Why HIPAA practices fax instead of emailing PHI

What HIPAA actually requires

HIPAA does not ban email and does not require fax. The Privacy Rule limits how PHI is used and disclosed, and the Security Rule requires covered entities and business associates to protect electronic PHI with administrative, physical and technical safeguards, such as access controls, audit controls and transmission security.

HHS guidance allows providers to email patients who ask for it, after warning them of the risks. The hard part is applying the same safeguards to every email, every attachment and every staff mailbox, every day.

The minimum necessary standard also applies: whatever channel you use, send only the PHI the recipient needs for the purpose, not the whole chart by default.

Why fax remains the standard between providers

Hospitals, labs, pharmacies, payers and specialists all publish fax numbers for orders, referrals, prior authorizations and records requests. A fax goes to a known office line instead of an individual's inbox, and it does not depend on the receiver's email setup. That makes it a predictable channel, which is why many practice policies name fax as the default for sending PHI to other providers.

Fax is also familiar to every front desk, so new staff can follow a written procedure without learning a new secure messaging tool for each partner.

Putting it into your policy

1. Name fax as the default channel for sending PHI to other providers.
2. Sign a BAA with your fax service before sending any PHI.
3. Keep a verified directory of the fax numbers you send to most often.
4. Use a cover page with a confidentiality notice on every fax.
5. Review the audit log regularly and set retention rules that match your records policy.