Quick Answer: A HIPAA-compliant fax cover sheet must include the date and time of transmission, the recipient’s name and fax number, the sender’s name and fax number, and a confidentiality disclaimer stating that the fax may contain protected health information (PHI). It should not include the patient’s name or other identifying details in the HIPAA fax cover sheet itself.
Also, HIPAA does not require a specific cover sheet format. Instead, it requires “reasonable safeguards” when transmitting PHI, and a compliant cover sheet is one of the simplest ways to meet that standard.
On This Page:
What Does RE Mean on a Fax Cover Sheet?
The abbreviation “RE” on a fax cover sheet typically stands for “regarding” or “reference” and is used to provide a brief description or subject line for the fax’s contents.
For example, a fax cover sheet might include the notation “RE: Appointment request for January 25th” to indicate that the fax contains an appointment request for a specific date.
What Should a HIPAA Fax Cover Sheet Contain?
When faxing PHI, the cover sheet must include the following:
- Date and time the fax cover sheet was sent
- Name of the recipient
- Fax number of the recipient
- Name of the sender (covered entity)
- Sender’s fax number
- HIPAA fax cover sheet disclaimer
It’s important that the fax cover sheet declares the document as “confidential” or “for authorized eyes only.”
Aside from these items, it is not recommended to include specific details in the fax cover sheet. For example, you may not include the patient’s name as this violates HIPAA standards. Instead, a fax cover sheet may have the patient’s case number for easy reference.
In some cases, you may include the physician’s contact number, case number, and insurance policy number on the fax cover sheet.
What Is a HIPAA Fax Disclaimer?
A HIPAA fax disclaimer should include the following:
- a reminder about confidentiality
- a warning against unauthorized viewing and use
- instructions on what to do to prevent PHI compromise
Sample HIPAA Fax Cover Sheet Disclaimer
Here is an example of a HIPAA-compliant fax cover sheet disclaimer:
IMPORTANT: This facsimile transmission contains confidential information, some or all of which may be protected health information as defined by the federal Health Insurance Portability & Accountability Act (HIPAA) Privacy Rule. This transmission is intended for the exclusive use of the individual or entity to whom it is addressed and may contain information that is proprietary, privileged, confidential, and/or exempt from disclosure under applicable law.
If you are not the intended recipient (or an employee or agent responsible for delivering this facsimile transmission to the intended recipient), you are hereby notified that any disclosure, dissemination, distribution, or copying of this information is strictly prohibited and may be subject to legal restriction or sanction. Please notify the sender by telephone (number listed above) to arrange the return or destruction of the information and all copies.
This fax cover sheet disclaimer is standard across different industries. You may revise the text to apply to health industry use. Check out these other samples of HIPAA-compliant disclaimers.
Is There a Required Format for a HIPAA-Compliant Fax Cover Sheet?
No. HIPAA does not mandate a specific fax cover sheet template or wording. The HHS Privacy Rule requires covered entities to apply “reasonable safeguards” when transmitting PHI by any method, including fax. A well-constructed cover sheet with a confidentiality disclaimer is a widely accepted way to meet that standard. Still, the cover sheet alone does not make a fax transmission compliant. The safeguards around it matter too (see below).
What Not to Put on a HIPAA-Compliant Fax Cover Sheet?
Avoid including:
- The patient’s full name (use a case number or reference ID instead)
- Diagnosis, treatment details, or other clinical information
- Insurance policy numbers, unless specifically required and approved by your compliance policy
- Any information beyond what’s needed to route the fax and identify the sender
Minimizing what appears on the cover sheet reduces exposure if the fax is misdirected or seen by an unauthorized party before the recipient retrieves it.
Is Fax a HIPAA-Compliant Way to Send Patient Information?
Yes. According to HHS guidance, covered entities and their business associates may share patient information by fax, phone, or email, provided that reasonable safeguards are in place. Fax is often considered lower-risk than email because online fax platforms typically use encryption and don’t leave PHI sitting in an inbox indefinitely.
Common examples of permitted fax use include a lab sending results to a physician, or a hospital faxing discharge information to a receiving facility.
For faxing PHI, examples of privacy safeguards include:
- Calling the recipient first to confirm their fax number
- Informing them that a document will be sent shortly
- Printing out a delivery confirmation report that proves the transmittal was successful
- Placing fax machines in a private area that is only accessible to authorized staff
- Using HIPAA fax cover sheets that do not display the patient’s name or other identifying information
Note: Patient consent is still typically required before faxing PHI for non-treatment purposes (e.g., sharing exam results with an employer).
Additional safeguards when faxing PHI
A HIPAA-compliant fax cover sheet works best alongside these practices:
- Thoroughly verify the recipient’s fax number before sending, especially for new contacts
- Restrict physical or digital access to inbound faxes to authorized staff
- Use a HIPAA-compliant fax service with encryption and audit trails rather than a standalone fax machine in an open area
Download a Free HIPAA Fax Cover Sheet Template
Rather than building a cover sheet from scratch, you can download a ready-to-use, fillable HIPAA fax cover sheet template in PDF or DOC format:
Frequently Asked Questions
What is a HIPAA fax cover sheet?
It’s a cover page used when faxing protected health information that identifies the sender and recipient and includes a confidentiality disclaimer, helping covered entities meet HIPAA’s requirement for safeguarding PHI.
Can I put the patient’s name on a HIPAA fax cover sheet?
It’s not recommended. Use a case number or reference ID on the cover sheet instead, and reserve the patient’s name for the body of the fax itself, seen only after the recipient retrieves it.
Does a HIPAA fax cover sheet alone make a fax compliant?
No. The cover sheet is one safeguard among several. Confirming the recipient’s number, restricting access to inbound faxes, and using a secure fax platform all contribute to compliance.
Where can I get a free HIPAA fax cover sheet template?
iFax offers a free, fillable HIPAA-compliant fax cover sheet in PDF and DOC format, available here.
What Your Fax Cover Sheets Cannot Do Alone
A confidentiality disclaimer tells the recipient how to handle your fax. It doesn’t encrypt the transmission, confirm who actually received it, or control who at your organization can view it once it arrives. That part depends on the platform sending it.
iFax handles the safeguards a cover sheet can’t:
- 256-bit encryption on every fax, in transit, and at rest
- Signed BAA available on all HIPAA-eligible plans
- Instant delivery confirmation and detailed audit trails
- Full control over who sends, views, and manages faxes
Pair your fax cover sheets with a HIPAA-compliant fax platform built for PHI from the ground up.
Start faxing today.
