How to Fax Medical Records (Without Breaking HIPAA)

Why Medical Records Still Travel by Fax

It sounds outdated. But fax remains the most common way medical records move between providers, insurers, and patients. Over 70% of healthcare providers still rely on fax for referrals and record transfers, according to the Office of the National Coordinator for Health IT.

The reason is simple: fax is considered HIPAA compliant by default. Email is not. Portal-to-portal transfers require both systems to be compatible. Fax works with every provider, every insurer, and every government agency regardless of what software they run.

So whether you're a patient trying to get records to a new doctor, or an office manager handling dozens of record requests per week, knowing how to fax medical records correctly matters.

What You Need Before You Send

Before you fax anything, gather these items:

• A signed authorization form. Under HIPAA, medical records can only be released with written patient consent. Most providers have their own release form, or you can use a generic HIPAA authorization. It needs the patient's name, date of birth, a description of what's being released, who it's going to, and a signature.
• The recipient's fax number. Double-check this. A wrong number means protected health information lands on a stranger's machine. That's a HIPAA violation.
• A HIPAA-compliant cover page. This should include a confidentiality notice stating the fax contains protected health information and instructing unintended recipients to destroy it. See our HIPAA fax cover page guide for exactly what to include.
• The records themselves. Scanned as a PDF or photographed clearly. Make sure every page is legible and oriented correctly.

Step-by-Step: Faxing Medical Records Online

You do not need a fax machine. Any browser on any device works. Here is the process:

1. Scan or photograph your documents. Use your phone camera or a scanner app. Save everything as a single PDF if possible. Most online fax services accept PDF, PNG, and JPEG.
2. Go to FaxDrop.com. No account required for your first two faxes.
3. Enter the recipient fax number. Include the area code. FaxDrop validates the format before you send.
4. Upload your PDF. Attach the authorization form, cover page, and medical records in one file. Or upload them separately and FaxDrop will combine them.
5. Add a cover page. FaxDrop subscribers can generate a branded cover page automatically. Otherwise, include your own as the first page of the PDF.
6. Send and confirm. You will get a delivery confirmation by email once the fax goes through. Keep this for your records. HIPAA requires you to be able to verify that transmissions were completed.

HIPAA Rules You Should Know

Faxing medical records is legal and HIPAA compliant when done correctly. But there are rules.

Always verify the fax number. Sending records to the wrong number is the most common HIPAA fax violation. Call the recipient and confirm their number before you send.

Always use a cover page with a confidentiality notice. This is not optional. The notice tells anyone who receives the fax in error that the contents are protected and must be destroyed.

Keep a transmission log. Whether you use a physical fax machine or an online service, keep a record of what was sent, when, and to whom. Online services like FaxDrop generate these logs automatically.

Send only what was authorized. If the patient consented to release lab results, do not include therapy notes. Scope matters.

Common Situations That Require Faxing Records

• Transferring to a new primary care physician
• Sending lab results or imaging to a specialist before an appointment
• Submitting records for insurance prior authorization
• Providing documentation for disability claims (SSA, workers' comp)
• Responding to a subpoena or legal records request
• Sending vaccination records to schools or employers

In each case, the receiving party almost always accepts fax. Many prefer it over email because it removes the encryption question entirely.