HIPAA

Hi and welcome to the presentation on hipaa, the Health Insurance Portability and Accountability Act. HIPAA was passed by Congress in 1996. Portability means your ability to transfer health insurance coverage. Accountability is designed to prevent health care fraud and abuse. Administrative simplification, decreased costs and administrative burdens were supposed to be repealed. HIPAA Privacy Rule was created because of increased risks for invasion of privacy, a public and congressional concern about healthcare privacy, support for the provider patient relationship, the need to develop national standards to protect protected health information, the need to establish national boundaries on the use and release of health records, the need for appropriate safeguards for protection of protected health information or phi the need to define what's able to be disclosed for public health purposes and the need to create some meat, if you will, to some of these regulations by creating civil and criminal penalties. According to the HIPAA Privacy rule, individuals have a right to an accounting of disclosures. That means every individual you serve has a right to ask you who you gave information to, what kind of information you gave them, and on what day and time you gave that information. With the very few exceptions, it's necessary at minimum to have a release of information from the client. When we do our intakes at our clinic, we have our standard release of information if we need to talk to lawyers or doctors, etc. But we also have a blanket release of information that goes over the rules for when we're allowed to break confidentiality without getting a new signed release of information. For example, if there's imminent danger to self or others and this includes a medical emergency or in our state when we are court ordered by a judge. Those are two examples of when we may have to disclose protected health information without first obtaining a release from the client. Individuals have rights to a copy of their health record. That doesn't mean you have to give it to them for free. You can charge a per page copy fee. That is reasonable. However, they do have a right to have a copy of their health record and or read their health record. Now this is important because I've seen too many times where clinicians will put stuff in the health record that they don't want the patient to read that is not objective, that is not supported by evidence, and it can come back to bite them in the hiney. Remember that your patient has the right to read everything in the health record. If you're going to put something in there that may be controversial or maybe opinion that's not supported by fact, it's important to know that your client may see that. So what am I saying don't put anything in there that you don't want your client to see. Every once in a while you need to put something in there that the client may not like. Which takes us to our next thing. The client has the ability and the right to request corrections to the record. At the agency that I used to work at, we had a process where they would file a form, indicate what was incorrect in their opinion in their record, and then it would go to the counselor. The counselor would have the option to say, sure, I'll change that, you know, I agree with you, or no, I'm still standing on my diagnosis, or our rationale for discharging you or whatever it is. Then it was referred to a committee that was staffed by all of our C level executives. They would review the information to determine whether or not the record would be changed. Now, the client's request for the change in the record would always be part of the record, henceforth and forevermore. However, we wouldn't necessarily always change the record if we believed that the record was accurate. Your agency needs to make sure they have defined policies on how to handle requests for corrections. Individuals have the right to control some uses and disclosures of protected health information. This is why we have them sign a release. When you have them sign a release, it's important to identify on the release what types of information are going to be given, whether you're just calling the probation officer and confirming attendance at treatment or whether you're sending over a copy of the original psychological assessment. Very, very different individuals have the right to file complaints with an office for civil rights. They have the right to submit written requests for notice of information. They have the right to have reasonable requests for confidential communication of phi accommodated reasonable requests for confidential communication, which most of us are not going to have a problem with maintaining confidentiality. One of the big things comes up, one of the big issues. If you have a private pay client who is whose treatment is being paid for by their parent or by someone else who is a private payor, not an insurance company, and they want information. It's actually less tricky if your client is a juvenile. But if your client is over the age of 18, maybe they're just 18, then there are often sticky things that come up with regard to that. So it's very, very important to communicate with the client and very, very important to communicate with your risk management department and your attorney so as not to inadvertently say something or not say something when it was approved. Who and what is covered? Healthcare providers, government and private health plans Healthcare clearinghouses and business associates