Is a fax number PHI under HIPAA?

A fax number is protected health information (PHI) when it belongs to the patient, or to a relative, employer or household member, and sits with information about the patient's care. It is the fifth of the 18 identifiers in 45 CFR 164.514(b)(2)(i). A clinic's or pharmacy's published line is not PHI by itself.

A fax number turns up in three records a practice keeps: the cover sheet, the log of sends and the delivery certificate that shows a fax arrived. Whose number it is comes first, and what else the record holds settles the rest.

What does the rule list?

Section 164.514(b)(2)(i) lists 18 identifiers that must be removed under the safe harbor method of de-identification. Names are item (A), telephone numbers item (D) and fax numbers item (E), the fifth. Fax numbers have been on the list since the Privacy Rule of December 28, 2000 (65 FR 82818). The list keeps the year of a date (item C) and the first three digits of a ZIP code in an area of more than 20,000 people (item B). It keeps no part of a fax number.

Whose number counts?

The list does not reach every fax number. Its opening words set the scope: the identifiers are those "of the individual or of relatives, employers, or household members of the individual." A home fax the patient gives as their own is on the list, and so is a spouse's, a parent's or an employer's line. A pharmacy's line belongs to none of these groups. A clinic's line belongs to one only when the clinic employs the patient.

Health information is the second half of the test. Under 45 CFR 160.103 it is information that a health care provider, health plan, employer or clearinghouse creates or receives about a person's health, care or payment for care. It is protected when it identifies the person or gives a reasonable basis to believe it can. HHS's de-identification guidance of November 26, 2012 applies that to contact details. A phone number alone is not necessarily PHI, and HHS's example is a listing in a phone book. The number becomes PHI beside care or payment data, as when a record shows the person was seen at a certain clinic.

The table applies both halves to six example records.

A record with a listed identifier of the patient beside information about the patient's care is PHI. The payer rows carry none, and the last row is where masking matters.

Does taking out the number end the question?

No. Health information is not individually identifiable when it does not identify the person and nothing gives a reasonable basis to believe it can (164.514(a)). The safe harbor is one route to that result: every listed identifier removed, and no actual knowledge that what remains could identify the person (164.514(b)(2)). A record that still names the patient is not de-identified, whatever happens to the number. HHS declined in 2000 to adopt a standard that removed only direct identifiers, because the result "would often remain identifiable" (65 FR 82708).

A limited data set drops fax numbers along with the other direct identifiers and is still PHI (164.514(e)(2)). The other route, expert determination, asks a qualified expert to find and document that the risk of identifying anyone is very small (164.514(b)(1)).

What about a cover sheet?

A cover sheet that names a payer and carries the practice's own return number, with no patient named, holds no identifier of the patient. A sheet that names the patient, goes to the patient's own home fax and concerns their care holds at least two of the 18: the name at item (A) and the number at item (E). That sheet is PHI. The cover sheet guide sets out what goes on a sheet, and why the patient's name stays off it.

What about a fax log?

A log row can hold a name, a number, a date and a page count. On a row that names a patient and lists a pharmacy's line, the number belongs to the pharmacy and adds nothing to the count. The row is still PHI. The name is item (A), and the row records a fax about the patient's care. The send date adds item (C) when it is tied to the patient. A row that pairs the patient with the patient's own number adds item (E) to the same line.

The retention guide covers the periods that apply to fax records. A log also records the number each fax went to. When one went to the wrong number, the wrong-number page explains the breach test.

What about the masked number on a delivery certificate?

Every plan includes a delivery certificate for every delivered fax. Its five fields are the date and time, the pages transmitted, the call duration, a confirmation ID and the recipient number partly masked. None is a name.

A payer's or pharmacy's line is outside the list, masked or not. A patient's own line is item (E), and masking does not make it a removed identifier. HHS's guidance asks whether parts of a listed identifier may be disclosed under the safe harbor and answers no, with the last four digits of a Social Security number as its example. Part of a fax number is part of item (E) in the same way.

That settles the safe harbor. Whether a given certificate is PHI is the 160.103 question: does the record identify the patient, or give a reasonable basis to believe it can? A certificate filed in a patient's chart beside the fax it proves is part of a record that does.

Does the fax service behind these records need a BAA?

Yes, when it keeps the faxes. A service that stores a covered practice's faxes is a business associate under 45 CFR 160.103, and 164.502(e) calls for a written contract or other written agreement; the BAA guide covers the conduit exception. Every Fax Pigeon plan includes a signed BAA, executed at signup.

* Fax Pigeon prices and plan terms as of October 14, 2026.