Can I legally fax patient records?
Yes. HIPAA permits covered entities to disclose protected health information for treatment, payment and health care operations, and fax remains one of the most common ways to do it. What matters is the safeguards around the fax: a signed BAA if you use an online service, reasonable steps to reach the right recipient, and the access and audit controls the Security Rule requires.
HIPAA does not ban faxing
There is no rule prohibiting fax. The Privacy Rule permits disclosure of PHI for treatment, payment and health care operations, and healthcare still runs on fax for referrals, prior authorizations, lab results and records requests. The regulation is about how the information is protected, not which technology carries it.
What you need in place first
Before faxing patient records, these are the pieces that matter:
- A signed BAA if you use an online fax service — that provider handles PHI on your behalf and is generally a business associate.
- Minimum necessary — send only the information needed for the purpose of the disclosure. Do not fax an entire chart when one report answers the request.
- Unique user identification — if several staff members send faxes containing PHI, each needs their own login (45 CFR 164.312(a)(2)(i)).
- Audit controls — a record of who sent what and when (45 CFR 164.312(b)).
- A cover sheet with a confidentiality notice — not required by the regulation itself, but standard practice and useful if a fax goes astray.
Misdirected faxes: the real risk
The most common fax incident is not interception — it is a wrong number. A digit typed incorrectly sends a patient record to a stranger. Practical controls:
- Verify the destination number before sending, especially the first time you fax a recipient.
- Use a saved contact list rather than typing numbers from memory.
- Confirm receipt for sensitive disclosures.
- Have a documented procedure for what to do when a fax goes to the wrong number, including your breach assessment process.
- Keep transmission confirmations — they are your evidence of what was sent and where.
Faxing to a patient
Patients have a right of access to their own records, and may request a specific delivery method. If a patient asks you to fax records to a number they provide, you generally must accommodate a reasonable request. Document the request and the number the patient gave you.
What this does not settle
Permission to fax is not the same as compliance. Your organization still needs its own risk analysis, policies, workforce training and documentation under the Security Rule. State law may also impose additional requirements on the release of medical records, and those are separate from HIPAA.
Primary sources.
We link to the original rule and guidance so you can verify anything here yourself.
This content is provided for general informational and educational purposes only and does not constitute legal, regulatory, compliance, or professional advice. HIPAA compliance depends on the specific facts, systems, policies, and practices of each organization. Organizations should consult qualified legal or compliance professionals regarding their specific obligations.
Last reviewed: 2026-07-19. Product features, pricing, and compliance offerings may change. Verify current terms directly with each provider before making a compliance or purchasing decision.
Questions worth asking.
Yes. HIPAA permits disclosure of PHI for treatment, payment and health care operations, and fax is a common channel. The requirements are about safeguards — a BAA with your fax provider, access and audit controls, and reasonable procedures to reach the right recipient.
The regulation does not mandate a specific cover sheet, but a confidentiality notice is standard practice and helps if a fax reaches the wrong recipient. Most fax services provide cover sheet templates.
Treat it as a potential breach and follow your breach notification procedures, which include a risk assessment of the disclosure. Having a documented procedure in place beforehand is part of your administrative safeguards.
Patients have a right of access to their records and may request a particular delivery method. A reasonable request to fax records to a number the patient provides generally must be accommodated. Document the request.
Try it before you decide.
14 days free. No credit card. The BAA is signed in-app before you send a single page — and it stays included at every plan, forever.