of healthcare providers, government and private health plans and healthcare clearinghouses. Business associates means everything from the people who handle your web traffic and your database management to the people who shred your data. If you send all of your shredding out to somewhere, anyone who may potentially have access to that information or access to a way to access that information is a business associate and they will need to sign a business associate agreement. This is something that often gets overlooked, but it is imperative. That also means, as I heard from someone, that is very important to make sure you know exactly who has access to everything from your charts to the paperwork that gets thrown away. Health information is oral or recorded information that is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or healthcare clearinghouse. It relates to the past, present and or future physical or mental health or other health condition. It may concern the provision of health care as it relates to the past, present or future payment. PHI is defined as health information that is individually identifiable and transmitted or maintained in any form or medium. So health information is a broad array of things that relate to physical and mental health acquired by pretty much anybody. Anybody who has business asking you that is probably collecting health information is protected to the extent that it can't if it's individually identifiable. So if we say that 3% of the people in this community have hepatitis, that's not individually identifiable. If we say that three people in this apartment building have hepatitis, that might be more identifiable. I would be really concerned about that level of narrowing. Even though you're not saying which persons, it's possible to extrapolate. This is very important to remember in small communities, if you're dealing with mental health patients, substance abuse, physical illnesses, whatever identifiable information people may be able to extrapolate because they saw John going to your office and then you're talking about the situation that sounds like something that's going on with John or any other number of things. It's always, always, always best to err on the side of not saying anything or being too vague. PHI security is required by law. It earns a patient's trust. If they know that you're not going to be telling everybody and his brother about your business, about their business, then they're going to be more open with you. It enhances the privacy and security of information and sets federal minimum standards and safeguards to protect protected health information. These are minimum standards. Minimum. There are a lot more things that need to be done around your office and a lot of these things are handled in your state requirements as well as contract requirements, say, with the Department of Children and Families, with health care insurance companies, or with accrediting bodies such as CARF or Jacob. PHI preempts weaker state laws. So it may be these regulations, these HIPAA regulations may be stronger than your state laws, or your state laws may have caught up by now. PHI Security does not supersede federal laws or Privacy. Trust impacts the quality of care. The patient's ability to trust you helps you get an earlier insight so you can detect and treat all conditions. It helps you get accurate and complete health records. It helps you provide the highest quality of health care. Because if you don't know some things, you may be missing something. It reduces health care costs because you're not spending three sessions trying to pull teeth, trying to figure out what's going on. It's all being laid out on the table. And patients do not move on from one facility provider to another nearly as much, partly because once they've put all their cards out on the table, they don't want to have to do that again. If patients do not trust us, they don't seek treatment. They give incomplete or inaccurate information. They jump from one provider to another, and they may ask the provider not to record their actual condition because they're afraid somebody who's not supposed to have it will see it. Earn a patient's trust. Know your forms, your policies and procedures. Always respect the patient's right to privacy. Treat all records as if they're your own, and be sensitive to privacy in all situations. One of the things that bugs me the most, one of my little pet peeves, is when I go to the doctor and we sign in with our first and last name and it's not covered up. Or if somebody walks out to call a patient back and they call them by their entire first and last name. Sometimes it's unavoidable, but most of the time you can get away with a first name. There are civil monetary penalties for violation of HIPAA as low as $100 per violation. It can be capped at $25,000 per calendar year per violation. It's enforced by the Office for civil rights up to $50,000 in fine and one year imprisonment for knowingly obtaining or disclosing individually identifiable health information, up to $100,000 and five years in prison if done under false pretenses. For example, if somebody claims they're a physician in order to get information, or claims they're from a health insurance company to get information, then they take this information and they use it for nefarious purposes. Then they can get fined up to $100,000 in five years in prison, up to $250,000 and 10 years in prison meant if done with intent to sell, transfer or use for commercial advantage, personal gain