HIPAA fax checklist

Faxera handles the technical safeguards: encryption, access control, the audit log and the BAA. This checklist covers the part that stays with your office. It is general guidance, not legal advice.

Before you fax

• Sign a BAA with your fax provider. Any service that stores or transmits patient records for you needs one. With Faxera it's signed at signup on every plan.
• Send only what's needed. Fax the minimum information the recipient needs for the purpose, not the whole chart.
• Use a cover sheet with a confidentiality notice and a number to call if the fax reaches the wrong place.
• Check the number twice. Save the numbers you fax often, such as labs, pharmacies and referring offices, so nobody retypes them.
• Confirm new recipients by phone before sending sensitive records to a number for the first time.

Who can see faxes

• Give each person their own sign-in. No shared logins.
• Turn on multi-factor sign-in for everyone, not just admins.
• Limit mailboxes by role. Billing doesn't need the clinical inbox.
• Remove access the day someone leaves.
• Keep the fax machine out of public view if you still use one, and collect printed faxes promptly.

Receiving and keeping records

• Deliver by secure link, not email attachment. Attachments sit in inboxes and get forwarded. Secure links require sign-in.
• Set a retention period that matches your records policy, then let old faxes expire on schedule.
• Review the audit log monthly. Look for downloads or sign-ins you don't recognize.

When something goes wrong

• Have a plan for misdirected faxes. Call the recipient, ask them to destroy it, document what was sent and to whom, and decide with your privacy officer whether it is a reportable breach.
• Train staff once a year on these habits, and keep a record that you did.

Where Faxera helps

Questions? Email [email protected]. For the technical side, read the security overview.