Can Faxes Be Intercepted? The Four Points Where a Fax Is Exposed

Yes. A fax can be intercepted at four points: the analog phone line, the VoIP connection, the e-fax vendor's server, and the tray at the receiving machine. The phone line is the hardest to reach. The tray is the easiest. And a wrong number, which is not an interception at all, exposes the same pages.

Each point has a fix. Which HIPAA rule applies depends on how the fax was sent, so this article covers that too. For the broader question of whether you may fax PHI at all, see our guide on whether faxing is HIPAA compliant.

Key takeaways

• A fax can be intercepted at four points: the analog phone line, the VoIP connection, the e-fax server, and the receiving tray.
• A wrong number is not an interception, but it exposes the same pages. A saved, verified number is the first fix.
• A paper document fed into a fax machine is not a Security Rule transmission. The Privacy Rule's safeguards standard still applies. A fax sent from software or an e-fax service falls under the Security Rule as well.
• An e-fax vendor that stores your faxes is a business associate and needs a signed BAA before you send PHI through it.
• A misdirected fax containing PHI is presumed to be a breach until you document a low probability of compromise.

How Can Faxes Be Intercepted: The Four Points

Here is the short version. The sections below take each point in turn.

The Analog Phone Line

An analog fax travels over the public telephone network as sound. To intercept it, someone needs physical access to the line at your building or a junction box, or access to the carrier's equipment, plus the gear to record the tones and rebuild the image. That is a targeted attack, not something a remote scammer does at scale.

The Internet Engineering Task Force made the same point in 2014. Secure fax on the phone network "was never widely considered or prioritized," it wrote, "mainly because of the challenges involved with malevolent physical access to telephony equipment" (RFC 7345).

Note the line in your security risk assessment anyway, so the record shows you considered it.

The VoIP Connection

A fax machine can plug into a phone jack and still not be on an analog line. If your phone service comes from your internet or cable provider, ask.

A VoIP system carries a fax as data. It either converts the call to T.38, the ITU standard for real-time fax over IP networks, or passes the fax tones through as audio inside data packets. Either way, the fax now crosses the same kind of network as the rest of your internet traffic.

That changes the risk. The same 2014 document says that as calls move to IP networks, "information might potentially be intercepted or spoofed." It also says the encryption options then available for fax "never gained any significant adoption in the market."

So do not assume your fax is encrypted. The places to think about are your own office network, your router, and your VoIP provider's systems. Ask your carrier whether fax calls are encrypted, and get the answer in writing.

Whether that carrier needs a BAA depends on what it does. HHS calls the conduit exception "a narrow one," limited to "mere courier services" and their electronic equivalents, and says the call is "fact specific." A company that only carries the signal may fit. A provider that stores fax images, or runs a fax-to-email service, is a different case. Ask what it keeps.

The E-Fax Server

An e-fax does not land on your machine. It lands on the vendor's servers first, usually as a PDF or image, and it can stay there until someone deletes it. The realistic way in is the inbox: a shared login, a stolen password, or a former employee who still has access.

A vendor that creates, receives, maintains, or transmits PHI on your behalf is a business associate under 45 CFR 160.103. Storage settles it. HHS says a data storage company with access to PHI "qualifies as a business associate, even if the entity does not view the information." You need a signed business associate agreement first. If a vendor will not sign one, do not send PHI through it.

Before you commit to a service, ask these in writing:

• Will you sign a BAA?
• Where are faxes stored, and for how long?
• Who at your company can view them?
• Does the inbox support individual logins and multi-factor authentication?
• How are faxes deleted when we close the account?

The Receiving Tray

The easiest interception takes no skill. A fax sits in an open tray and someone reads it.

HHS names this directly. In its FAQ on faxing between physician offices, one example of a reasonable safeguard is "placing the fax machine in a secure location to prevent unauthorized access to the information." Assign someone to pick up incoming faxes, and decide what happens to faxes that arrive after hours.

The machine itself can also hold copies. HHS says PHI stored, "whether intentionally or not," in fax machines and photocopiers "is subject to the Privacy and Security Rules." Before a leased machine goes back, the stored data has to come off it.

A Wrong Number Is Not an Interception

A transposed digit sends a patient's file to a stranger's machine. Nobody attacked anything, and the pages are exposed anyway.

The same HHS FAQ gives the other example of a reasonable safeguard: "the sender confirming that the fax number to be used is in fact the correct one." In practice:

• Save verified numbers for the offices you fax often.
• Confirm the number by phone before a first-time send.
• Use a cover sheet with the recipient's name and a confidentiality notice. No HIPAA rule requires one, but it tells a wrong recipient what to do.
• Keep the confirmation report, so you can show where the fax went.

Which HIPAA Rule Applies to Your Fax

This part is easy to get wrong, because the answer depends on the form the document was in right before it was sent.

The definition of electronic media in 45 CFR 160.103 says:

"Certain transmissions, including of paper, via facsimile, and of voice, via telephone, are not considered to be transmissions via electronic media if the information being exchanged did not exist in electronic form immediately before the transmission."

HHS explained this in the 2013 Omnibus Rule: "a facsimile machine accepting a hardcopy document for transmission is not a covered transmission even though the document may have originated from printing from an electronic file."

In plain English:

So the transmission security standard at 45 CFR 164.312(e) reaches e-fax and software-sent fax. It does not reach every fax. The Privacy Rule covers all of them: 45 CFR 164.530(c) says a covered entity "must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information."

One case is not settled by that language. We did not find HHS guidance on a paper fax sent over a VoIP line. The definition looks at the form of the information, not the kind of line. Either way the Privacy Rule applies, and listing the VoIP connection as a network risk in your risk assessment leaves you a better record. If this matters for your practice, ask your attorney. One Guy Consulting is not a law firm, and this article is not legal advice.

