LetterAgent
Mail physical letters by just asking your AI assistant.
Home > Guides > Fax audit trails and HIPAA
A fax audit trail is the record of who sent what to whom and when: date and time, sender and recipient fax numbers, page count, transmission result, and the user account that sent it. HIPAA never uses the words "fax audit trail", but its audit controls call for mechanisms that record access to electronic protected health information, and a fax log is how most practices meet that for faxed records.
| What a useful audit trail captures | Why it matters |
|---|---|
| Date, time, and time zone of the transmission | Pins down exactly when protected information left your control |
| Sending and receiving fax numbers | Shows the intended recipient; a wrong number here is how misdirected faxes get spotted |
| Page count and transmission result (OK, NG, partial) | Proves the whole document went, not just the first page |
| Which user or account sent it | Needed when several staff share one fax machine or one online fax login |
| Patient or case identifier the fax relates to | Lets you answer "who received this patient's records?" during an audit or breach review |
| Confirmation page retained with the record | The contemporaneous proof that the send happened and completed |
This is general information, not legal advice.
The HIPAA Security Rule's audit controls are an "addressable" implementation specification, which does not mean optional: it means you implement them in a way that fits your environment. The standard asks for hardware, software, and procedural mechanisms that record and examine activity in systems containing electronic protected health information. For a practice that faxes records, the fax transmission log plus confirmation pages is the practical mechanism. An auditor asking "show me every fax that carried this patient's records" expects an answer, and a pile of confirmation pages in a drawer is a much weaker answer than a searchable log.
The weak points are almost always the same. A shared office fax machine with no user logins records the numbers but not who sent each fax. Confirmation pages get thrown away or fade (old thermal confirmations become blank paper within a couple of years). Staff refax a document and the log shows two sends with no note about why, which looks sloppy in a review. Online fax services fix the first two problems automatically: every send is tied to a user account and logged centrally, and confirmations are PDFs that do not fade. The refax note still needs a human.
HIPAA's documentation rule sets a six-year retention period for the policies and records the Security Rule requires, and most practices apply the same window to transmission logs and confirmations. That is a federal floor, not a ceiling: state medical-record laws sometimes run longer, and malpractice carriers may ask for more. The practical rule is to keep fax logs as long as you keep the patient records they document, and to store them where an auditor can actually find them, which usually means the same records system as the charts, not a binder in the supply room.
Yes, and this is where the audit trail pays for itself. A fax sent to the wrong number is a disclosure of protected information, and whether it counts as a reportable breach depends on the facts, including whether the recipient was authorized and whether the information was returned or destroyed. The audit trail is what lets you answer the follow-up questions: when was it sent, to which number, what was in it, and who caught the error. Without that log, you are reconstructing events from memory weeks later.
LetterAgent's fax service is in testing with US and Canadian fax numbers only, and no inbound faxes. A per-fax quote with the page count verified, your approval of the exact total, and a one-time payment is the flow. If you are a covered entity, check with your compliance officer before using any new fax channel: HIPAA generally requires a business associate agreement with vendors that handle protected information on your behalf, and that paperwork comes before the first fax, not after.
Ready to fax it? Fax with LetterAgent: describe it to your AI assistant, approve the exact quoted price, and it is sent.
LetterAgent is a working name. Prices include print, postage, and our service fee. US prices in USD, Canadian prices in CAD (Canadian prices exclude applicable sales tax, added at checkout). Currently in private testing.
Need help? Ask your assistant: it can check a job's status any time. If it ever can't handle something: hello@getletteragent.com