A referral arrives by fax. A staff member adds it to the patient's chart, and the original stays in the fax inbox. Months later, that same document may also exist in an email attachment, a downloads folder, and a stack of printed paperwork.
How long should the organization keep those copies?
There is no single HIPAA retention period for all faxed patient records. The right retention schedule depends on the information in the document, the laws and requirements that apply to the organization, and whether the copy is the official record or a temporary working copy.
Does HIPAA Require Keeping Medical Faxes for Six Years?
The familiar six-year HIPAA rule is often misunderstood. Under 45 CFR 164.530(j), covered entities must retain required Privacy Rule documentation for six years after its creation or the date it was last in effect, whichever is later. Required Security Rule documentation has a corresponding six-year requirement under 45 CFR 164.316(b).
These requirements cover documentation such as HIPAA policies and procedures and other records those rules require organizations to document. They do not establish a six-year retention period for every patient chart or fax. www.ecfr.gov
HHS expressly states that the HIPAA Privacy Rule does not set medical-record retention periods. State laws generally govern those periods, while other applicable requirements can also matter. HIPAA safeguards continue to apply while the organization holds the information, including during disposal. www.hhs.gov
What Determines the Retention Period?
Fax is a delivery method. A faxed laboratory result, referral, or treatment summary should be classified according to its content and role in the organization's records.
When developing a retention schedule, review the applicable state medical-record laws, provider licensing requirements, federal program requirements, payer contracts, and preservation obligations. Check whether special rules apply to minors or particular record categories. Identify what starts each retention period, such as discharge or the last treatment date.
Federal requirements can apply independently of HIPAA. For example, the Medicare hospital Conditions of Participation at 42 CFR 482.24(b)(1) require medical records to be retained for at least five years. That requirement applies to the hospitals subject to it; it is not a universal five-year rule for every healthcare organization, and other applicable requirements may require longer retention. www.cms.gov
Do You Need to Keep Every Copy of a Fax?
A practical retention policy should distinguish the retained patient record from additional copies created during processing.
| Record or copy | Retention consideration |
|---|---|
| Faxed clinical document filed in the patient chart | Apply the retention schedule for that medical record. |
| Required HIPAA documentation received by fax | Apply the applicable HIPAA documentation requirement and any other relevant obligations. |
| Extra copy in a fax inbox, email, or downloads folder | Define when it may be removed after verifying the retained record is complete and checking for preservation requirements. |
| Fax transmission log or confirmation | Set a schedule based on its purpose and applicable requirements; do not automatically apply a universal six-year period. |
Before removing a working copy, verify that every page reached the correct patient chart and remains readable and retrievable. Confirm that the transfer preserved any information needed for the record, including relevant annotations or transmission details.
For example, a practice might receive a four-page referral, verify all four pages in its approved record system, and then remove the inbox copy under its documented policy. The retained referral remains subject to the medical-record schedule. If the inbox copy contains unique information, or a preservation obligation applies, routine deletion may be inappropriate.
A Fax Inbox Is Not Automatically a Long-Term Archive
Cloud fax services can provide useful storage, but the service's retention setting should not determine the organization's medical-record schedule.
Before relying on a fax platform for retained records, establish:
- How long documents and transmission records remain available.
- Whether automatic deletion is enabled and who can change it.
- How records can be searched, retrieved, and exported.
- What happens to stored records when the account closes.
- How deletion affects backups and other retained copies.
A service that keeps faxes for 90 days cannot be the only location for documents the organization must retain for years. Likewise, indefinite inbox storage can leave unnecessary copies for staff to manage and protect.
Document where the retained record belongs and who verifies that it gets there.
Combine Cloud Storage With Secure Local Backups
Cloud storage can make retained faxes easier to organize and retrieve. When using a cloud provider to maintain electronic protected health information, the organization needs an appropriate business associate agreement and must address the service in its risk analysis and safeguards. A provider's marketing claim alone does not establish that the organization's use of the service is HIPAA compliant. HHS.gov
For organizations with the equipment and IT support to manage it, keeping a secure local backup alongside cloud storage can provide another way to recover records if internet access fails, a cloud account becomes unavailable, or records are accidentally deleted. This is a resilience recommendation, not a HIPAA requirement to use both locations. HIPAA's Security Rule requires a data backup plan and a disaster recovery plan, but does not prescribe this particular arrangement. govinfo.gov
A managed server, network-attached storage device, or dedicated backup system may support that approach. The local copy should be part of an approved backup process, with encryption, restricted access, physical protection, and monitoring for failed backups. Recovery keys and credentials also need protection and must remain available to authorized staff during recovery.
A synchronized folder is not necessarily an independent backup. Deletion, corruption, or ransomware may affect both synchronized locations. Use backup history and a protected copy that routine users or compromised accounts cannot readily overwrite. CISA recommends offline, encrypted backups and regular recovery testing. cisa.gov
Plan for failures at either location. Local equipment can be damaged by fire, flooding, theft, or hardware failure, so a local copy should not become the only backup either. Test whether staff can restore complete, readable records, including during a cloud outage. If offline access is a goal, confirm that recovery does not depend entirely on an unavailable cloud login or application.
Finally, distinguish deliberate backup copies from stray working copies. Document backup schedules, retention and expiration, responsibility for restoration, and how legal holds affect deletion. Keeping a controlled recovery copy serves a different purpose from leaving patient files scattered across employee computers.
Build Retention Into the Fax Workflow
A workable process connects receipt, filing, retention, and disposal:
- Classify the document. Determine whether it is a clinical record, required compliance documentation, correspondence, or another category.
- File and verify it. Place it in the approved system and confirm the patient, page count, readability, and completeness.
- Apply the correct schedule. Record the retention period and the event that starts it.
- Check for preservation obligations. Suspend routine destruction where a legal hold or other applicable requirement calls for preservation.
- Manage extra copies. Address fax inboxes, email, local downloads, printouts, and other locations in the policy.
Assign responsibility for each step. A policy is easier to follow when staff know who confirms filing, who authorizes disposal, and who handles exceptions.
Protect Records Through Disposal
Once records are eligible for destruction, disposal still needs appropriate safeguards. HHS guidance calls for protecting PHI during disposal and gives examples such as shredding paper so the information cannot be reconstructed. Electronic media require appropriate handling before disposal or reuse. www.hhs.gov
Deleting a fax from a visible inbox may leave copies elsewhere. The disposal process should account for the systems and media involved, including provider-managed storage and backups. Staff should understand the organization's procedures rather than assume that moving a file to the trash completes the process.
Retain Records According to Their Purpose
The most useful question is not simply, “How long do we keep faxes?” It is, “What record did we receive, which requirements apply, and where will we preserve the complete record?”
Answer those questions in a written retention schedule, then align the fax workflow and storage settings with it. That gives staff a clear basis for keeping necessary records and disposing of eligible copies securely.