Author:
mFax by Documo

The Regulated Company's Guide To Online HIPAA Fax Compliance in 2021

As many businesses upgrade to electronic fax, they should reevaluate their processes to ensure they meet HIPAA requirements. Failure to follow HIPAA rules can result in disruptions to your business, hefty fines, or worse.


What Are The 3 Rules Of HIPAA


hipaa fax rules

The Health Insurance Portability and Accountability Act (HIPAA) consists of three rules that form its foundation. The first two rules restrict unauthorized people from accessing health records, while the third dictates what firms should do in the event of a data breach.

1. Privacy Rule

The HIPAA rules that govern protected health information (PHI) and electronic PHI (ePHI) are the privacy and security rules. The obligation to maintain compliance rests with the provider, not with the electronic health record vendor. Practitioners must comply with all local and state guidelines and HIPAA requirements.

The privacy rule applies to any entity that handles PHI in any format. Examples include healthcare providers, clearinghouses, insurers, and their business partners. Even businesses that do not keep EHR or other electronic files must still comply with the privacy rule.

This rule generally limits the use of protected health information to obtaining medical treatment or paying for it. For purposes other than treatment, entities must minimize their use of PHI. As part of the HIPAA requirements, all business associates are also required to maintain HIPAA compliance. Patients have the right to access their health information at any time and learn how entities with access to the PHI use the data.

2. Security Rule

The security rule applies to anyone who creates, transmits, receives, stores, or maintains ePHI. This rule governs how covered entities may use ePHI. The three main tenets of this rule are:

Availability: Patients can access their ePHI at any time.

Confidentiality: Only patients or other authorized persons have access to ePHI.

Integrity: Information in ePHI cannot be changed by unauthorized individuals or in unauthorized ways.

Identifying and mitigating security risks, ensuring employee compliance, and protecting against imminent data breaches or unauthorized disclosures are other aspects of the security rule. Consequently, the security regulation emphasizes network security, encryption, and other approaches to preventing data breaches.

3. Breach Notification Rule

The final aspect of HIPAA is the breach notification rule, which defines who covered entities must contact in the event of an unauthorized access to PHI or ePHI. Most entities must contact the affected individual or individuals, HHS, and sometimes the media.


mfax hipaa secure fax


What Are HIPAA Fax Rules


According to HIPAA, healthcare clearinghouses, providers, and health plans must comply with these rules to protect patient information. In addition, any company working with covered entities and handling PHI or ePHI shall enter into a business associate agreement (BAA) and meet all HIPAA guidelines.

This means that any provider who faxes information that contains patient information will be covered under HIPAA. If the provider uses a cloud-based fax service to store or send patient information, that service will also need to comply with HIPAA requirements.

Whenever a covered entity or business associate sends or receives a fax containing individually identifiable information, HIPAA requirements must be followed. A covered item is information that can identify the patient such as a name, social security number, birth date, or address. It also includes information about a patient's physical and mental health conditions, treatment, and payment in the past, present, and future.


What Happens If You Break HIPAA Rules


break hipaa rules

In the event you don't comply with HIPAA, you may be subject to a complaint or a breach. Many of these complaints are outside the jurisdiction of the Office of Civil Rights (OCR) and don't involve covered entities. These cases resolve quickly after the OCR reviews them and determines that no investigation is needed.

If the OCR determines that a possible violation of HIPAA occurred, it will open an investigation into the business. For cases of criminal violations of HIPAA, it will turn the case over to the Department of Justice (DOJ) for review.

If the OCR does find a HIPAA violation, it will resolve the matter with the covered entity in one of three ways:

Voluntary compliance

Corrective action

Resolution agreement

Voluntary compliance is when a business voluntarily updates its security and prevents future violations within the time required by the OCR. Businesses that make the necessary changes during the time they have to notify the OCR of a breach or during the investigation will only receive technical assistance to ensure future compliance.

In the event that businesses fail to take corrective action within the specified time or do not take the necessary steps, OCR may impose penalties.

In some instances the OCR may require that the business be monitored by HHS for compliance for up to three years and pay a resolution agreement. For example, a medical practice was forced to pay $100,000 following a security breach for failure to conduct a risk assessment or take appropriate measures to reduce the risk of future breaches.


What Are HIPAA Business Associate Agreements (BAAs)


hipaa business associate agreements

HIPAA mandates that covered entities that share PHI with third parties have a contract in place that protects the information and follows HIPAA guidelines. This contract is known as a business associate agreement.

