Despite years of predictions, fax remains a daily workhorse in healthcare. Physician orders, referrals, lab results and pharmacy communications still arrive by fax in many facilities. That means protected health information is flowing through fax servers, multifunction copiers, scanners and email gateways, often without the same scrutiny given to the EHR.
This article walks through where fax-related risk hides and how to reduce it.
Physical fax machines: paper trays where documents sit for hours
Multifunction copiers: many store images of scanned and faxed pages on internal drives
Fax-to-email gateways: deliver documents to inboxes, where they are forwarded, saved and sometimes lost
Online fax services: store messages and logs in the provider's cloud
Shared folders: scan-to-folder destinations that may be open to many staff
Backups: which copy all of the above
A mistyped number can send resident information to the wrong recipient. This is one of the most common privacy incidents and may require a breach risk assessment.
Incoming faxes left on a machine in a public hallway or front office can be read by visitors or unauthorized staff.
Some copiers keep images of everything they process. When a leased machine is returned or replaced without wiping, those images can leave with it.
Fax-to-email sent over unencrypted channels or to shared mailboxes with broad access can expose PHI.
Copiers and scanners ship with default administrator passwords and open services. Attackers scan for them.
Place fax machines and copiers in controlled areas, not public spaces
Collect and file incoming faxes promptly, with an assigned person responsible
Change default administrator passwords and disable unneeded features
Update device firmware
Put multifunction devices in a separate network segment where possible
Ask your vendor whether the device stores images, and enable encryption and automatic overwrite if available
Include secure wiping or drive removal in lease return and disposal procedures
Obtain a certificate of destruction when equipment is retired
Use pre-programmed numbers for frequent recipients, and verify them regularly
Use a cover sheet with a confidentiality statement and the sender's contact details
For first-time recipients, call to confirm the number
Consider confirmation reports so unusual failures are noticed
If you move to an eFax or cloud fax solution, evaluate:
Willingness to sign a business associate agreement
Encryption in transit and at rest
Individual user accounts with multi-factor authentication
Role-based access to inboxes, so only the right staff see certain faxes
Audit logs of who viewed, sent or deleted documents
Retention settings that match your policies
Integration options for your EHR or document management system
Scan-to-email and scan-to-folder should use authenticated, encrypted connections and send only to designated, protected locations. Avoid scanning to a folder that everyone can open.
Write a short procedure covering how faxes are received, who checks the machine, how misdirected faxes are handled and who to notify. Train staff on verifying numbers, using cover sheets and reporting errors immediately. Misdirected fax incidents should be logged and evaluated through your breach assessment process.
Moving to a secure eFax platform can reduce paper exposure, make faxes searchable and give you audit trails. It also helps with disaster scenarios, since faxes can be received even if the building is inaccessible. Transition carefully, and keep the same attention to access control.
Once a year, walk through the building with a technician and list every fax machine, copier and scanner. Check who can reach each one, whether it stores images, what its administrator password is and where its scans are sent. This simple walk-through often finds forgotten devices, open folders and old contracts that need cleanup.
UnityCare IT provides eFax solutions and managed IT for healthcare organizations. If you are not sure what your copiers store or who can open your scan folders, we can review your fax and scanning workflow and recommend practical fixes.
Call or text: 405-285-3845
New customers: start@unitycareit.com
Existing customers: support@unitycareit.com
Address: 2524 N Broadway Ste 554 PMB 947974, Edmond, Oklahoma 73034