How to fax medical records to another provider securely (HIPAA)

A provider may fax a patient's records to another provider for treatment without the patient's authorization when reasonable safeguards are in place, such as confirming the fax number and pre-programming numbers used often. Psychotherapy notes need the patient's authorization, and Part 2 substance use disorder records travel with a copy of the consent or a clear explanation of its scope.

Can you fax medical records to another provider without the patient's authorization?

A provider can fax a patient's records to another provider without the patient's authorization when the records are for that provider's treatment of the patient. HHS says so in its FAQ on sending records to a specialist, and the regulation's treatment provision, 45 CFR 164.506(c)(2), lets a covered entity disclose protected health information for the treatment activities of a health care provider.

The permission comes with a condition: reasonable safeguards. HHS's FAQ on faxing to another physician's office names two, confirming that the number is the correct one for the other office and keeping the fax machine in a secure location. Its FAQ on treatment communications adds two more: pre-program frequently used numbers to avoid misdirecting the information, and confirm a number that is not regularly used with the intended recipient first. The same FAQ says treatment communications may go by phone, fax or email.

Who asks for records, and what lets you send them?

Records requests reach a practice from another provider for treatment, from the patient for their own copy or for a copy sent to someone else, and from an attorney or insurer holding the patient's authorization, and each request rests on a different permission. The table matches each requester with what lets the practice send and the clock that runs.

An authorization works only when it is complete. 45 CFR 164.508 requires it to name or specifically identify the person or class of persons who may receive the records and to describe each purpose. It is not valid once its expiration date has passed, or when a required element was left blank. HHS's FAQ on copies of authorizations says a copy of a signed authorization, including one received by fax, is valid.

A cover letter from the requester can narrow an authorization and cannot widen it. HHS's FAQ on authorizations used with other instructions says a transmittal or cover letter can narrow or give specifics about the request, but it cannot expand the authorization's scope. When HIPAA needs patient consent to fax records sorts the purposes that need none.

What should go in the fax, and what should stay out?

A treatment fax can carry what the receiving provider needs, because the minimum necessary standard in 45 CFR 164.502 does not apply to disclosures to a health care provider for treatment. Psychotherapy notes are the exception that stays out. HHS's FAQ on mental health information says that, with few exceptions, the Privacy Rule requires the patient's authorization before psychotherapy notes are disclosed for any reason, including treatment by a provider other than the originator of the notes.

The definition in 45 CFR 164.501 is narrow. Psychotherapy notes are a mental health professional's notes documenting or analyzing the contents of conversation in a private, group, joint or family counseling session, kept separate from the rest of the record. Medication prescription and monitoring, session start and stop times, the modalities and frequencies of treatment, clinical test results and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress to date fall outside it. How HIPAA protects psychotherapy notes covers the separate-file rule.

Part 2 substance use disorder records carry their consent with them. HHS's fact sheet on the 2024 Part 2 final rule says the rule requires each disclosure made with patient consent to include a copy of the consent or a clear explanation of its scope, and persons subject to Part 2 have had to comply since February 16, 2026. 42 CFR 2.32 gives a short notice that may accompany such a disclosure: "42 CFR part 2 prohibits unauthorized use or disclosure of these records."

State law can add conditions. Under 45 CFR 160.203(b), a state privacy law that is more stringent than the Privacy Rule stays in force.

How do you send records safely and prove they arrived?

A records fax goes out safely when the sender confirms the number before sending, puts a confidentiality statement on the cover page and keeps a record of the transmission. HHS's safeguards above cover the number and the machine, and they name no cover-sheet wording. A fuller checklist comes from the Defense Health Agency's October 2024 information paper for Military Health System covered entities.

That paper tells a sender faxing an entity for the first time to telephone it, alert it to the fax, confirm the number and find out whether the machine sits in a secure area. Its cover-sheet items include a line instructing the receiver to verify receipt and a confidentiality statement. It also asks for a record of each PHI fax: the date and time, the intended recipient, the contents and the number at which receipt was confirmed.