Businesses who have a BAA with a covered entity do not need to be in the medical field. Examples of business associates might include:

- A freelance medical transcriptionist

- Lawyers who consult with covered entities and can access PHI or ePHI

- Accountants who may have access to PHI or ePHI from a covered entity

- Third-party health care claims processors

- Cloud-based companies that store or transmit ePHI, such as cloud fax services

- Any other third parties that may have access to ePHI or PHI in any capacity

The BAA guarantees that all business associates will only use the ePHI or PHI they have access to for approved and minimal purposes. Patients must sign an agreement to allow the covered entity to use their information in any other manner.


What HIPAA Security Measures Should Online Fax Services Have


Online fax services, such as mFax, are HIPAA compliant because they implement high levels of security to protect ePHI. It is always wise to thoroughly review the security information of any cloud fax provider since not all will take the same measures to protect ePHI and other transmitted data.

First, mFax only allows authorized personnel to access transmitted data via a secure web portal that requires authentication to log on.

Furthermore, all transmitted and stored data undergoes 256-bit SSL and AES encryption with Transport Layer Security 1.2, keeping it secure throughout the delivery and receipt process. Encryption also assures that only those with authorized keys can decrypt the data.

To restrict access to the system, an administrative control can limit which IP addresses are allowed to log in. Automatic time-outs for idle sessions prevent unauthorized users from accessing information on shared computers. In addition, the system automatically creates audit trails of every IP address and user accessing the system.


Tips For Keeping Your Fax HIPAA Compliant


keeping fax hipaa compliant

No matter the type of faxes you send out, here are some basic security protocols to make sure your company's faxed information is secure, whether in paper or electronic format.

1. Use fax cover sheets

Cover sheets are vital for maintaining compliance. The cover sheet must indicate that the fax contains confidential information intended only for the recipient. In one case, the OCR found that a physician's office had sent information on the HIV status of a patient to their workplace fax number rather than their new provider. The OCR ordered the practice and provider to apologize to the patient, revise its cover sheet, and retrain its office staff for this accidental delivery.

While this practice was only required to make corrections to their methods, if an entity was investigated and failed to do so, the OCR could levy civil money penalties.

2. Remove faxes from machines promptly

Remove faxed material from the fax machine tray as soon as it is completed to prevent it from being accessed by unauthorized personnel.

3. Keep detailed audit trails

In cases of security breaches, the OCR will need to conduct an investigation. A detailed audit trail will help them to trace potential sources of the breach. HIPAA requires the creation of audit trails under the security rule for tracking who has access to ePHI.

4. Verify whether machines or networks store or send unencrypted files

Some machines, such as network-connected multifunction printers and fax servers, may not be secure. If the equipment includes a hard drive that stores faxes in a queue, confirm that the drive fully encrypts all data. When faxes remain on the hard drive unencrypted, the security rule could be violated since anyone with access to the hard drive could potentially read the faxes.

The same security concerns apply to open networks that connect to these devices. An open network and unencrypted hard drive on a multifunction printer could result in a security breach or a failure to meet HIPAA's requirements for transmission security of ePHI.


Why Internet Fax Services Are The More Secure HIPAA Compliant Option


hipaa compliant cloud fax

Traditional fax machines may leave sensitive information exposed. They also lack a comprehensive audit trail detailing who has accessed the information and when. Additionally, network-connected faxes or multifunction printers have security holes when they do not encrypt data on their hard drives, even if the devices ultimately send files over secure telephone lines.

Cloud fax is a more secure way to transmit information and to meet the requirements of the HIPAA fax rules, which apply to all PHI and ePHI.


More Regulated Businesses Trust mFax’s Secure Cloud Fax Platform


When it comes to data security, businesses operating in regulated industries can’t trust their sensitive information to just anyone. You need a partner you can trust. The mFax platform was built for security.

With state-of-the-art encryption, full audit trails, and advanced user access controls, you can be sure all your faxes are safe and compliant.


GET STARTED WITH MFAX HIPAA SECURE FAX TODAY


Table of Contents
Schedule your mFax Demo
User-Friendly Interface
Full-Featured Cloud Fax API
Reliable White-Label Fax Solution
Secure and Encrypted
Schedule Your mFax Demo

Recent posts

Phil Charron
Phil Charron

Administrative Burdens are the Real Reason US Healthcare is Broken

4 Mins
June 11, 2024
Tony Cox
Tony Cox

Unlock New Revenue Streams: Cloud Fax for Agents and Resellers with Documo

3 Mins
June 7, 2024
Steve Chong
Steve Chong

The Promise of Artificial Intelligence in Managing Healthcare Information

5 Mins
May 24, 2024
Denis Whelan
Denis Whelan

Healthcare Interoperability, more than EHR to EHR

3 mins
May 8, 2024
Shane Fitch
Shane Fitch

Product Managers' Guide to Integrating Cloud Fax in Healthcare Applications

6 mins
April 2, 2024
Steve Chong
Steve Chong

What To Look For in a Cloud Fax Solution as a Reseller

9 mins
March 26, 2024
Denis Whelan
Denis Whelan

Ultimate Cloud Fax Buyers Guide: 7 Key Considerations When Choosing an Online Fax Service

