Don’t Kill Faxing: Kill the Fax Machine

Hillary Clinton may have run the State Department, and she is currently running for president; however, she can’t use a fax machine.

An entertaining email exchange between Clinton and longtime aide Huma Abedin suggests the former First Lady might be fax-challenged.

Here’s Abedin instructing her boss to hang up the phone receiver attached to her fax machine: “Just pick up phone and hang it up. And leave it hung up.”

Clinton responds: “I’ve done it twice now. Still nothing.” In other words, the most powerful country on Earth was temporarily brought to its knees by a fax machine.

Scottish clockmaker Alexander Bain invented the fax machine in 1843, sending the first image using telegraph technology. Nearly two centuries later, the fax machine is still around to cause issues in offices all over the world. Thanks to mobile technology, people carry video and music studios in their pockets. Yet they can’t part with the whining, bleeping, paper-jamming dinosaur that is the fax machine.

Faxing Is More Secure Than Online Transmissions but the Fax Machine Is Not

While “hacking” generates more than a hundred thousand online searches every month, “fax hacking” unsurprisingly garners none. According to data from cyberinsurance provider Beazley PLC, the top two causes of data breaches have nothing to do with hackers. In a presentation to the International Association of Privacy Professionals, Beazley said that misdirected documents, such as emails and faxes sent to the wrong recipient, account for 31 percent of data breaches. Misuse of paper records account for 24 percent of breaches, making the fax machine culpable in two of the top drivers of data breaches. In short, people are still dialing wrong numbers and leaving confidential documents lying around for anyone to peruse.

 Unlike the next potential  Democratic presidential  nomination, health c  are organizations are clearly well  versed with their beloved fax  machines. While it’s unlikely due  to the fear of a crippling a data b  reach, many payers, providers,  and pharmacies continue to view  fax as a path of least resistance as well as a safeguard from HIPAA and HITECH violations.

Only it’s not that simple. While focusing on data in transmission, health care firms aren’t considering the impact of misdialed fax numbers and patient data sent to the wrong person. They also forget the sent and received faxes left on the fax machine in view of anyone, or the faxes picked up and filed in the wrong location — not to mention the faxes left on the wrong person’s desk or dumped into the garbage without being shredded.

So while faxing is still one of the most secure ways to transmit patient data, the fax machine itself remains a gaping security hole that does little to prevent fat fingers and prying eyes.

Electronic Fax: a Safe and Convenient Alternative

With the right security precautions, HIPAA-compliant electronic fax for health care offers security protections and conveniences that traditional fax machines don’t. In addition to eliminating the dial tone, the busy signal, and the paper jam, secure electronic faxes improve document handling and do a significantly better job of keeping PHI safe.

Security measures, like encrypted transmission over TLS and secure HTTP, make faxes far less vulnerable to interception while in-transit. Also, because faxes go directly to the recipient’s email inbox as well as into the organization’s document management system, faxes go to both the correct recipient and the right file.

Software integrations also make it easy to fax documents directly from a range of applications, including EMR and EHR solutions as well everyone’s favorite, Microsoft Office. Even cover letters are auto- scanned and formatted for HIPAA compliance, ensuring only the right people get access to PHI. Electronic fax drastically reduces human error, eliminating many accidental privacy breaches and vulnerabilities created by paper fax workflows.

 Keeping All Faxes Secure

If you’re not quite ready to take  your fax machine out and give it  the same treatment Samir and  the Initech guys from “Office  Space” gave their printer — these  precautions will keep your  Faxosaurus paperus HIPAA- compliant:

• Limit what you send. Avoid sending any patient PHI the recipient doesn’t critically need.
• Secure the machine. If possible, put a designated person in charge of sending an receiving faxes. At very least, locate the fax machine somewhere secure and accessible only by authorized staff.
• Ensure PHI isn’t included on the coversheet and add a confidentiality statement to cover sheets. Here’s an example: “The information contained in this transmission is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. If you are not the intended recipient of this information, do not review, re-transmit, disclose, disseminate, use, or take any action in reliance upon, this information. If you received this transmission in error, please contact the sender or contact the HIPAA privacy officer for further instruction.”
• Address faxes sent or received in error. If you receive or send a PHI-related fax in error, contact the recipient or the sender immediately. After disclosing the error, shred the fax or inform your organization’s compliance officer.
• Know what should and should not be faxed. Certain notes can’t be sent within a fax transmission, including psychotherapy notes and notes related to domestic violence or sexual assault counseling.

Today there’s no compelling reason to keep using your paper fax machine and plenty of reasons to end those busy signals for good. Stop dialing that fax machine keypad. Call a HIPAA-compliant electronic health care fax provider instead.