A HIPAA-compliant fax cover sheet is the confidentiality notice attached to the front of any fax that contains protected health information (PHI) — medical records, referrals, lab results, prior-authorization forms, or anything else covered by the HIPAA Privacy Rule. It tells whoever picks up the fax on the other end that the contents are confidential, states what to do if the fax arrived in error, and gives a way to contact the sender. It is a cheap, five-minute fix that a lot of offices still get wrong — either by using no cover sheet at all, or by using one with vague, non-specific language that doesn’t actually do the job.
This page gives you a free template you can copy and use today, explains what the disclaimer language needs to say and why, and covers the harder question the template can’t answer on its own: whether the underlying fax transmission itself is HIPAA-compliant. A cover sheet is necessary but not sufficient — it protects against misdirected-fax exposure, not against an insecure transmission method.
Free HIPAA-Compliant Fax Cover Sheet Template
Copy the block below into a Word document, PDF form, or your fax software’s cover sheet field. Fill in the bracketed fields for each transmission.
CONFIDENTIAL FACSIMILE TRANSMISSION
To: [Recipient name] Fax: [Recipient fax number]
From: [Sender name] Organization: [Sender organization]
Phone: [Sender callback number] Fax: [Sender fax number]
Date: [Date] Total pages (including this cover sheet): [#]
Re: [Subject — avoid naming the patient or diagnosis in the subject line itself]
CONFIDENTIALITY NOTICE: The documents accompanying this facsimile transmission contain confidential information belonging to the sender that is legally privileged and protected under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 45 CFR Parts 160 and 164. This information is intended only for the use of the individual or entity named above. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this facsimile in error, please immediately notify us by telephone at [callback number] to arrange for return or destruction of the transmitted documents, and destroy this fax without reading, copying, or disclosing it.
Three things in that language are doing real work, not just filling space:
- The named-recipient limitation. Saying the information is intended only for the named individual or entity is what makes the “wrong number” scenario a misdirected-disclosure event rather than an authorized one — it puts the unintended recipient on notice that they aren’t the audience.
- The affirmative instruction for a wrong recipient. Telling an accidental recipient to call back and then destroy the fax, rather than just asking them to be discreet, gives you something concrete to point to if you ever need to document your office’s response to a misdirected fax.
- A working callback number. Not a general office line that goes to voicemail for three days — a number someone will actually answer, since the whole point of the notice is enabling a fast correction.
HIPAA-Compliant Fax Cover Sheet Template for Multiple Use Cases
The core disclaimer above works for general PHI. A few common variants:
- Behavioral health / substance use records. If any of the content falls under 42 CFR Part 2 (federal substance use disorder treatment records), add a specific Part 2 re-disclosure prohibition — the standard HIPAA notice alone is not sufficient for Part 2-protected information, which has its own stricter re-disclosure restrictions.
- Attorney or peer-review privileged records. Add a line noting the material may also be protected by attorney-client privilege or peer-review privilege under state law, where applicable, in addition to HIPAA.
- Research/IRB-related transmissions. If the fax is moving PHI in the context of a research study rather than treatment, payment, or operations, note the applicable IRB protocol number in the subject line instead of identifying the study by condition or drug name where avoidable.
In every variant, the fields that change are the added disclosure restriction and the subject-line practice — the core named-recipient, misdirected-fax, and callback language stays the same.
What a Cover Sheet Does — and Doesn’t — Fix
A confidentiality notice addresses exactly one risk: a fax landing with the wrong human being on the other end because of a dialing error, an outdated number, or a shared machine. It does nothing about several other risks that a cover sheet can’t touch:
- Interception in transit. A fax sent over the plain analog phone network isn’t encrypted. A cover sheet on an unencrypted transmission is a paper disclaimer on an insecure pipe.
- Physical exposure at either end. A shared office fax machine that prints incoming faxes to an open tray, or an outgoing fax left sitting at the machine, exposes PHI to anyone walking past — regardless of what the cover sheet says.
- No audit trail. A traditional fax machine can’t tell you who picked up a given incoming fax, or confirm exactly when an outgoing one was retrieved. If you’re ever asked to reconstruct who had access to a document, a physical machine has no record to produce.
