4.1.E HIPAA/Privacy: General Rules - Faxing PHI Policy

  • PURPOSE:

    To establish policy and procedure for transmission of PHI via facsimile (fax) or other means of electronic transfer, to comply with HIPAA and its accompanying regulations, and to protect the confidentiality and integrity of PHI as required by State and Federal law, professional ethics and accreditation agencies.

    POLICY/PROCEDURE:

    All LHCC personnel are expected to strictly observe the following policies relating to faxing PHI:

    • Unless otherwise arranged through through LHCC legal counsel, release of PHI in any media, including fax, may be performed only as allowed by LHCC personnel. No one is permitted access to the medical record of any patient without a legitimate, LHCC-related reason for doing so.
    • Qualified personnel may send PHI by fax when:
      • the original record or mail-delivered copies will not meet the immediate needs of patient care; or
      • when PHI is urgently required by a third-party payor and failure to fax the records could result in loss of reimbursement.
    • Except as authorized by law or in the event of a medical emergency, or as otherwise permitted by law, a properly completed and signed (by the patient or the patient’s legally authorized representative) authorization must be obtained before releasing PHI. If fax is being sent for purposes of payment (including third-party reimbursement), patient care or medical treatment purposes, the patient’s signed consent provided at registration serves as authorization.
    • LHCC personnel shall limit the information transmitted to the minimum amount reasonably necessary to meet the requester’s needs or to accomplish the purpose for which the request is made.
    • LHCC personnel MAY NOT send by fax, especially sensitive medical information, including, but not limited to, AIDS/HIV information, mental health, and developmental disability information, alcohol and drug abuse information, or other abuse information, and other sexually transmissible disease information without separate specific written authorization by the patient or legally authorized representative.
    • All releases of PHI shall be documented in the medical and/or financial record. Documentation shall include the date of the release, what information was released, to whom the information was released, the purpose for the release, and how the release was carried out.
    • The cover page accompanying the fax transmission must include, at a minimum, the confidentiality notice below:
      • Confidentiality Notice: The information contained in this email message is privileged & confidential information & intended only for the use of the individual or entity named in the address. If you are not the intended recipient, you are hereby notified that any dissemination, distribution, or copying of this information is strictly prohibited. If you received this information in error, please notify the sender & delete this information from your computer & retain no copies of any of this information.
    • LHCC personnel must make reasonable efforts to sent the fax transmission to the correct destination.
    • Fax machines must be in a secure area.
    • Each office/department is responsible for the proper handling of incoming faxes and faxes are not left sitting on or near the machine, but rather shall be distributed to the proper recipient expeditiously while protecting confidentiality during distribution.

    Revised 12/2013

  • Date Format: MM slash DD slash YYYY