LetterAgent
Mail physical letters by just asking your AI assistant.
Home > Guides > Misdirected medical faxes
A fax of patient records to the wrong number is an impermissible disclosure of protected health information, and it triggers a formal breach risk analysis. Whether it counts as a notifiable breach depends on who received it, whether the records were retrieved or destroyed, and what was disclosed. When in doubt, organizations document the analysis and notify. This is general information, not legal advice.
HIPAA treats a disclosure as a disclosure: there is no "it was an accident" carve-out for sending protected health information to the wrong recipient. The moment records land on a fax machine or server that does not belong to the intended recipient, an unauthorized party has access to the patient's information. Misdialed faxes are one of the classic causes of healthcare privacy incidents, and they show up in enforcement commentary precisely because the error is so ordinary. The question after a misdirected fax is never "did we mean it," it is "what happened to the information next."
Once an impermissible disclosure happens, the organization performs a risk assessment across four factors: the nature and extent of the information (a one-page referral with a name is different from a full chart with a diagnosis and Social Security number), the identity of the unauthorized recipient, whether the information was actually acquired or viewed, and how far the risk of compromise has been reduced (for example, the recipient confirmed in writing that they shredded it). All four are weighed together; no single factor decides alone. If the assessment does not demonstrate a low probability of compromise, the incident is a breach, and the notification duties kick in.
| Scenario | Risk picture | Typical outcome |
|---|---|---|
| Fax went to another covered clinic that shredded it and confirmed in writing | Low: professional recipient, destroyed unread | Often no patient notification, but document the analysis |
| Fax went to an unknown number, no confirmation of destruction | High: recipient unknown, pages unaccounted for | Breach, with patient and sometimes HHS notification |
| Fax contained only a name and appointment time | Lower: minimal information exposed | Depends on the rest of the analysis; document it |
| Fax contained a full record with diagnoses and identifiers | High: sensitive clinical information exposed | Breach almost certainly, notify accordingly |
Speed helps, because retrieval matters to the analysis. Call the wrong number immediately, explain that a confidential medical fax arrived by mistake, and ask the recipient to confirm in writing that the pages were destroyed unread and not copied. Document everything: the number dialed, the correct number, the pages sent, the time, who was contacted, and what they confirmed. If the organization concludes it was a breach, affected patients must be notified without unreasonable delay (within 60 days), and larger breaches trigger notifications to the Department of Health and Human Services and sometimes local media. Then fix the process: pre-programmed numbers, cover sheets that name the intended recipient, and a habit of confirming the number before hitting send.
Yes, with a different name. In Canada, health privacy is governed provincially (Ontario's Personal Health Information Protection Act, for example), and a misdirected fax of patient records is treated as a privacy breach under the same logic: unauthorized disclosure triggers a duty to assess, contain, and in many cases notify. The practical response is identical on both sides of the border: contain it fast, get written confirmation of destruction, and document the analysis. Patients in either country who receive someone else's records by fax should not read further than necessary, should not copy them, and should notify the sender.
Ready to fax it? Fax with LetterAgent: describe it to your AI assistant, approve the exact quoted price, and it is sent.
LetterAgent is a working name. Prices include print, postage, and our service fee. US prices in USD, Canadian prices in CAD (Canadian prices exclude applicable sales tax, added at checkout). Currently in private testing.
Need help? Ask your assistant: it can check a job's status any time. If it ever can't handle something: hello@getletteragent.com