What HIPAA expects from a fax
HIPAA does not ban faxing protected health information, and it does not require a cover sheet by name. What the Privacy Rule does require is reasonable safeguards and the minimum necessary disclosure. In practice, a cover sheet with a confidentiality notice is how most covered entities show they took those safeguards, and many compliance policies make one mandatory.
The notice on this template says the fax contains PHI, limits use to the named recipient, forbids redisclosure, and tells an accidental recipient to call and destroy the pages. Edit it if your privacy officer has approved wording of their own.
Filling in the patient and provider fields
Put only what the receiving office needs to match the fax to the right chart. A patient name and date of birth are usually enough; skip diagnoses, Social Security numbers and anything else that would expose more than the routing requires. The provider name and NPI help a referral or prior-authorization team find the order quickly.
If your policy is to keep every identifier off the cover, leave the patient fields blank: the sheet prints empty lines in the Classic and Modern styles, and the Minimal style simply hides them.
Before you press send
- Confirm the fax number against the provider directory or a recent letterhead, not from memory. Misdialed numbers are the most common cause of fax breaches.
- Call ahead for urgent or sensitive records, such as mental health or substance use treatment notes, so someone is waiting at the machine.
- Records covered by 42 CFR Part 2 (substance use treatment) need their own redisclosure notice. Add it to the notice box.
- Tick what you are sending in the Enclosed PHI list and write the total page count, so the recipient can tell if anything is missing.
- Keep the transmission confirmation with the patient's disclosure log.
Sending it
Download the PDF to print and put on top of your records, or attach the records above and choose Fax it now. The cover becomes page one, the number carries over, and the fax is sent over an encrypted connection to our fax provider for $2.99. This page gives general guidance, not legal advice; your organization's privacy policies come first.
Frequently asked questions
Is a fax cover sheet required by HIPAA?
Not by name. HIPAA requires reasonable safeguards and minimum necessary disclosures when PHI is faxed. A cover sheet with a confidentiality notice is the standard way to meet that, and most healthcare compliance policies require one.
Should the patient's name go on a medical fax cover sheet?
Only if the recipient needs it to route the fax. A name and date of birth are common for matching records. Never put a diagnosis, Social Security number or treatment details on the cover; those belong on the pages behind it.
What should a HIPAA confidentiality notice say?
That the fax contains protected health information, that it is intended only for the named recipient, that any other use or redisclosure is prohibited, and that someone who received it in error should call the sender and destroy it. The template includes this wording, and you can edit it.
Can I fax medical records from my computer?
Yes. Fill in the cover sheet here, attach the records as a PDF or photos, and choose Fax it now. The cover is added as page one and the fax is sent for $2.99, with no fax machine or subscription.