or malicious harm. So whether it's to bolster somebody's divorce proceedings or to sell it to somebody to so they can steal everybody's identity or whatever the reason, a quarter million dollars and 10 years in prison. Non compliance with HIPAA is enforced by the US Department of Justice. It's important that all patients receive a Notice of privacy. Practices that explain the health records are used to plan for care and treatment, communicate among healthcare professions, check results and improve care, verify services, build educate healthcare professionals, improve the health of all people, support medical research, conduct facility planning and marketing, and maintain legal health care records. Reviewing this with patients Explain that patients must understand his or her own health record in order to ensure accuracy, understand why others may review his or her protected health information and make informed decisions regarding disclosures. In the substance abuse facility that I used to work in, we regularly had clients or asked clients to sign releases so we could communicate with their physicians in the community if they had one or any. People most of the time agreed to let us communicate with their physician in the community every once in a while. They didn't, and that was something that we needed to talk over with them about why they didn't want their physician knowing they were in treatment for substance abuse. We couldn't breach their confidentiality if they adamantly said no. However, you do need to make sure that the client knows they have the right to say no. I don't want you talking to so and so and such and such. Explain patients rights to receive and inspect their health records. Request restrictions on who can see or use their health information request corrections and or amendments Request confidential communications. If they want you to call somebody and tell them something, they sign a release of information and you can do so. They have the right to receive a list of disclosures. They have the right to revoke written authorization to disclose or use health information. They have the right to revoke it. And remember, good releases of information have a beginning date and an end date that means they expire. So it's important to check that release before you sign it. Before you release any information on someone whose release of information may have expired. And they have the right to receive a paper copy of the notice of privacy practices. Explain to the patients their responsibilities to maintain privacy of information. Now I may not go out and tell anybody anything about you. But if you go out and you're talking about it on the bus on the way home that you went to see Dr. Smith at this clinic for hepatitis and they diagnosed you with substance abuse, then you pretty much just shared your information on the whole bus. And we can't be held responsible for things that you do for lack of discretion. It's their responsibility to inform individuals about privacy practices. To tell people, you know, in order for my therapist to release that information, I need to sign a release of information. It's important to notify patients if requests for restriction are denied. So if they want you to not say something and maybe they're court ordered and the judge says no, you have to tell us, and you know, you run it through all your legal channels and the judge has the right to do that in your state, then it's very important to let the patient know that I wasn't able to or I'm not going to be able to keep everything, all these things away from the judge. It's important to accommodate reasonable requests for alternative communications. If the patient needs you to write the letter instead of calling them on the phone, or if the patient would prefer for you to, and I use this cautiously, email them using a secure encrypted email. Not Google, not Yahoo. Secure encrypted email. And it's important for them, as well as you to honor all terms of the notice of Privacy practices procedures. If there's an emergency or the patient is incapacitated, note the situation on an acknowledgement form. Sign and date and place and record. So if your patient falls out in the middle of group or while they're in the waiting room, make a note of this. Put it in the record as soon as the patient is capable of signing. Provide it to them to sign if they are willing to. Do not agree to anything verbally. A Notice of Privacy practices must be posted in a public place, inside or outside the facility and or on the website. It's generally common practice to have it on the website and also to give people a hard copy when they come in to do their initial paperwork in order to cover all your bases. Because not everybody is Internet savvy. Written requests for disclosure of health information or for changes in the health record must contain the requestor's name and address, the date of the request, date of birth, description of requested information, and an original signature. All of this has to be correct in order to fulfill the request. We need to verify identity. If Sally is coming to pick up something for her sister Susie. We can't just assume that Sally is Susie's sister. Try saying that three times fast. Just like if you were a notary or some somebody else, you would require verification by picture identification of the person picking up the information. If you're providing information, and this seems like common sense, but I'll say it. If Jane has information that she needs and she wants to send her sister Sally