3 ms·

Most doctor's offices. Fax is considered to be HIPAA compliant if done properly, so it is still the defacto method of sending orders etc... For a small non-te

Most doctor's offices. Fax is considered to be HIPAA compliant if done properly, so it is still the defacto method of sending orders etc... For a small non-technical health practice, in many cases it's the only option.

dragonwriter 5y ago
> Fax is considered to be HIPAA compliant if done properly This is a misleading description of the rationale. Fax is not considered “electronic media” under HIPAA and therefore has a lot weaker requirements, both as to format (the standard data formats and contents required of electronic media under the TCS rule don't apply) and security (the encryption and other electronic media requirements the Security Rule, and the definitions of “unsecured” PHI under the HITECH breach notification rule don't apply) than most other non-paper mechanisms.
- claytongulick 5y ago
  Not really. Most implementations of faxes are "soft" (efax) and have an encryption requirement. They'll generally have a configuration where the fax arrives as a secure link in an email, or as an actual attachment to an email, or is accessed through a portal depending on the email security configuration. It's also fairly common for slightly more sophisticated practices to have faxes go directly into the EHR. This all falls squarely under the HIPAA Security Rule. I don't see very many practices printing faxes anymore. Same way you don't see many practices that still have paper medical records, though they still exist. Electronic faxes are also commonly used for sending documents, most EHRs have this capability. This is to avoid transmission of documents over email, and also falls squarely within the Security Rule. Eventually we'll get to the point where we all use HL7/FHIR for this stuff, but until then "soft" faxes will remain the primary means of Healthcare document transmission.
  - dragonwriter 5y ago
    > Most implementations of faxes are "soft" (efax) and have an encryption requirement. The transaction is not considered electronic when it is by fax, even if both sides happen to use eFax, so the pieces that involve the partner-to-partner communication aren't covered by the standard transaction set requirements of the Transaction and Code Sets rule, when performing functions for which there is a specified standard; I personally know major state Medicaid agencies whose use of fax has been largely for special (out of the regular automated flow) communications that fit functions for which there is a standard transaction, as a TCS rule hack. And it supports communication with partners using hard fax as an even more comprehensive regulatory back, which may be a minority but still exist. But, yes, with soft fax the internal toolchain is covered by electronic-specific provisions of the various HIPAA rules.

dragonwriter 5y ago

> Fax is considered to be HIPAA compliant if done properly This is a misleading description of the rationale. Fax is not considered “electronic media” under HIPAA and therefore has a lot weaker requirements, both as to format (the standard data formats and contents required of electronic media under the TCS rule don't apply) and security (the encryption and other electronic media requirements the Security Rule, and the definitions of “unsecured” PHI under the HITECH breach notification rule don't apply) than most other non-paper mechanisms.

claytongulick 5y ago
Not really. Most implementations of faxes are "soft" (efax) and have an encryption requirement. They'll generally have a configuration where the fax arrives as a secure link in an email, or as an actual attachment to an email, or is accessed through a portal depending on the email security configuration. It's also fairly common for slightly more sophisticated practices to have faxes go directly into the EHR. This all falls squarely under the HIPAA Security Rule. I don't see very many practices printing faxes anymore. Same way you don't see many practices that still have paper medical records, though they still exist. Electronic faxes are also commonly used for sending documents, most EHRs have this capability. This is to avoid transmission of documents over email, and also falls squarely within the Security Rule. Eventually we'll get to the point where we all use HL7/FHIR for this stuff, but until then "soft" faxes will remain the primary means of Healthcare document transmission.
- dragonwriter 5y ago
  > Most implementations of faxes are "soft" (efax) and have an encryption requirement. The transaction is not considered electronic when it is by fax, even if both sides happen to use eFax, so the pieces that involve the partner-to-partner communication aren't covered by the standard transaction set requirements of the Transaction and Code Sets rule, when performing functions for which there is a specified standard; I personally know major state Medicaid agencies whose use of fax has been largely for special (out of the regular automated flow) communications that fit functions for which there is a standard transaction, as a TCS rule hack. And it supports communication with partners using hard fax as an even more comprehensive regulatory back, which may be a minority but still exist. But, yes, with soft fax the internal toolchain is covered by electronic-specific provisions of the various HIPAA rules.