Do you need patient consent to fax medical records?

HIPAA requires no patient consent and no signed authorization to fax medical records for three purposes: treatment, payment and health care operations (45 CFR 164.506; HHS FAQ 356 and 482). Most other disclosures need a signed authorization, and psychotherapy notes need one even when the recipient is treating the patient (164.508). A patient can ask for a different number or means of delivery (164.522(b)), and a stricter state law can add a consent rule of its own (160.203).

When can you fax records with no patient signature?

Section 164.506 lets a covered entity disclose protected health information for its own treatment, payment and health care operations, for another provider's treatment, and for the payment activities of whoever receives the information. Disclosures for another covered entity's operations qualify only in narrow cases (164.506(c)(4)). Treatment includes consultation between providers and referral from one provider to another. Payment includes precertification and preauthorization (164.501).

HHS FAQ 482 says covered providers may share protected health information for treatment by phone, fax or email without patient authorization, with reasonable safeguards, and its examples include a physician faxing a patient's record to a specialist who will treat the patient. FAQ 356 names a safeguard for a fax: the sender confirms the number is the right one for the other office (164.530(c)).

Consent is a separate, optional step: a covered entity may obtain it for these three purposes, and HHS says it is not required to. A consent form cannot stand in for an authorization (164.506(b)). Two limits apply whether or not the practice obtains consent. The minimum necessary standard covers payment and operations, so a fax to a plan carries what the payment needs rather than the full record, but it does not cover a disclosure to a provider for treatment (164.502(b)). And HHS says each disclosure has to be consistent with the practice's notice of privacy practices.

Which faxes need a signed authorization?

A fax needs a signed authorization when the Privacy Rule does not otherwise permit or require it (164.508(a)(1)). HHS's examples are records to a life insurer for coverage, pre-employment test results to an employer and a drug company's marketing. Three kinds of disclosure carry their own authorization rule, which overrides the permission for treatment, payment and operations: psychotherapy notes, marketing and a sale of protected health information (164.506(a), 164.508(a)(2) to (4)).

Psychotherapy notes are narrower than a therapist's chart. The definition covers a mental health professional's notes of counseling sessions kept apart from the rest of the record. It leaves out medication prescription and monitoring, session start and stop times, treatment modalities and frequencies, clinical test results and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis and progress (164.501). HHS adds that psychotherapy notes do not include any information maintained in the patient's medical record. How psychologists fax evaluation reports shows how that line applies to an evaluation report.

What can a patient ask you to change about how you fax?

Section 164.522 gives a patient two requests.

A restriction request (164.522(a)) asks the practice to limit disclosures for treatment, payment or health care operations. The practice may say no, but once it agrees it is bound, apart from emergency treatment. One request it must accept comes from a patient who pays for a service in full out of pocket and asks that it not go to a health plan for payment or operations, unless a law requires the disclosure (164.522(a)(1)(vi)).

A confidential communications request (164.522(b)) is about how the practice reaches the patient, and a fax to the patient needs no authorization (164.502(a)(1)(i)). A provider must accommodate a reasonable request to receive protected health information by alternative means or at alternative locations. HHS's examples are a designated address or phone number and a closed envelope instead of a postcard. The practice may require the request in writing and an alternative address or method of contact, and may not ask why (164.522(b)(2)). The request covers what the patient receives from the practice. What goes to other providers falls under the restriction request.

Does state law change the answer?

It can. A state privacy law that is more stringent than the Privacy Rule is not preempted (160.203(b)). Section 160.202 treats a law as more stringent when it restricts a disclosure the Rule would allow or sets stricter terms for the patient's permission, and HHS's summary of the Rule lists the same exception. A state statute that asks for the patient's written permission before records go to another provider would govern that fax, although 164.506 asks for none. Your state's statutes and licensing board say whether yours does.

How do you collect an authorization and keep the record?

An authorization carries the patient's signature and date among its core elements (164.508(c)(1)(vi)), and HHS says it can be obtained electronically if any electronic signature is valid under applicable law. When the patient starts the request, the purpose can read "at the request of the individual" (164.508(c)(1)(iv)). A covered entity that seeks an authorization must give the patient a copy of the signed form (164.508(c)(4)), and it must keep any signed authorization for six years from the date it was created or last in effect, whichever is later (164.508(b)(6), 164.530(j)).

Every Fax Pigeon plan includes e-signatures, so a release can be signed and sent without printing. It also includes a delivery certificate for every delivered fax. The certificate is your proof of delivery: file it with the authorization or the request that prompted the fax. A fax that goes on a patient's accounting of disclosures also needs the date, the recipient, a description of what was sent and its purpose (164.528). Treatment, payment, operations and authorized disclosures stay off the accounting.

A fax service that keeps your faxes maintains protected health information for you, which makes it your business associate (45 CFR 160.103). Every Fax Pigeon plan includes a signed BAA, executed at signup, and plans start at $4.99 a month billed annually for 200 pages.

* Fax Pigeon prices and plan terms as of October 11, 2026.