- No Business Associate Agreement. If any third-party service touches the fax — a cloud fax provider, an e-fax gateway, a scanning service — the HIPAA Privacy Rule requires a signed BAA with that vendor before PHI passes through it, cover sheet or not.
In other words: the cover sheet template above is the right and necessary piece of paper for every fax carrying PHI, but it’s solving the misdirected-recipient problem, not the transmission-security problem. For a full breakdown of what makes the underlying fax method itself compliant — BAAs, encryption in transit and at rest, access logging, retention and disposal — see CASRAI’s guide to HIPAA-compliant fax services.
If your office is still running PHI through a physical fax machine in a shared hallway, that transmission-security gap is the bigger exposure, and it’s the one a template can’t paper over. Fax.Plus is a cloud fax service built around exactly this problem: it can sign a Business Associate Agreement, encrypts faxes in transit and at rest, and logs who sent, viewed, or downloaded each document — on its Enterprise plan specifically (see the honest caveat on pricing below).
Where Fax.Plus Fits — and Where It Doesn’t
Fax.Plus runs five tiers as of August 2026: a free plan limited to 10 lifetime send-only pages with no dedicated number; Basic at $6.99/month (200 pages/month, one number, one member); Premium at $13.99/month (500 pages/month); Business at $27.99/month (1,000 pages/month, multiple numbers, five members); and Enterprise at $79.99/month (4,000 pages/month, multiple numbers, unlimited members). The BAA and HIPAA-compliant configuration are only available on the Enterprise plan — the free, Basic, Premium, and Business tiers do not include a signed BAA, which means they are not an appropriate way to fax PHI regardless of how the transmission is encrypted. This is a real limitation worth knowing before you sign up expecting HIPAA coverage on a cheaper tier: if your organization needs a BAA, budget for Enterprise pricing, not the plan that looks like it covers your page volume.
Fax.Plus is a reasonable fit for a clinic, research office, or department that already knows it needs a BAA and multi-user access logging and is prepared to pay Enterprise pricing for it. It is not the right fit for a solo practitioner or small office trying to stay on a cheaper tier while still handling PHI — for that budget point, it’s worth directly comparing named competitors that price BAA access differently (SRFax and iFax both offer BAA-eligible plans at lower price points than Fax.Plus Enterprise; see the fuller comparison in CASRAI’s HIPAA-compliant fax service guide) rather than assuming Fax.Plus is the only option or the cheapest one for a small practice.
Frequently Asked Questions
Is a fax cover sheet alone enough to make faxing HIPAA-compliant?
No. A confidentiality notice addresses misdirected-recipient risk only. HIPAA compliance for the fax itself also requires a secure transmission method (encryption, or a signed BAA if a third-party service is involved), access controls, and a retention/disposal policy for the documents once received.
Do I need a HIPAA-compliant fax cover sheet template for outgoing faxes only, or incoming too?
Use it on every outgoing fax that contains PHI. You don’t attach your own cover sheet to an incoming fax, but the same logic applies in reverse — a sender who doesn’t use one is putting your organization at receiving-end risk if the fax is misdirected to you.
What’s the difference between a HIPAA-compliant fax cover sheet and a regular one?
A regular business fax cover sheet typically just lists sender, recipient, date, and page count. A HIPAA-compliant version adds the specific confidentiality/re-disclosure prohibition language, the misdirected-recipient instruction, and a working callback number — the elements that give the notice actual legal and operational weight rather than being a formatting convenience.
Can I use a free online fax tool with this cover sheet template?
Only if that tool has a signed BAA with your organization. The cover sheet’s confidentiality language doesn’t change the compliance status of the transmission method underneath it — a free, no-login fax tool with no BAA is not appropriate for PHI no matter what cover sheet you attach.
Does HIPAA require a specific cover sheet format?
No. HIPAA doesn’t mandate specific cover sheet wording or a government-approved form. What matters is that the notice functionally conveys confidentiality, identifies the intended recipient, and gives instructions for a misdirected fax — the template above meets that bar and is the format most compliance offices converge on.
