Is a fax cover sheet required by HIPAA?

No. The words 'cover sheet' appear nowhere in 45 CFR Parts 160 and 164. HIPAA requires reasonable safeguards for protected health information (45 CFR 164.530(c)), and the fax examples HHS gives are confirming the number with the recipient, pre-programming frequent numbers and keeping the machine in a secure place. A cover sheet is a safeguard a practice adds by its own policy.

What should be on a HIPAA fax cover sheet?

Six items: the recipient's name and fax number, your practice's name, phone and return fax, the date and time, the page count with the cover included, a subject that names the kind of document, and a confidentiality notice. HIPAA prescribes none of them. Keep the patient's name, date of birth, record number and diagnosis on the pages behind the sheet.

Should a fax cover sheet include the patient's name?

No. Page one is the page a wrong recipient reads first, and the breach rule's risk assessment weighs the nature and extent of the information involved, including the types of identifiers (45 CFR 164.402). Washington University's HIPAA Privacy Office tells staff to keep protected health information off the cover sheet. Put the name, date of birth and record number on the pages behind it.

Can you be fined for not using a fax cover sheet?

Not for the sheet itself: no HIPAA rule requires one. HHS imposes a civil money penalty when a covered entity 'has violated an administrative simplification provision' (45 CFR 160.402(a)), a requirement or prohibition in the statute or the rules (160.103). The provisions that bear on faxing include the safeguards standard (164.530(c)), the breach notification rules (164.400 to 164.414) and, for a service that keeps your faxes, the business associate rule (164.502(e)).

Does a HIPAA disclaimer on a fax make it compliant?

No. 45 CFR Parts 160 and 164 prescribe no fax disclaimer and no wording, and a fax sent to the wrong number still goes through the breach rule's risk assessment (45 CFR 164.402) whatever the notice says. The notice's use is practical: it asks a wrong recipient to call you and destroy the pages. What the rules ask of a fax service that keeps your faxes is a written business associate agreement (164.502(e)).

Do I need a BAA with my online fax service?

Yes, when the service keeps your patients' faxes. A vendor that creates, receives, maintains or transmits protected health information on your behalf is a business associate under 45 CFR 160.103, and 164.502(e) requires the assurances to be documented in a written contract or other written agreement. Fax Pigeon includes a signed BAA on every plan, executed at signup, from $4.99 a month billed annually for 200 pages.

October 10, 2026

HIPAA fax cover sheet requirements

HIPAA has no fax cover sheet rule: 'cover sheet' appears nowhere in 45 CFR Parts 160 and 164. Six items belong on one, the patient's name does not, and the fax service needs a signed BAA.

A padlock and a stethoscope resting on a keyboard against a teal background

HIPAA has no fax cover sheet requirement: the words "cover sheet" appear nowhere in 45 CFR Parts 160 and 164. The Privacy Rule requires reasonable safeguards for patient information (45 CFR 164.530(c)), and a cover sheet with six items and no patient name is an easy safeguard to add. The requirement no sheet can meet is a signed business associate agreement (BAA) with a fax service that keeps your faxes (45 CFR 164.502(e)). Every Fax Pigeon plan includes one, from $4.99 a month billed annually.

What does HIPAA say about fax cover sheets?

Nothing by name. The safeguards duty sits in one sentence: a covered entity "must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information" (45 CFR 164.530(c)). The next paragraph adds a duty to guard against intentional or unintentional violations and to limit incidental disclosures. Fax shows up in two sections of Parts 160 and 164. Section 164.514 lists fax numbers among the identifiers, and 160.103 says a paper fax is not a transmission by electronic media when the information was not in electronic form just before it was sent. Neither is a cover sheet rule.

Two HHS FAQs give fax examples, one on faxing to another physician's office and one on treatment communications by fax, e-mail or phone. The safeguards HHS names are confirming a number you do not use often with the recipient, pre-programming the numbers you do use, and keeping the machine somewhere secure. Neither FAQ mentions a cover sheet.

Where an organization expects a sheet, its own policy says so. The Defense Health Agency (DHA) privacy office advises military health facilities, in an October 2024 paper, to create a special cover sheet for faxes that carry patient information, with eight items at a minimum. Washington University's HIPAA Privacy Office tells staff to always use one and to keep protected health information (PHI) off it.

Which fields belong on the sheet, and which stay off?

Both policies put a sheet on every fax that carries patient information. Six fields do the work, and HIPAA prescribes none of them:

Field	On the sheet?	Why
Recipient's name and fax number	Yes	Pairs the person with the number you confirmed before sending
Your practice's name, phone and return fax	Yes	Gives a wrong recipient someone to call
Date and time sent	Yes	Ties the sheet to one transmission
Page count, cover included	Yes	The DHA paper has the receiver check the pages that arrived against it
Subject naming the kind of document	Yes	"Records request" says what is attached and names no patient
Confidentiality notice	Yes	Asks a wrong recipient to call you and destroy the pages
Patient's name, date of birth, record number, diagnosis	No	Page one is the page a wrong recipient reads first

A free template from Fax Pigeon has the six fields, a confidentiality notice and no patient field. Download the fillable PDF or the Word file.

A payer's own form may set the fields. The cover sheet notes on the Cigna and Express Scripts pages keep patient details behind the sheet.

Should the patient's name go on the cover sheet?

No. Page one is the page a stranger reads first when a fax reaches the wrong number. The breach rule presumes that a disclosure the Privacy Rule does not permit is a breach unless the practice shows a low probability that the information was compromised, through a risk assessment of at least four factors (45 CFR 164.402). The first is the nature and extent of the information involved, including the types of identifiers. The third is whether the information was actually acquired or viewed. A stranger who stops at a sheet with no name, birth date, record number or diagnosis has seen nothing that names a patient. Neither the DHA's eight items nor Washington University's list includes a patient field.

