HHS has never told healthcare to stop faxing. Its guidance says the Privacy Rule permits physicians to disclose PHI to another provider by fax for treatment, as long as reasonable and appropriate safeguards are in place.

Take two identical referral forms sent the same morning. One moves through an encrypted, logged channel covered by a signed business associate agreement (BAA), and OCR software indexes it into the chart. The other sits in an output tray in a shared hallway. Same document, same law, two very different compliance positions.

HIPAA regulates the safeguards around a fax

Does a fax need to be HIPAA compliant? For a covered entity or business associate sending protected health information, yes. But a fax machine, an app or a cloud service can’t be compliant on an organization’s behalf.…