to come get it, you need to have a release of information signed for Sally. You cannot give her even a sealed envelope with all of Jane's Phi in it without having a release of information. So you get the release of information from Jane, and Sally comes to pick up the envelope, and she shows up at the desk and she says, hi, I'm Sally. I'm here to pick up Jane Doe's information. Well, that's wonderful. That all sounds well and good, but then you need to see picture identification verifying that this really is Sally Doe, Jane's sister. Patients requesting their own PHI must have a matching identification. An identification with name change requires supporting evidence. So if somebody gets married, maybe they were in treatment with you two years ago as Jane Doe, and they got married and now they're Jane Smith, and they want their information from two years ago when they were Jane Doe, well, they have to provide a picture ID showing who they are and proof of their legal name change from Doe to Smith. Law enforcement officials who are trying to access Phi must show official identification and the request or court order requesting the release of Phi. In certain states, not all requests, even if issued by a law enforcement officer, can be fulfilled under hipaa. Some states, like Florida, require the information or the request to be signed by a judge. Be very, very clear on what your state rules are, because you may be held in contempt of court, Attorney, attorney's assistants, or insurance companies must show valid photo ID and their authority. So a picture ID of themselves so you know that they are who they say they are, and then some way to verify that they're working for that company and their proof of authority to act. So they need, if it's an attorney, they need to have a contract signed by the client. You also need to have a release of information for that person from the client. Other individuals trying to access Phi must have a photo ID matching the individual named on the release of information. For example, if Jane Doe wants you to communicate information to her mother, June Doe, then that's fine. She has to sign the release of information. But then we need to confirm that the person we're talking to is June Doe. Providing phi to parent, guardian or personal representative. Verify the identity of the requester and verify the relationship. You need to see either a birth certificate, court order, previously provided, evidence in the medical record, or other evidence of the relationship. The only time that this is not necessarily important is if you're sitting in a room with Jane Doe and her mother June comes and you're having sort of a family session. I always like to go over ahead of time with the client what kind of information we're going to release and talk about in the family session and get a signed release of information that I can divulge certain information in front of this person. I prefer to be safe rather than sorry. When receiving requests for PHI in an emergency, obtain requesting provider's name, facility name, location and telephone number. So maybe Jane Doe is a patient in your methadone clinic and she is brought to the emergency room and she can't. She's groggy, she can't say much, but they figured out that she was a patient at your methadone clinic. The emergency room calls the clinic to verify dosage or whatever they need. You need to know. You need to be able to verify that this is a hospital, that this is a person working at a hospital, and get their telephone number, then call them back. Verify the telephone number actually goes to the hospital. Don't call a number that's allegedly some nurse's cell phone. Make sure that you're calling the facility you think you're calling and talking to the person that you think you're talking to. Document the call and the identity of the individual who received the call, information being sought or requested, the reason for the request, and provide the minimum necessary protected health information. Don't go into all of Jane's business if they're just requesting what her methadone dosage is and when the last dose she had was. Provide additional information requested as in a non emergency. So if they want to know all her background information and everything that's not really vital to this particular situation, wait until you have appropriate documentation. Signed verification of identity with regard to a subpoena or court order. When receiving requests for phi via court order, refer to your area health records consultant or regional attorney. Again, not all areas are the same and it's vital to know in your area who has to sign that document in order to override the need for a release of information. It's also important, I'll put in my little two cents here, that the law enforcement agencies and the people who serve, you know, different places use different agencies to serve warrants, etc. That they understand HIPAA and PHI and what they're able to request. That way you don't end up with situations where counselors are getting arrest arrested for obstruction when they were just trying to maintain a client's confidentiality. They were just in error because they didn't realize that the officer had the authority to get that information, etc. A required stamp or label on all PHI disclosures. This information has been disclosed to you from records whose confidentiality is protected by federal law. Federal Regulations 45 CFR Part 2 prohibit you from making any further disclosure of it without specific written consent of the