Does a confidentiality notice make a fax HIPAA compliant?

No. Parts 160 and 164 prescribe no fax notice and no wording, and a fax that reaches the wrong number goes through the same 164.402 risk assessment whatever page one says. The notice earns its place after a misdial. The DHA paper has the sender contact the wrong recipient at once and ask for the fax to be destroyed, and a notice can get the stranger to call first. That call lets the practice ask whether the pages were read and confirm they were destroyed. Those answers go to the third factor and to the fourth, the extent to which the risk has been mitigated. One version:

CONFIDENTIAL. These pages are for [recipient's name] at [their fax number]. If you are anyone else, please call [your phone number], tell us how many pages arrived, then shred every one.

Can HIPAA fine you for a missing cover sheet?

Not for the sheet itself. HHS imposes a civil money penalty when a covered entity "has violated an administrative simplification provision" (45 CFR 160.402(a)), a term 160.103 defines as a requirement or prohibition set by the statute or the rules. Parts 160 and 164 contain no cover sheet requirement and no field on one. The provisions that do bear on faxing include the safeguards standard in 164.530(c), the breach notification rules in 164.400 to 164.414 and, for a service that keeps your faxes, the business associate rule in 164.502(e).

Fax.Plus's HIPAA cover sheet page says otherwise. It lists the patient's name or a reference number among its mandatory fields and says skipping any field "can lead to fines of up to $50,000 per violation." Its own HIPAA fax requirements page says no specific rule requires a cover sheet.

What does HIPAA require of the fax service?

A written agreement, when the service keeps your patients' faxes. A business associate is a person who "creates, receives, maintains, or transmits" protected health information on a covered entity's behalf (160.103). A covered entity may let one do that if it obtains satisfactory assurance that the information will be safeguarded, documented in a written contract or other written agreement (45 CFR 164.502(e)). An online fax service that keeps a practice's sent and received faxes maintains them. No cover sheet stands in for the BAA.

Who should switch?

A practice that faxes patient information on a plan with no BAA has a bigger gap than any sheet closes. Fax.Plus's 200-page Basic plan is $6.99 a month billed annually, and its HIPAA fax requirements page says the Free, Basic, Premium and Business plans should not be used for PHI. It signs a BAA only on Enterprise, which its pricing page lists from $79.99 a month billed annually for 4,000 pages.

Fax Pigeon's Basic plan is $4.99 a month billed annually for 200 pages, and Premium is $49.99 a month billed annually for 5,000, each with a signed BAA, executed at signup. Every plan also includes unlimited people at no extra cost and a delivery certificate for every delivered fax. The pricing page lists all six plans, and Is Fax.Plus HIPAA compliant? has the plan-by-plan detail.

* Prices last verified October 7, 2026, at each provider's own site. Fax Pigeon is not affiliated with Fax.Plus or Alohi.

Frequently asked questions

Is a fax cover sheet required by HIPAA?: No. The words 'cover sheet' appear nowhere in 45 CFR Parts 160 and 164. HIPAA requires reasonable safeguards for protected health information (45 CFR 164.530(c)), and the fax examples HHS gives are confirming the number with the recipient, pre-programming frequent numbers and keeping the machine in a secure place. A cover sheet is a safeguard a practice adds by its own policy.
What should be on a HIPAA fax cover sheet?: Six items: the recipient's name and fax number, your practice's name, phone and return fax, the date and time, the page count with the cover included, a subject that names the kind of document, and a confidentiality notice. HIPAA prescribes none of them. Keep the patient's name, date of birth, record number and diagnosis on the pages behind the sheet.
Should a fax cover sheet include the patient's name?: No. Page one is the page a wrong recipient reads first, and the breach rule's risk assessment weighs the nature and extent of the information involved, including the types of identifiers (45 CFR 164.402). Washington University's HIPAA Privacy Office tells staff to keep protected health information off the cover sheet. Put the name, date of birth and record number on the pages behind it.
Can you be fined for not using a fax cover sheet?: Not for the sheet itself: no HIPAA rule requires one. HHS imposes a civil money penalty when a covered entity 'has violated an administrative simplification provision' (45 CFR 160.402(a)), a requirement or prohibition in the statute or the rules (160.103). The provisions that bear on faxing include the safeguards standard (164.530(c)), the breach notification rules (164.400 to 164.414) and, for a service that keeps your faxes, the business associate rule (164.502(e)).
Does a HIPAA disclaimer on a fax make it compliant?: No. 45 CFR Parts 160 and 164 prescribe no fax disclaimer and no wording, and a fax sent to the wrong number still goes through the breach rule's risk assessment (45 CFR 164.402) whatever the notice says. The notice's use is practical: it asks a wrong recipient to call you and destroy the pages. What the rules ask of a fax service that keeps your faxes is a written business associate agreement (164.502(e)).
Do I need a BAA with my online fax service?: Yes, when the service keeps your patients' faxes. A vendor that creates, receives, maintains or transmits protected health information on your behalf is a business associate under 45 CFR 160.103, and 164.502(e) requires the assurances to be documented in a written contract or other written agreement. Fax Pigeon includes a signed BAA on every plan, executed at signup, from $4.99 a month billed annually for 200 pages.

Fax Pigeon

HIPAA-compliant fax with a signed BAA on every plan

Plans start at $4.99 a month, billed annually, for 200 pages, with your own number and unlimited people. Your first fax is free.

Free porting of your local number
Fax from your email
AI summary of every inbound fax
E-signatures
Contact management
Delivery proof

Plans and pricing

Know a practice that still faxes? Refer it through the referral program and earn 20% of its plan, every month it stays.