10 mins
April 9, 2024
Sam Dorshorst
Sam Dorshorst

Enterprise Cloud Fax Implementation Pitfalls

9 mins
March 19, 2024
Matt Overlund
Matt Overlund

How OCR Fax Software Saves Healthcare Organizations Critical Time

7 min
March 12, 2024
Jack Hoover
Jack Hoover

Effortless Fax Online Solutions: Your Guide to Modern, Reliable Faxing

8 min read
December 19, 2023
Jack Hoover
Jack Hoover

Effortless Guide to Fax with iPhone: Send & Receive Faxes on the Go

11 min read
November 29, 2023
Jack Hoover
Jack Hoover

How to Fax an Email: Simple Steps to Send and Receive Faxes via Email

5 min read
November 17, 2023
mFax by Documo
mFax by Documo

Fax Plus vs. mFax - A Comprehensive Comparison

5 min read
November 2, 2023
mFax by Documo
mFax by Documo

WestFax vs. mFax - A Comprehensive Comparison

November 2, 2023
mFax by Documo
mFax by Documo

OpenText vs. mFax - A Comprehensive Comparison

November 2, 2023
mFax by Documo
mFax by Documo

Concord vs. mFax - A Comprehensive Comparison

November 2, 2023
mFax by Documo
mFax by Documo

mFax vs. Retarus - A Detailed Comparison

5 min read
November 2, 2023
mFax by Documo
mFax by Documo

mFax vs. RingCentral - A Detailed Comparison

5 min read
November 2, 2023
mFax by Documo
mFax by Documo

mFax vs. Biscom - A Detailed Comparison

5 min read
November 2, 2023
mFax by Documo
mFax by Documo

mFax Versus iFax - A Detailed Comparison

November 2, 2023
mFax by Documo
mFax by Documo

mFax vs. eFax - A Detailed Comparison

5 min read
November 2, 2023
mFax by Documo
mFax by Documo

Securely Fax HIPAA Compliant in 2023 - Your Guide to Online Fax Services

6
October 18, 2023
mFax by Documo
mFax by Documo

Free Fax Cover Sheet Templates

5
October 30, 2023
mFax by Documo
mFax by Documo

Top 10 eFax Best Alternatives | 2023

3 minutes
October 25, 2023
Brynna Carman
Brynna Carman

Part 2: ViVE 2023 Innovators

March 8, 2023
Brittany Woo
Brittany Woo

50 Must See HealthTech Innovators @ ViVE

March 8, 2023
mFax by Documo
mFax by Documo

Health Tech Innovator Profile: Phreesia

February 6, 2023
mFax by Documo
mFax by Documo

Comparably’s Top Companies for Women - Documo Selected for Inclusive Culture

January 17, 2023
mFax by Documo
mFax by Documo

SOC 2 Compliance is Just Table Stakes for Vendor Evaluations

January 12, 2023
mFax by Documo
mFax by Documo

Documo Selected as 2022 Comparably Award Winner

November 30, 2022
mFax by Documo
mFax by Documo

What is Faxploit and How Can We Avoid It?

6 min read
July 11, 2022
mFax by Documo
mFax by Documo

Why Does Faxing Still Exist Despite Advancing Technology?

11 min read
August 15, 2022
mFax by Documo
mFax by Documo

How to Send a Fax in 2023: A Comprehensive Guide

7 min read
September 10, 2022
mFax by Documo
mFax by Documo

Why Is Fax Still Important in Financial Industries?

11 min read
September 15, 2022
mFax by Documo
mFax by Documo

Ultimate FAQ For Online Faxing

6 min read
September 15, 2022
mFax by Documo
mFax by Documo

The Regulated Company's Guide To Online HIPAA Fax Compliance in 2021

June 30, 2022
mFax by Documo
mFax by Documo

Why Your Business Needs A Programmable Fax API

June 30, 2022
mFax by Documo
mFax by Documo

Why These 4 Industries Still Fax In 2020

July 5, 2022
mFax by Documo
mFax by Documo

VoIP vs FoIP - How to Choose the Best Service for Your Business

June 30, 2022
mFax by Documo
mFax by Documo

Why is HIPAA-Compliant Fax Crucial for the Healthcare Industry?