person to whom it pertains or is otherwise permitted by such regulations. A general authorization for the release of medical or other information is not sufficient for this purpose. That has to be on everything. That doesn't mean that just sticking that on something puts you in compliance with hipaa. Just sticking that at the end of your email that is not secure and encrypted. That's not acceptable. That doesn't mean that you are in compliance. That means you put a bunch of gobbledygook at the end of your unsecure email when you're emailing, even if your email is secure. And make sure that you talk with your tech people about this. If your email is secure but you're emailing to someone who doesn't have a secure email, such as a probation officer, then you're violating hipaa because as soon as it leaves the secure channels, it's going all through unsecure channels. HIPAA violation, Required stamp or label on alcohol or substance abuse disclosures I won't read this one to you. You can pause the video if you want to read it more. It's important to note the sentence at the bottom that says Federal rules restrict any use of the information to criminally investigate or prosecute any alcohol or drug abuse patient. Progress Notes Notes recorded by a mental health professional that document or provide analysis of conversations that were held in private, in group, or in joint or family counseling sessions. Progress notes should be maintained separate from the medical record. They're owned by the mental health professional who recorded them. Psychotherapy notes do not include medication, prescription and monitoring. Counseling sessions Start and stop times, modalities and frequencies of treatment furnished results of clinical tests, including drug tests, summary of diagnosis, functional status, treatment plans, symptoms, prognosis or progress to date. So your general information is not going to be protected. In some states, urine drug test results may be protected. Again, check with your attorney. Generally that falls under clinical tests though. Use of psychotherapy notes no authorization required if it's used by the originator of the notes for treatment. So if you don't need a release to use your own notes for treatment if its use or disclosure is used for supervised mental health training programs. So if you are going to receive supervision because you're an intern or because you just think you need supervision on this particular case, you may use those notes provided you are communicating with another business associate or person that's covered under hipaa. Use or disclosure in legal actions or proceedings initiated by the individual. So if they sue you, at least as it stands right now, you have the right to use information from your progress notes. Use or disclosure that's required by law. Authorized disclosure to a health oversight authority with respect to the oversight of the originator of the psychotherapy notes and used to report a serious and imminent threat to the health and safety of the patient or a third party danger to self or others. Disclosure required by the Secretary of the Department of Health and Human Services to investigate facility compliance with HIPAA and certain disclosures about deceased patients to concerns or medical examiners to coroners or medical examiners. Again, if in doubt, ask your attorney or your risk manager. Phi of Minors Request by parents, guardians or in local parentis where the law prohibits you shall not disclose the minor's phi to the parent, guardian or in loco parentis. Where the law permits you may disclose the minor's protected health information to the parent, guardian or in loco parentis unless parental rights have been terminated. Disclosure might endanger the minor or disclosure is not in the best interest of the minority. It's vital to understand what legal relationship this child has with this parent. If their parental rights have been terminated, then technically they're not the parents anymore. It's also important to weigh whether disclosure is going to be in the best interest of the minor. Where state law permits you may disclose the minor's phi to the parent or guardian unless the minor has consented to to a service where parental consent is not required under state law, the minor has requested parent or guardian not to be treated as a personal representative or the parent or guardian agrees to an agreement of confidentiality between you and the minor. So if parental consent is not required under state law, then you can't disclose the minor's protected health information without a release. If the minor has specifically said I don't want you telling my mom and dad this, then you need to respect that unless something else supersedes it. Health information management director or designee shall determine whether or not to release a minor's protected health information to the minor's parent or guardian. In these cases, especially when you're dealing with minors, it's usually best to consult and to allow your Risk management risk manager to either be in the room and accompany you in the disclosure of the information or to do the disclosure himself or herself. I found that generally works best because then there's no he said, she said after the fact. All requests must be made in writing for correction or amendment of a record. The CEO or risk manager will date stamp the form. The patient receives a copy of the date stamped form within 10 business days. If a decision can be made within 10 business days, then the patient will be notified