Is a fax sent to the wrong number a HIPAA breach?

Presumed yes. A fax that reaches the wrong number is a disclosure the Privacy Rule does not permit, and 45 CFR 164.402 presumes a breach unless the practice shows a low probability of compromise, judged on at least four factors. If the presumption stands, individuals must be told without unreasonable delay and within 60 days of discovery.

Why is a wrong-number fax presumed a breach?

The Breach Notification Rule, 45 CFR 164.400 to 164.414, starts from a presumption. A use or disclosure the Privacy Rule does not permit is presumed to be a breach unless the practice (the rule says covered entity) demonstrates a low probability that the information was compromised (164.402). The practice carries that burden (164.414(b)).

Three exclusions come first: a workforce member's good-faith, unintentional access within their authority; an inadvertent disclosure between two people who are both authorized to see the information at the same covered entity or business associate; and a disclosure where the practice believes in good faith that the recipient could not reasonably have retained the information. The first two lapse if the information is then used or disclosed further in a way the rule does not permit (164.402).

The definition has no exception for a misdial. When commenters asked HHS to exempt routine slips such as faxing to the wrong number, HHS declined in its 2013 final rule and wrote that the answer is fact specific: it turns on who received the information, what it was and what mitigation followed. Its worked example of the third exclusion is mail returned to the sender undelivered and unopened (78 FR 5646). Notices are owed only for unsecured information, meaning information not made unreadable to unauthorized people by encryption or destruction (HHS). A page that arrives legible at the wrong end has had neither.

What do the four factors weigh?

HHS's commentary on the final rule shows what each of the regulation's four factors looks at (78 FR 5642 and 5643):

1. The information. How sensitive and how detailed it is. HHS names diagnosis, medication, treatment plan, history and test results, and asks whether the identifiers or their context could point to a person.
2. The recipient. Whether the person who received it owes a duty to protect it, as another entity bound by the HIPAA rules or a federal agency bound by the Privacy Act does.
3. Acquired or viewed. HHS separates information that was actually acquired or viewed from information that only could have been. Its example is a letter that reached the wrong person, who opened it and called to report the mistake: reading it far enough to notice the error counted as viewing and acquiring it.
4. Mitigation. The recipient's satisfactory assurance that the information will not be used or disclosed further, or will be destroyed. HHS says a covered entity may be able to rely on such assurances from another covered entity or a business associate, but that assurances from certain third parties may not be enough.

HHS wants one overall judgment. The entity addresses each factor, may add others, and weighs them in combination, in good faith and to a reasonable conclusion. When the assessment fails to demonstrate a low probability, notification is required (78 FR 5643). HHS also says an entity may skip the assessment and give the notices (HHS).

HHS has used a fax as its own example: one misdirected to the wrong physician practice, where the receiving physician calls to say it came in error and has been destroyed. HHS wrote that the covered entity may be able to demonstrate, after a risk assessment, a low risk of compromise (78 FR 5642). Apart from the assessment, 45 CFR 164.530(f) requires a covered entity to mitigate, to the extent practicable, any harmful effect it knows of from a disclosure that violates the rules.

When does the 60-day clock start?

At discovery: the first day the breach is known to the practice or would have been known with reasonable diligence. What any workforce member or agent knows counts as the practice's knowledge, except for the person who committed the breach (164.404(a)(2)). The rule asks for notice "without unreasonable delay" and "in no case later than 60 calendar days after discovery," so day 60 is the outer limit (164.404(b)).

Who must be told, and by when?

The two thresholds sit one apart: HHS's timing turns on 500 or more individuals, the media notice on more than 500 residents of one State or jurisdiction. HHS takes its reports through an online breach report form (HHS).

Written notice to individuals goes by first-class mail, or by email to anyone who agreed to receive notices electronically. It is in plain language and covers what happened, with the dates of the breach and of discovery; the types of information involved; what the person can do to protect themselves; what the practice is doing to investigate, reduce harm and prevent a repeat; and how to reach the practice, by toll-free number, email address, website or postal address (164.404(c) and (d)).

What records does a practice keep, and for how long?

The burden of showing that every required notice went out, or that the disclosure was not a breach, sits with the practice (164.414(b)). HHS reads that as keeping the notices, or the risk assessment that showed a low probability of compromise, or the exception the practice relied on (HHS). The rule sets six years, counted from the date the documentation was created or last in effect, whichever is later (164.414(a) applies 164.530(j) to breach records).

The notice gives the date of the breach, if known, and a delivery record can supply it. Every Fax Pigeon plan includes a delivery certificate for every delivered fax, a dated record of when each fax arrived to file beside the assessment.

Which safeguards against a wrong number does HHS name?

The safeguards standard covers unintentional disclosures as well as intentional ones (164.530(c)). FAQ 356 names the sender checking that the number is the right one for the receiving office and keeping the fax machine in a secure location. FAQ 482 adds confirming a number that is not regularly used with the intended recipient first, and pre-programming the numbers used often into the machine so those faxes are not misdirected. Is online fax more secure than email? covers how fax and email compare on this one risk.

* Fax Pigeon prices and plan terms as of October 11, 2026.