A HIPAA fax cover sheet is an ordinary cover sheet with three things added: a confidentiality statement that says the pages contain protected health information, an instruction to a wrong recipient to notify the sender and destroy the pages, and enough identification of sender and intended recipient that a misdirected fax can be traced. The rules do not prescribe the wording; the practice's policy does, and the sheet is the evidence the policy was followed. This page gives the fields, the disclaimer wording, and the mistakes that make a medical fax cover sheet worthless.
The fields a medical fax cover sheet carries
Date and time sent. The sender's name, practice, phone and fax number, so a recipient can call back. The intended recipient's name, organisation and fax number, written out rather than assumed from the dialled number. The number of pages including the cover, so a short transmission is noticed. A one-line subject that does not itself disclose health information: a patient's name and the word oncology on the cover sheet is a disclosure to whoever picks it up. A confidentiality statement and instructions for a wrong recipient. And a line for the sender's initials confirming the number was verified. Every vendor in the Fax Line Index lets a practice save that as a default cover in its account.
The HIPAA fax disclaimer wording
The statement needs to say four things and can say them in three sentences. That the fax contains confidential information, including protected health information, intended only for the named recipient. That if the reader is not the intended recipient, any review, use, disclosure or distribution is prohibited. That a wrong recipient should notify the sender immediately by telephone and destroy the pages or return them. And a contact number for that call. A practice can add that the information is protected under HIPAA and applicable state law, but the legal citation does not change what the reader must do; the instruction does. Keep it in plain words, at a size that can be read on a poor transmission, above the fold of the page.
What makes a confidential fax cover sheet fail
The most common failure is a cover sheet that discloses on its face: a diagnosis in the subject line, a patient's full name and date of birth as a convenience for the recipient. The second is an unverified number, which no wording repairs; the cover sheet should record that the number was confirmed. The third is a generic sheet with a confidentiality statement but no callback number, so a wrong recipient has no way to comply with the instruction. The fourth is sending the cover sheet and forgetting the pages, or the reverse, which is why the page count is on it. The free fax cover sheet on this site carries the fields and the wording; the practice's job is to fill them in honestly and check the number every time.
Questions people ask about hipaa fax cover sheet
Is a HIPAA cover sheet legally required?
HIPAA requires reasonable safeguards, not a specific document. A cover sheet with a confidentiality statement and wrong-recipient instructions is the safeguard every auditor expects to see.
Can I put the patient's name on the cover sheet?
Best practice is no. Use an internal reference or account number and keep the patient's details on the pages behind the cover, which a wrong recipient is told not to read.
Do online fax services add a cover automatically?
Every vendor in the index lets you save a default cover with your own wording and attach it to each send. Check the saved version still carries the callback number after any edit.