Does HIPAA require a cover sheet when faxing medical records?

HIPAA does not explicitly mandate a cover sheet, but it requires covered entities to implement reasonable safeguards when transmitting PHI. Using a cover sheet with a confidentiality notice is the industry-standard safeguard recognized by HHS and most compliance programs.

What information should be on a fax cover sheet for medical records?

Include sender name and organization, sender fax and phone number, recipient name and fax number, patient name and reference number, date, total page count, a brief description of the records, and a HIPAA confidentiality disclaimer with instructions for misdirected faxes.

Can I put patient diagnosis details on the cover sheet?

No. The cover sheet should include only the minimum necessary information — typically the patient name and reference number. Detailed diagnoses, medications, or test results belong in the attached medical record pages, not on the cover sheet where they are more exposed.

What should I do if a medical records fax goes to the wrong number?

Contact the unintended recipient immediately and request that all copies be destroyed. Document the incident and conduct a HIPAA breach risk assessment. Depending on the circumstances, you may be required to notify the affected patient and the HHS Office for Civil Rights within 60 days.

Is a digital fax cover sheet HIPAA-compliant for medical records?

Yes, provided the fax platform implements appropriate safeguards and you have a signed Business Associate Agreement (BAA) with your provider. [mFax Business](https://mfax.to/business/) includes HIPAA-ready infrastructure and BAA support for healthcare organizations.

Fax Cover Sheet for Medical Records: HIPAA-Compliant Template

A fax cover sheet for medical records must include a HIPAA confidentiality notice, patient reference, and sender/recipient details. Download our free template and learn exactly what to include to stay compliant.

Frequently Asked Questions

Does HIPAA require a cover sheet when faxing medical records?: HIPAA does not explicitly mandate a cover sheet, but it requires covered entities to implement reasonable safeguards when transmitting PHI. Using a cover sheet with a confidentiality notice is the industry-standard safeguard recognized by HHS and most compliance programs.
What information should be on a fax cover sheet for medical records?: Include sender name and organization, sender fax and phone number, recipient name and fax number, patient name and reference number, date, total page count, a brief description of the records, and a HIPAA confidentiality disclaimer with instructions for misdirected faxes.
Can I put patient diagnosis details on the cover sheet?: No. The cover sheet should include only the minimum necessary information — typically the patient name and reference number. Detailed diagnoses, medications, or test results belong in the attached medical record pages, not on the cover sheet where they are more exposed.
What should I do if a medical records fax goes to the wrong number?: Contact the unintended recipient immediately and request that all copies be destroyed. Document the incident and conduct a HIPAA breach risk assessment. Depending on the circumstances, you may be required to notify the affected patient and the HHS Office for Civil Rights within 60 days.
Is a digital fax cover sheet HIPAA-compliant for medical records?: Yes, provided the fax platform implements appropriate safeguards and you have a signed Business Associate Agreement (BAA) with your provider. [mFax Business](https://mfax.to/business/) includes HIPAA-ready infrastructure and BAA support for healthcare organizations.