Faxing PHI Is Still Allowed

HHS is plain about this: "The HIPAA Privacy Rule permits physicians to disclose protected health information to another health care provider for treatment purposes. This can be done by fax or by other means."

Fax is still how many referrals, imaging orders and records requests move, and a practice cannot always opt out. The question is whether the safeguards around it are in place.

Addressable does not mean optional. Under 45 CFR 164.306(d)(3), you assess whether the safeguard is reasonable and appropriate. If it is, you implement it. If it is not, you document why and implement an equivalent alternative if that is reasonable and appropriate. A 2025 proposed rule would remove most of that flexibility. It is proposed, not final, and HHS's target date is July 2027.

The minimum necessary standard applies to most faxes, so send only what the recipient needs. It does not apply to disclosures to a health care provider for treatment, under 45 CFR 164.502(b)(2)(i).

Fax Compared With Email

Neither is secure by default, and HIPAA does not rank them. An analog line is hard to reach without physical access. Once your fax runs over VoIP, that advantage shrinks. Email is easy to misaddress and sits in more mailboxes, but encrypted email with a BAA is easier to log.

Use the channel you can secure, record and explain.

What to Do When a Fax Is Misdirected or Intercepted

Start the same way every time.

1. Write down what happened, when you learned of it, what PHI was on the fax, and who sent and received it.
2. Call the recipient. Ask them to destroy the pages and confirm that in writing.
3. Complete a documented breach risk assessment.
4. Keep all of it in your incident records.

Do not stop at step 2. Under 45 CFR 164.402, an impermissible disclosure "is presumed to be a breach unless" you demonstrate a low probability that the PHI was compromised, based on at least four factors:

• The nature and extent of the PHI involved
• The unauthorized person who received it
• Whether it was actually acquired or viewed
• The extent to which the risk has been mitigated

HHS was asked to exempt faxes sent to the wrong number. Its answer: "We decline to create such an exception." Each case is "very fact specific."

HHS did give an example that can come out well. A fax goes to the wrong physician practice, and the physician calls to say it arrived in error and was destroyed. HHS says the covered entity "may be able to demonstrate after performing a risk assessment that there is a low risk" of compromise. A recipient who is also bound by HIPAA may lower the probability too. A full chart sent to a number you cannot identify is a much harder case.

The burden of proof is yours under 45 CFR 164.414(b). If the assessment does not support a low probability, it is a breach:

• Notify affected individuals "without unreasonable delay and in no case later than 60 calendar days after discovery," under 45 CFR 164.404(b). Sixty days is the outer limit, not the target.
• For a breach of fewer than 500 people, keep a log and report it to HHS within 60 days after the end of the calendar year, under 45 CFR 164.408(c). See our guide to the small breach log.
• For 500 or more, HHS must be told at the same time as the individuals, and media notice can apply. Our breach notification guide covers it.

---

FAQ

Can someone intercept a fax without access to the phone line?

On an analog line, it takes physical access to the line or access to the carrier's equipment, plus gear to rebuild the image. On a VoIP line, the fax travels as data, so it can be exposed on any network it crosses that is not protected.

Do I need a BAA with my online fax service?

Yes, if it stores your faxes or otherwise handles PHI on your behalf. HHS says a data storage company with access to PHI is a business associate even if it does not view the information. If the vendor will not sign a BAA, do not send PHI through it.

Is a fax cover sheet required by HIPAA?

No. No HIPAA rule requires one. It is still a useful step: a cover sheet with the recipient's name and a confidentiality notice tells a wrong recipient what to do. HHS's own fax examples are confirming the number and keeping the machine in a secure location.

Does the Security Rule apply to faxes?

It depends on the form of the document. Paper fed into a fax machine is not a covered transmission. A fax sent from a computer, EHR or e-fax service is, and so is anything stored in a fax inbox or machine memory. The Privacy Rule's safeguards standard applies to all of them.

How long should we keep fax confirmation sheets?

HIPAA does not name them. It does require documentation it mandates to be kept for six years, so six years is a simple rule to use. Keep breach risk assessments for misdirected faxes for at least that long, because the burden of proof is yours.

Conclusion

A fax can be intercepted, but the phone line is the hardest point to reach. The tray, the e-fax login and the dial pad are the easy ones. Fix those first, find out what your fax line actually is, and write down what you decided.

Want help putting this in place? The Full-Scope plan from One Guy Consulting pairs the compliance software with 4 hours a month of 1:1 implementation calls with Chuck Weiselberg, with no per-user fees. Book a free 30-minute intro call. No obligation, no pressure.

Sources

• HHS, Can a physician's office fax patient medical information to another physician's office (FAQ 356)
• HHS, Omnibus Final Rule, 78 FR 5566 (Jan 25, 2013)
• IETF, RFC 7345, UDP Transport Layer (UDPTL) over DTLS (August 2014)
• ITU-T Recommendation T.38, Procedures for real-time Group 3 facsimile communication over IP networks
• HHS, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, proposed rule, 90 FR 898 (Jan 6, 2025)
• 45 CFR 160.103 (eCFR)
• 45 CFR 164.306 (eCFR)
• 45 CFR 164.308 (eCFR)
• 45 CFR 164.310 (eCFR)
• 45 CFR 164.312 (eCFR)
• 45 CFR 164.402 (eCFR)
• 45 CFR 164.404 (eCFR)
• 45 CFR 164.408 (eCFR)
• 45 CFR 164.414 (eCFR)
• 45 CFR 164.502 (eCFR)
• 45 CFR 164.530 (eCFR)

---

Related Reading

• Is Faxing HIPAA Compliant
• HIPAA Email Compliance Guide
• HIPAA Breach Notification Rule Compliance
• Is RingCentral HIPAA Compliant