HHS's FAQ on documenting communications says the Privacy Rule does not require documentation of information used or disclosed for treatment, payment or health care operations. The transmission record is still the sender's proof of where the pages went. Social Security's Electronic Records Express FAQ sets the same bar for records sent to it: the fax should show a successful transmission, including the number of pages.

A fax sent from a computer falls under the Security Rule. The definition of electronic media in 45 CFR 160.103 excludes a paper fax only when the information did not exist in electronic form immediately before it was sent, so records faxed from a computer travel as electronic protected health information. HHS's cloud computing guidance lets a covered entity use a cloud service for that information when the service signs a business associate agreement.

What deadlines apply to records requests?

HIPAA sets no deadline for a treatment fax to another provider, and it gives 30 days to act on a patient's own request for access, with one extension of no more than 30 days. Under 45 CFR 164.524, the extension needs a written statement to the patient, inside the first 30 days, that gives the reasons for the delay and the date the request will be completed. Only one extension is allowed. How to respond to a medical records request by fax walks through that clock.

The breach clocks start at discovery. Under 45 CFR 164.404, notice to each affected patient is due without unreasonable delay and no later than 60 calendar days after discovery, and a breach counts as discovered on the first day it is known or, by exercising reasonable diligence, would have been known. HHS's breach notification page says breaches affecting fewer than 500 individuals are reported to the Secretary no later than 60 days after the end of the calendar year in which they are discovered.

What mistakes turn a records fax into a breach?

A records fax becomes a presumed breach when it reaches a recipient the Privacy Rule does not permit, such as an office at a wrong number, unless a risk assessment shows a low probability that the information was compromised. 45 CFR 164.402 requires that assessment to weigh at least four factors, among them whether the information was actually acquired or viewed and how far the risk has been mitigated.

The Defense Health Agency paper tells a sender who discovers that PHI went to the wrong number to contact that recipient immediately and ask that the fax be destroyed. HHS's breach notification page asks the covered entity to keep documentation that every required notice went out, or that none was required, such as the risk assessment. Is a fax sent to the wrong number a HIPAA breach? covers the risk assessment step by step.

The rules above name the mistakes to avoid: a new number nobody confirmed, a frequently used number keyed by hand instead of pre-programmed, psychotherapy notes sent on a treatment request, Part 2 records sent without the consent or its explanation, an expired or incomplete authorization, and a cover letter that tries to widen an authorization.

How does the same job work for a patient's request, an attorney or a payer?

The same records fax runs on the patient's signed request for a directed copy, on a valid HIPAA authorization for an attorney or insurer, and on the payment and operations permissions for a payer. A patient's directed copy needs a request in writing, signed by the patient, that clearly identifies the person and where to send the copy, under 45 CFR 164.524. HHS's FAQ on directing records to a third party says a provider may accept a faxed or mailed copy of the signed request, an electronic copy, or a request signed through a secure portal.

That directive is narrower than the regulation's text. HHS's page on the court order says a federal court on January 23, 2020 vacated the third-party directive insofar as it goes beyond requests for an electronic copy of an electronic health record, and that the access fee limit does not apply to a request to send records to a third party. HHS marks its third-party access FAQs as in effect only to the extent they are consistent with that order.

A payer's review rides other permissions. Under 45 CFR 164.506(c)(3), a covered entity may disclose information to another covered entity or provider for the payment activities of the one that receives it. HHS's FAQ on disclosures to health plans allows disclosure to a plan for its quality-related operations, such as HEDIS reporting, when the plan has or had a relationship with the patient.

How do you send records from a HIPAA fax account?

Records leave a Fax Pigeon account under the BAA signed at signup, and a PDF exported from the chart uploads as it is, from the browser or by email. Because the cover sheet is optional, the practice's own cover page, with its confidentiality statement and a line asking the receiver to verify receipt, can lead the fax. Delivery proof for each delivered fax belongs in the log of what was sent and to whom. The records team works from one number and one shared inbox with roles and assignment, and adding a person costs nothing.

* Official sources (HHS, the eCFR) were read on October 19, 2026. Fax Pigeon prices and plan terms as of October 20, 2026.