at the same time he or she receives a date stamped copy of the form. If it takes longer to make a decision about whether you're going to amend the health information, then you will need to provide a separate notification of the results. If patient requests changes to the PHI created by another agency, you need to forward the request to that agency with a release of information. I always get a release of information. The patient will be notified of approval or denial of the request within 60 days after the receipt of the request. This may be extended for an additional 30 days as allowed by law. If you extend the time period, the patient will be notified of reasons and date the request will be acted upon. So if you decide you're not going to rule on it until your next quarterly meeting, then the patient needs to be notified of the reason for the delay and the exact date that it will be ruled on. Only one 30 day extension is allowed. You need to file the form at the site of the contested entry in the health record and maintain it for the life of the health record. So if they want something changed in their Department of Children and Families record, you need to forward that request to the Department of Children and Families. They need to act on it and they need to maintain the copy of the request. You need to maintain a copy of information detailing that you forwarded it so you can track the continuity of this. Execute approved corrections as follows without eraser or other obliteration, so don't scratch it out or redact it. Use a single line through the incorrect data, correct the information, add the reason for the correction and include the date and your signature with patient approval. Submit the correction to the persons or organizations that received information in the past that may have relied or may rely in the future on the information that are identified by the patient as needing the correction or amendment with the required statement. This is an amendment to the information that was previously sent on, and then fill in the date, document the correction in the accounting disclosure record, and notify the patient in writing of the approval. Accounting of Disclosures Record Disclosures of protected health information that are subject to an accounting should be in the disclosure accounting record or in the release of information software. If you're using electronic medical records, accountings of oral disclosures of PHI should also include the name, signature, and title of the staff who made the oral disclosure, so you need to make sure it's in the record. If you call Jim Bob's probation officer and talk to him about how Jim Bob is doing, Patient requested accountings of disclosure must be in writing. Include disclosures to and by business associates and you must include for each disclosure the date, the name and address of the recipient, the brief description of the PHI disclosed, and a brief statement of the purpose of the disclosure or copy of request for disclosure. Another little side note here. If you're faxing to someone, if you're faxing, for example, to a probation office, that is not usually a secure fax. It's usually one fax in the main area where the receptionists sit. That's not keeping phi that's not complying with hipaa. If you are going to fax something, you need to make sure that the person who is supposed to receive it knows it's coming or it's going to a secure area. Disclosures that do not require accounting include disclosures to officers and employees of the Department of Health and Services who have a need for the information for purposes of treatment, payment, or operations. Disclosures to the Secretary that are required in order to investigate or determine compliance with privacy requirements. Disclosures to the patient Patient authorized disclosures and disclosures required under the Freedom of Information Act. Patients access to their phi. They need to understand their rights and the requirements for for them or for anybody obtaining their phi. You need to understand the requirements for responding to requests the procedure for when access to PHI is granted, how do you handle that or when access to PHI is not granted, how do you handle that, what needs to be documented and where Patient requirements for requesting access Submit written requests to the CEO or designee specifying the records the patient wants to access. Medical Record Progress Notes all of the above Designate a representative to review the record and inform the patient of the contents. Generally, organizations will allow patients to look at their record, but they will be accompanied by either a nurse if it's medical, or their therapist if it's a mental health record. In order to answer any questions, clear up anything or handle crises that may arise if the patient doesn't like what they see. Authorize presence of any other individual to be present during any discussion of a record. So if the patient does not specify that their attorney can be there, or their mother can be there or whomever, then that person can't be there. The patient may request copies of records in accordance with the fee schedule Requirements for Responding to patient requests for Access the organization must act on the request within 30 days if maintained or accessible on site, within 60 days if not maintained or accessible on site. This doesn't often occur anymore. But for example, for patients who we saw six years ago before we went to an electronic medical record, all of their data was stored in hard copy in a