June 29, 2022
mFax by Documo
mFax by Documo

Why Fax is Better Than Email

July 6, 2022
mFax by Documo
mFax by Documo
Tech talk

What Personal Information is Protected Under HIPAA?

12
June 29, 2022
mFax by Documo
mFax by Documo

Vanilla Go Paperless Cupcakes

June 30, 2022
mFax by Documo
mFax by Documo

Ultimate Guide to HIPAA Fax

July 7, 2022
mFax by Documo
mFax by Documo

T.38 and the VoIP Fax Stigma

July 5, 2022
mFax by Documo
mFax by Documo

The Matter of Fax: A look at faxing in healthcare

July 7, 2022
mFax by Documo
mFax by Documo

The Limitations (and Even Dangers) of Free Fax Services

June 29, 2022
mFax by Documo
mFax by Documo

The Future of the Cloud Fax Market

June 29, 2022
mFax by Documo
mFax by Documo

The Evolution of Fax Technology

June 29, 2022
mFax by Documo
mFax by Documo

Partner Spotlight - Skyetel

July 7, 2022
mFax by Documo
mFax by Documo

Is Cloud Faxing Secure & Safe?

June 30, 2022
mFax by Documo
mFax by Documo

Interesting Fax Facts for People to Ponder

June 29, 2022
mFax by Documo
mFax by Documo

Online Signature Analysis: What Your Signature Says About You

June 29, 2022
mFax by Documo
mFax by Documo

Is it Safe to Fax Personal Information?

June 29, 2022
mFax by Documo
mFax by Documo

How to Protect Your MFPs from Security Breaches

June 30, 2022
mFax by Documo
mFax by Documo

How to Send an International Fax the Old-Fashioned Way

June 29, 2022
mFax by Documo
mFax by Documo

Innovaccer and Documo Bring HIPAA-Compliant Digital Fax to the Innovaccer Health Cloud

June 29, 2022
mFax by Documo
mFax by Documo

Industries That Are Benefiting the Most from Online Faxing

June 29, 2022
mFax by Documo
mFax by Documo

How to Get a Fax Number Without a Phone Line

June 29, 2022
mFax by Documo
mFax by Documo

How the Elections Benefit from Online Faxing

June 29, 2022
mFax by Documo
mFax by Documo

How Emailing Private Docs Can Leave You Vulnerable

June 30, 2022
mFax by Documo
mFax by Documo

How mFax is Helping These 6 Healthcare Organizations Live in the Future

June 29, 2022
mFax by Documo
mFax by Documo

How Cloud Fax Enables Healthcare Interoperability During Coronavirus

July 5, 2022
mFax by Documo
mFax by Documo

How Healthcare IT Teams Can Deliver Interoperability In 2020

July 5, 2022
mFax by Documo
mFax by Documo

How Do Cloud Faxes Work?

June 30, 2022
mFax by Documo
mFax by Documo

Beginners' Guide to Business Automation

July 5, 2022
mFax by Documo
mFax by Documo

HIPAA Fax Cover Sheet: A Secure Guide and Free Templates

June 29, 2022
mFax by Documo
mFax by Documo

Cloud Faxing: Top 5 Questions That You’re Guaranteed to Ask

June 30, 2022
mFax by Documo
mFax by Documo

HIPAA and The Cloud

July 7, 2022
mFax by Documo
mFax by Documo

Are You on the Brink of a HIPAA Disaster? How Physical Fax Machines Put You at Risk

July 7, 2022
mFax by Documo
mFax by Documo

Healthcare Technology Trends to Watch Out for

July 7, 2022
mFax by Documo
mFax by Documo

Cloud Fax or Fax Server - How to Compare Solutions

June 30, 2022
mFax by Documo
mFax by Documo

5 Reasons Why Online Faxing is Important

June 29, 2022
mFax by Documo
mFax by Documo

Are You Losing 15% of Your Faxes?

June 30, 2022
mFax by Documo
mFax by Documo

5 Winning Reasons mFax is the All-Star Player in Today’s Financial Industry

July 6, 2022
mFax by Documo
mFax by Documo

5 Best Concord Cloud Fax Alternatives

June 29, 2022
mFax by Documo
mFax by Documo

4 Simple Ways You Can Quickly Improve Patient Retention

July 5, 2022
mFax by Documo
mFax by Documo
mSign me up

Advantages and Disadvantages of Online Faxing

June 29, 2022

Get in touch with our US based team of fax experts

We'll help you assess your fax needs and determine the best solution for your business.

+1 (888) 966-4922
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.