Page 1 of 3
Administrative (Non-Clinical) Policy
UWHC only (Hospital Administrative-entity wide) UWMF only (entity wide)
UWHC Departmental (indicate name) UWMF Departmental (indicate name)
UWHC and UWMF (shared)
Policy Title: Security of Faxed, Printed and Copied Documents
Policy Number: 6.20
Effective Date: May 1, 2015
Chapter: Medical Records
To establish guidelines for securing paper documents containing protected health information (PHI).
It is the policy of UWHC to hold, transmit, and dispose of paper documents containing protected health
information in a protected and secure manner in compliance with federal and state regulations and
This policy applies to document printers, facsimile machines (faxes), copiers, copy pickup/drop-off
locations and waste paper disposal containers.
A. Procedures for Faxing PHI
Protected health information may be sent by fax pursuant to Hospital Administrative policy 4.13-
Uses and Disclosures of Protected Health Information. In addition to following the procedures set
forth in policy 4.13, staff must take the following measures to secure the transmission of faxed
1. Staff members faxing patient information shall take reasonable steps to ensure that the
fax transmission is sent to the appropriate destination. When taking a request for
information to be faxed, obtain the following information:
Name/Date of Birth of Patient/Medical Record Number (if possible);
Information Requested (provide minimum necessary to meet needs of requestor);
Reason for Request (i.e., continued care);
Fax Number of Requesting Party;
Phone Number of Requesting Party (for verification of identity and questions)
a. When requests are made by or when sending information to parties that are
unfamiliar to the sender, UW Health staff should verify the requesting party's
identity by contacting the party via the contact phone number and determining
legitimacy through the identification provided by the party at the contact number.
b. Staff members should always double check the recipient's fax number before
pressing the "send" key. When using pre-programmed receiving fax numbers, the
Page 2 of 3
numbers should be tested immediately after the first programming to determine
c. Using a "speed dial" generally prevents misdirected faxes. However, if used, the
number must be verified from time to time or changed if necessary.
2. Any fax that contains PHI must use a fax cover sheet that includes a confidentiality
statement similar to, but not necessarily exactly, as follows:
The documents accompanying this fax transmission contain confidential patient health
information that is legally privileged. This information is intended only for the use of the
individual or entity named above. The authorized recipient of this information is
prohibited from disclosing this information to any other party unless permitted to do so
by law or regulation and is required to destroy the information after its stated need has
If you are not the intended recipient, you are hereby notified that any disclosure, copying,
distribution, or action taken in reliance on the contents of these documents is strictly
prohibited. If you have received this information in error, please notify the sender
immediately and arrange for the return or destruction of these documents.
The cover sheet shall be filled out completely with the name, phone number and
department of the sender clearly indicated as well as a description of what was sent.
3. Information and documents that have been faxed shall be gathered immediately after
faxing and routed to the appropriate location or destroyed in a confidential manner.
4. Parties receiving faxes from UWHC on a regular or routine basis should be periodically
reminded to notify UW Health if their fax numbers change.
B. Procedures for Retrieval of Printed or Faxed Documents
1. Staff should remove output from printers, fax machines and copiers as soon as possible to
avoid unauthorized persons from gaining access to the materials.
2. Staff should verify the total number of pages as identified on the fax cover sheet and take
care to accurately route the contents.
3. If the fax transmission is illegible, incomplete, or received in error, the sender should be
notified immediately. Documents received in error should be immediately placed in
confidential receptacles for shredding.
4. Fax transmissions of protected patient health information should be immediately routed
to the intended receiver or the patient's record.
C. Physical Security and Location of Equipment
1. Locations of FAX Machines and Printers
Fax machines and printers that routinely receive transmissions of protected patient health
information shall be placed in secure, non-public areas. Public areas inappropriate for the
location of such equipment include, but are not limited to, primary hallways, waiting
rooms, multi-use and conference rooms and elevator lobbies.
a. Special consideration should be given to fax machines and printers that receive
paper output containing PHI outside of regular business hours (e.g. printers
running overnight batch print jobs). This equipment should be located inside a
room that is routinely locked outside of regular business hours.
b. Semi-public areas are acceptable locations for printers and fax machines if
patients and visitors are accompanied by staff in those locations. Semi-public
areas may include, but are not limited to, clinic hallways and work areas where
patients are escorted by staff, administrative buildings which have little or no
patient traffic and private office space that is enclosed but not behind locked
2. Locations of Copy Machines
Copy machines may be located in areas that are not appropriate for printers and fax
machines, since a human operator must be present to create output containing PHI. Copy
Page 3 of 3
machines should be attended during the copying of PHI. Placement of copy machines
must comply with life safety codes.
D. Disposal of Discarded Paper Containing PHI
1. When possible, dispose of paper waste containing PHI in receptacles that are secured by
locking mechanisms or that are located behind locked doors after regular business hours.
Locked containers must be used with copy machines located in insecure or unattended
2. Unsecured (unlocked) recycle bins/waste receptacles should not be located in public or
semi-public areas where the general public may have access to them. Nursing stations
and similar workstations in clinics are considered semi-public areas and should,
therefore, have secured recycle bins placed in them.
3. In physical locations serviced by the UWHC Environmental Services department, locked,
confidential recycling containers may be requested by calling the UWHC Director of
Environmental Services at 263-6482. A container can usually be placed within 48
hours. Managers or supervisors of clinics or other sites not serviced by UWHC's
Environmental Services department are responsible for obtaining their own confidential
recycling containers (including "locked" confidential containers). These can be obtained
by contacting the Environmental Services Supervisor for the facility who, in turn, will
contact the vendor responsible for destruction of confidential materials at that facility.
4. Per state law, paper documents containing PHI will be destroyed before final
disposal. These documents will be destroyed, by a bonded outside vendor who is
contracted through the Environmental Services Department at UWHC. Most UWHC
serviced sites provide on-site destruction of documents containing PHI.
Senior Management Sponsor: VP, CIO
Author: Director, Health Information Management
Approval Committee: Administrative Policy and Procedure Committee
President & CEO
Previous revision: May 2012
Next revision: May 2018