PHIPA and faxing: what custodians should know

What PHIPA expects

PHIPA requires custodians to take reasonable steps to protect personal health information in their custody or control against theft, loss and unauthorised use or disclosure. That duty extends to the people acting on your behalf, such as reception staff, and to the tools you use, including fax.

If personal health information is stolen, lost, or used or disclosed without authority, PHIPA requires the custodian to notify the individual at the first reasonable opportunity. Certain breaches must also be reported to the IPC, and custodians report annual breach statistics. Check the IPC's current guidance for exactly which situations must be reported.

Practical safeguards

The IPC's guidance on faxing generally points custodians toward a mix of administrative and technical steps. In practice, these include:

• Confirming the recipient's number before sending, especially for a first-time recipient.
• Using a cover page with a confidentiality notice and instructions if received in error.
• Reviewing and updating saved fax numbers regularly.
• Limiting faxed information to what's needed for the purpose.
• Keeping incoming faxes where only authorised staff can see them.
• Training staff and having a plan for what to do when a fax goes astray.

A short checklist for your privacy officer

Whatever fax setup you use, review it at least once a year. Pull a sample of the audit log and check that access matches staff roles. Remove former staff promptly. Re-verify the fax numbers you use most, particularly for hospitals, labs and specialists that have moved or merged. Confirm that faxes are being filed into the patient record and purged from the fax inbox on the schedule your retention policy sets. Finally, run through your breach response plan with front-desk staff so they know who to tell if a fax goes to the wrong number. The other guides on faxservices.ca cover choosing a service and moving off a fax machine.