HIPAA Fax for Therapists

What therapists fax

• A treatment summary or records sent to a psychiatrist, a primary care doctor or the client’s next therapist
• A release of information the client signed, and the records that follow it
• Insurer forms, such as Evernorth’s Outpatient Behavioral Network Exception Request Form (email preferred, or fax (860) 687-7329) and its Transition of Care request (fax (844) 271-1507)
• Letters to a disability carrier or attorney, once the client has authorized them

Prior authorization for a prescribing clinician has its own lines at Cigna, Humana and CVS Caremark.

What a BAA is and when it applies

A Business Associate Agreement is the contract HHS describes as the “satisfactory assurances” a covered entity obtains before a vendor handles PHI for it. Whether you need one with a fax service comes down to three questions:

• Is your practice a covered entity? HHS lists psychologists among covered providers, but only if they “transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard”, such as an electronic insurance claim. HHS publishes a decision tool for the question, and an entity outside the definition “does not have to comply with the HIPAA Rules”.
• Does the vendor store or handle the documents? HHS gives a “Cloud service provider engaged to create, receive, maintain, or transmit electronic PHI” as an example of a business associate. Its conduit exception covers entities that “only provide transmission services for PHI”, including any temporary storage, and not one that accesses PHI on a regular or frequent basis to perform a service. FaxTerra stores your documents, so we sign a BAA for that storage and processing.
• Who is on the other end? HHS says a covered entity is “not required to have a BAA to disclose PHI about an individual to a health care provider for treatment purposes”. You do not sign one with the psychiatrist you fax, and HHS says the same of a provider that “discloses PHI to a health plan for payment purposes”.

A client faxing their own records needs no BAA, and the free plan for patients fits them.

What the FaxTerra HIPAA add-on is

HIPAA compliance is an add-on to any paid plan, with the same controls on every plan:

• A signed BAA, executed online before the add-on starts and downloadable from your account
• A unique AES-256 key for each document, and encryption for the documents already on the account
• A six-year audit log of every view and download, with a copy available on request from support
• Arrival and delivery notices with no names, fax numbers or document detail
• Faxes that stay in the inbox: PDF attachments on arrival emails, fax forwarding and sending by email all turn off

HHS says that it and its Office for Civil Rights “do not certify any persons or products as ‘HIPAA compliant’”, so no vendor holds a HIPAA certificate. We attest to these controls and sign the BAA. The phone-network leg of a fax travels under the conduit exception HHS set out at 78 FR 5571, as with any fax.

What it costs

The add-on is $4.99 a month, or $49.99 a year on an annual plan. The plan sets the page allowance:

• Starter + HIPAA. $9.98 a month for 50 pages, sent and received combined.
• Business + HIPAA. $14.98 a month for 200 pages, sent and received combined.
• Pro + HIPAA. $34.98 a month for 1,000 pages, sent and received combined.

Each plan includes a fax number. Choose one on the HIPAA fax page and sign the BAA at checkout. No sales call is involved.