy.
Can a doctor's office fax medical records?
Yes. HHS says a provider may fax health information to another provider for treatment, as long as it uses reasonable safeguards.
What should a medical fax cover sheet not include?
Leave off diagnoses, test results and other health details. Include only what the recipient needs to find the right patient, since anyone near the machine sees the cover sheet first. HHS's minimum necessary standard asks covered entities to share only the health information a purpose needs. It doesn't apply to disclosures between providers for treatment.
iPhone is a trademark of Apple Inc., registered in the U.S. and other countries. App Store is a service mark of Apple Inc., registered in the U.S. and other countries. FaxFair is not affiliated with Apple. Other names are trademarks of their owners. FaxFair is not affiliated with them.