Security of Faxed, Printed, and Copied Documents Containing Protected Health Information

Layout for printing
Policy Number:
UW-128
Old Policy Number:
8.5
Responsible Office:
Office of Compliance

University Policy

Rationale/​Purpose:

In enacting HIPAA, Congress mandated the establishment of federal standards for the privacy of individually identifiable health information. Under the patchwork of laws existing prior to adoption of HIPAA and the Privacy Rule, personal health information could be distributed—without either notice or authorization—for reasons that had nothing to do with a patient's medical treatment or health care reimbursement. For example, unless otherwise forbidden by state or local law, without the Privacy Rule patient information held by a health plan could, without the patient’s permission, be passed on to a lender who could then deny the patient's application for a home mortgage or a credit card, or to an employer who could use it in personnel decisions. The Privacy Rule establishes a federal floor of safeguards to protect the confidentiality of medical information. State laws that provide stronger privacy protections apply over and above the federal privacy standards.

Definitions:
Business associate
A person or entity not affiliated with UW–Madison that performs or assists in performing, for or on behalf of any unit in the UW–Madison health care component (UW HCC), business support functions/services that involve the use of protected health information (PHI).
Protected health information (PHI)
Health information, or healthcare payment information, including demographic information, which identifies the individual or can be used to identify the individual. Protected health information does not include student records held by educational institutions or employment records held by employers. 
UW–Madison health care component (UW HCC)
Those units of UW–Madison that have been designated by the university as part of its health care component under HIPAA. See UW-100 Designation of UW–Madison Health Care Component for a listing of these units.
Scope:

Applies to all members of the UW HCC.

Policy:

Policy Summary

UW–Madison maintains and transmits patient information in a protected and secure manner. Protected health information must be sent in the most secure manner, consistent with the urgency of the information.

This policy establishes requirements and guidelines for safeguarding paper documents containing protected health information generated and/or transmitted by facsimile (“fax”) machines, printers, and copiers, internal to UW–Madison and at copy pickup/drop-off locations, in compliance with federal and state regulations and statutes.

Policy Details

  1. Faxing PHI

    1. Faxing of protected health information should be limited to urgent patient care and treatment purposes whenever possible.
    2. Staff members faxing patient information should take reasonable steps to ensure that the fax transmission is sent to the appropriate destination. When taking a request for information to be faxed, staff should obtain the following information:
      1. Name, date of birth of the patient, medical record number (if possible)
      2. Information requested
      3. Reason for request (e.g., continued care)
      4. Fax number of requesting party
      5. Phone number of requesting party
    3. Staff members should always double-check the recipient’s fax number before pressing the “send” key. When using preprogrammed receiving fax numbers, the numbers should be tested immediately after the first programming to determine accuracy.
    4. Whenever possible, documents containing protected health information should be accompanied by a separate phone call from the sender, alerting the receiving person of their arrival.
    5. A fax cover sheet that includes a confidentiality statement shall be used as a cover page when faxing patient information (see attached sample). The cover sheet should be filled out completely with the name and department of the sender clearly indicated as well as a description of what was sent.
    6. Information and documents that have been faxed “out” should be gathered immediately after faxing and routed to the appropriate location or destroyed in a confidential manner.
    7. Parties receiving faxes from a unit of the UW HCC on a regular or routine basis should be periodically reminded to notify the UW HCC unit if their fax numbers change.
    8. If a fax is transmitted in error, contact the person who received the fax to verify the destruction of the fax. Report the possible breach as specified in UW-131 Notification and Reporting in the Case of Breach of Unsecured Protected Health Information.

  2. Physical Security and Location of Equipment

    1. Fax Machines and Printers.
      1. Fax machines and printers that routinely receive transmissions of protected patient health information shall be placed in secure, non-public areas. Public areas inappropriate for the location of such equipment include, but are not limited to, primary hallways, waiting rooms, multi-use and conference rooms, and elevator lobbies.
      2. Special consideration should be given to fax machines and printers that receive paper output containing protected health information outside of regular business hours (e.g., printers running overnight batch print jobs). This equipment should be located inside a room that is routinely locked outside of regular business hours.
      3. Semi-public areas are acceptable locations for printers and fax machines if patients and visitors are accompanied by staff in those locations. Semi-public areas may include, but are not limited to, clinic hallways and work areas where patients are escorted by staff, administrative buildings which have little or no patient traffic, and private office space that is enclosed but not behind locked doors.

    2. Copy Machines and Copy Service Pick-Up/Drop-Off Locations

      1. Copy machines may be located in areas that are not appropriate for printers and fax machines because a human operator must be present to create an output containing protected health information on a copy machine, unlike a fax or printer. However, some copy machines now have both fax and print capabilities. In that case, the copy machine should be located and secured as described in II. above. Copy machines should be attended during the copying of protected health information.
      2. Contracted copy services may be used to copy protected health information if the copy originals are secured in transit to and from the copy service location by placing copy originals in a sealed container. Sealed containers containing protected health information may be left with appropriate employees of the copy service pickup/drop-off location, and staff should verify that the copy service will deliver the finished copies to the delivery location in a sealed container.
      3.  Prior to using a contracted provider for copy service, a business associate agreement must be executed with the copy service and staff must be reasonably certain that the copy service can comply with the terms of the agreement (See UW-116 Managing Arrangements with Business Associates of the University of Wisconsin–Madison).

  3. Procedures for Retrieval of Printed or Faxed Documents

    1. Staff should remove output from printers, fax machines, and copiers as soon as possible to avoid unauthorized persons from gaining access to the materials.
    2. Staff should verify the total number of pages as identified on the fax cover sheet and take care to accurately route the contents.
    3. If the fax transmission is illegible, incomplete, or received in error, the sender should be notified immediately. Documents received in error should be immediately destroyed in a confidential manner.
    4. Fax transmissions of protected patient health information should be immediately routed to the intended receiver or the patient’s record.

  4. Use of Courier Services, U.S. Postal Service, and Campus Mail to Send PHI

    Documents sent in response to routine requests for protected health information should be sent via secure courier, U.S. Postal Service, or another reliable delivery service.

    Campus mail may be used to send protected health information only if the envelope/package containing the information is sealed as though it is going into the U.S. mail and if the envelope/package is labeled with a warning that the letter/package is confidential and can only be opened by the addressee. Note that most inter-departmental mail envelopes are not appropriate containers because they do not include tamper-evident seals.

Consequences for Noncompliance

Failing to comply with this policy may result in discipline for the individual(s) responsible for such noncompliance.

Further, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy and Security Rules, and an individual’s noncompliance may result in institutional noncompliance and/or an investigation by OCR. OCR attempts to resolve investigations by obtaining voluntary compliance and entering into corrective action plans and resolution agreements. Failure to comply with HIPAA or cooperate with OCR in an investigation may result in civil and/or criminal penalties.

Related UW-Madison Policies:
Related UW–Madison Documents, Web Pages, or Other Resources:

Additional information may be found at www.compliance.wisc.edu/hipaa

External References:

Policy Administration

Approval Authority:
Vice Chancellor for Legal Affairs
Policy Manager:
HIPAA Privacy Officer
Contact:
HIPAA Privacy Officer -- Jack Talaska, JACK.TALASKA@WISC.EDU, (608) 265-4077
Effective Date:
04-14-2003
Revised Dates:

08-21-2014: Effective date of the revised policy: 08-21-2014.
03-26-2020: Effective date of the revised policy: 03-26-2020.

Retrieved:
01-20-2025 22:27:24