When a misdirected medical fax reaches you, do not forward it, file it or read further than needed to identify the sender. Keep the pages secure, contact the sending office to tell them what arrived, and follow their instructions to return or destroy it. Whether it counts as a reportable breach is the sender's assessment to make.
First steps after receiving a misdirected medical fax
The first steps after receiving a misdirected medical fax are to stop, secure the pages and tell the sender. A misdirected fax is one that carries another organization's patient information to the wrong number. The receiving office's job is to limit who sees it and give the sender what they need to assess it.
The steps for the receiving side, in order:
- Stop reading. Look only far enough to find the sender's name and number, usually on the cover sheet or the fax header line. Do not read the clinical pages.
- Do not forward it. Even to the office you think it was meant for. You cannot confirm that destination, and a second wrong number doubles the problem.
- Secure the pages. Move paper pages to a locked spot. For an electronic fax, move the file out of shared inboxes into a restricted folder, and do not attach it to any patient chart.
- Contact the sender. Call the number on the cover sheet. Tell them the date and time it arrived, the number of pages, and the patient name or other identifier only as needed for them to find it on their side.
- Follow the sender's instructions. They may ask you to fax it back, mail it back or destroy it. If they ask for destruction, use your normal secure shredding or deletion and confirm back to them when it is done.
- Record what happened. Log the date, the sender, who you spoke to, what they asked you to do and when you did it. Keep no copy of the pages themselves.
Fictional example: on 10/14/2026 at 4:52 p.m., Brightwater Family Clinic receives three pages for a patient named Theo Marsh (example) from Example Orthopedics. The front desk calls Example Orthopedics the next morning, is asked to shred the pages, shreds them and calls back to confirm. The log entry lists both calls and the name of the staff member at each end.
Front desks that see this often should build it into their daily fax routine. The guide to triaging a clinic fax inbox covers where a misdirected page fits among the other priority tiers.
Is a misdirected medical fax a reportable breach?
Whether a misdirected medical fax is a reportable breach is assessed by the covered entity responsible for the information, which is usually the sender, not the office that received it. Under the HIPAA Breach Notification Rule, an impermissible disclosure is presumed to be a breach unless the entity shows a low probability that the information was compromised.
The definition sits in 45 CFR 164.402 on eCFR. It sets out three exceptions. One covers a disclosure where the entity believes in good faith that the person who received the information could not reasonably have kept it. The section also lists four factors the risk assessment must consider: the nature and extent of the information, who received it, whether it was actually acquired or viewed, and how far the risk has been mitigated.
That is why the receiving office's call matters. A prompt report that the pages were not read, were secured and were destroyed gives the sender facts for the third and fourth factors. Notification duties belong to the covered entity: 45 CFR 164.404 on eCFR requires notice to affected individuals "without unreasonable delay and in no case later than 60 calendar days after discovery of a breach", and 45 CFR 164.408 on eCFR sets when breaches are reported to HHS, with those affecting fewer than 500 people logged and reported each year.
This post describes what the rule says, not how it applies to a specific fax. Each office's privacy officer makes that call. The breach rules in full, including the exceptions and the notice contents, are covered in the HIPAA and PHI category.
How do you avoid sending a misdirected medical fax?
Avoiding a misdirected medical fax comes down to sending only to numbers you have confirmed, labelling every transmission so a wrong recipient knows what to do, and testing new numbers before sending patient pages. The HIPAA Privacy Rule requires appropriate safeguards for protected health information, and fax is one channel those safeguards cover.
That requirement is in 45 CFR 164.530 on eCFR, which says "A covered entity must have in place appropriate administrative, technical, and physical safeguards" to protect the privacy of that information. The rule does not list fax steps. The checklist below is common office practice, not a requirement drawn from the regulation.
A short checklist for the sending side:
- Use stored, verified numbers. Keep a directory of the offices you fax often, with each number confirmed by phone, and use the stored entry rather than retyping.
- Confirm any new number. Call the receiving office and read the number back before the first transmission.
- Send a test fax. For a new recipient, send a cover sheet with no patient information and ask them to confirm receipt.
- Use a cover sheet every time. Name the sender, the intended recipient, the page count and a callback number, with a short notice asking a wrong recipient to call and to not read further.
- Check the confirmation report. Match the number dialled and the page count against what you meant to send.
- Review the directory on a schedule. Offices move and change numbers. A stale entry is a misdirected fax waiting to happen.
Fax persists in healthcare for reasons that go beyond habit, explored in why healthcare still runs on fax.
Misdirected fax handling errors that make it worse
Misdirected fax handling errors make the problem worse when they remove the sender's chance to assess what happened, or when they spread the pages further. The two most common are shredding the pages without telling the sender and forwarding them to the office you think was the intended recipient.
Shredding without telling the sender. Destroying the pages feels responsible, but the sender then has no idea a disclosure happened. They cannot assess it, correct the bad number or prevent the next one. Call first, then destroy on their instruction.
Forwarding it on. Sending the pages to the "right" office is a second disclosure based on a guess. Return the pages to the sender and let them resend.
Filing it in a chart. A page attached to the wrong patient's chart spreads the information to everyone who opens that chart, and it may be acted on as if it were that patient's record.
Discussing the contents. Reading the pages aloud to find out who they belong to, or showing them to colleagues, widens the group who have seen the information.
Keeping a copy "just in case". A retained copy is the opposite of what the sender needs to hear. Keep the log entry, not the pages.
Ignoring repeat senders. If the same office keeps faxing you its patients' pages, say so on each call and ask them to fix their directory.
Uploading it to other software. Any tool that reads documents turns a misdirected page into data inside that system as well, so keep it out of extraction and scanning tools. Schema Care does not receive faxes, and it accepts no real patient data until a business associate agreement is signed; every paid plan includes one, as the Schema Care compliance section sets out.