storage facility off site, so we were allowed to have an extra 30 days to go dig through the boxes. Must provide patient with written statement of the reasons for the extension and the date on which you will respond. All requests must be maintained in the patient's health health record when access is granted in whole or in part, your risk manager, your CEO, whoever in your organization is responsible for this shall inform the patient in writing. Now make sure you know who's responsible. Don't just assume your risk manager is going to do it, because she may be assuming you're going to do it. You must produce the protected health information only once per request. You must produce in a format that is requested, if producible, or in a legible hard copy. So if they want to see the hard copy record, if that's possible, give it to them. If not, you may need to find some other way around that. Generally, anything that's in a computer can be printed out. A summary or explanation of the phi may be provided in lieu of the underlying information. If the patient agrees in advance, but the patient still retains the right to see the entire phi. Again, if you don't want the patient to read it, don't put it in the file. When access is granted in whole or in part, the access must be provided at a mutually convenient time and place for inspection or copying. That means the patient can't walk in at 8am on Monday morning and go, I want to see my record right now. They don't have that right to demand immediate action. It can be mailed if the patient pays the copying and mailing fee. Note the date the copy is provided to the patient in the chart and follow procedures for verification of identification. PNP stands for Policies and Procedures. If you cannot determine whether direct access to the record will have adverse effects on the Patient. Deny direct access to the patient, at least initially. Forward the records to the designated representative to review. Usually that's your risk manager or your clinical supervisor. Notify the patient in writing of the decision. Provide patient direct access if the designated representative does not provide the patient with the record. So if you don't, if it's not overruled, if it's not determined to be detrimental to the patient, you need to provide them with the record. Otherwise, they need an explanation of why they can't see their own health record. Fax machines can't be in a public area, use can only be monitored by persons designated to conduct monitoring, and only authorized staff can have direct access to the fax machine. Medical records. Fax cover pages must include the facility's identification, the date of transmission, the number of pages including the COVID page, the to information including the telephone number and fax number. The from information including the sender's name, provider's name, if applicable, and the sender's telephone number and fax number. So if you're having your secretary send it out, the secretary's name, your name, and the secretary's telephone number and fax number. Remarks are special instructions, if appropriate, and that big old confidentiality statement that has to all be on the COVID page. Sending information via fax. You want to call the receiving facility to inform them that you are faxing something over. Confirm the fax number ahead of time. Confirm that the fax machine is in a secure area or request that the recipient stand by the machine to receive it. Reconfirm after dialing the number that the number displayed on the fax machine is correct before hitting send. Confirm receipt of the fax by calling the recipient or checking the transmission report. At our agency, we always had to include a copy of the transmission report with the fax in the chart. If the fax is sent to the wrong machine, contact the recipient and request the fax to be destroyed. Place a copy of the COVID page and confirmation of fax receipt in the patient's medical record. Remove medical information from fax machines asap. Count the number of pages to make sure you got all of them. If you're missing any, contact the sender and request retransmittal. Read the fax cover page and follow instructions. Most of us just kind of chuck that as soon as we get it. It's important to keep it and read any instructions. Document the receipt of the fax. If the fax is printed on thermal paper, photocopy and destroy the original thermal paper. Thermal paper is that paper that fades over time, so you need to make sure you have a copy that's going to endure for at least the minimum 7 years. Notify intended recipient that the fax was received. Any fax medical information that is not in a secure area must be hand delivered or placed in a sealed envelope and delivered asap. So if you do fax to an unsecure place, whoever receives it, maybe your secretary is your authorized designee, needs to receive it and put it in a sealed envelope and hand deliver it as soon as possible. If a fax is erroneously received at a facility, inform the sender of the error, destroy the fax and notify risk management and then note in the record if applicable. In summary, if in doubt, ask all disclosures, including oral, electronic or written, must be accounted for in the medical record. There are limited reasons for breaching confidentiality without consent. All patients have the right to request access and or to amend their protected health information, and it's vital that you're cautious when using electronic communications such as fax machines or email to ensure secure delivery of the information.