How to Write a HIPAA-Compliant Fax Cover Sheet: Disclaimer and Confidentiality Statement Examples
Mircea RilăFree generator with a built-in confidentiality notice. Send PHI only through the HIPAA web workflow with a BAA.
This guide covers the wording: what a HIPAA fax disclaimer (or fax confidentiality statement) should say, what a HIPAA compliant fax cover sheet should include, and the limits of any notice. Copy one of the example statements below, then drop it into a cover.
Just need the cover itself? Use our free HIPAA fax cover sheet generator. It fills the routing fields, includes a confidentiality notice and exports a PDF in under a minute, with no account. Prefer a printable layout? Browse 12 fax cover sheet templates for Word, Google Docs and PDF.
Need to send organizational PHI? Use the HIPAA web workflow and required BAA, from $6.50 for up to ten pages. Confirm the authorized organizational signer and recipient before uploading.
Is there required HIPAA disclaimer wording?
HHS says providers may share health information for treatment by fax with reasonable safeguards. Its fax guidance gives confirming an unfamiliar destination number as an example. It does not prescribe a single cover-sheet design for every transmission.
A cover can reduce unnecessary exposure and make misrouting easier to report. Your organization may require one as part of its procedures. Follow that policy and any instructions from the receiving office rather than assuming a generic template replaces them.
The presence of a cover does not establish that the disclosure is permitted. A correctly addressed packet can still contain documents the sender is not authorized to disclose. Check the purpose and authorization requirements before choosing a template.
What to include on a HIPAA-compliant fax cover sheet
Use the cover for routing and follow-up:
| Field | Suitable content | Avoid adding unnecessarily |
|---|---|---|
| To / department | Named office, Records, Referrals or a specific team | An unrelated shared destination |
| Recipient fax | Verified direct fax number | Voice extension or an old cached number |
| From | Sender and organization | Claims of authority you do not have |
| Callback | A monitored appropriate contact | A mailbox no one checks |
| Date | Actual send date | A stale date from an old template |
| Total pages | Cover plus all attachment pages | A count from an earlier draft |
| Subject | Records request or Requested referral | Diagnosis or full SSN |
| Message | Brief routing instructions | A clinical narrative copied onto the cover |
Use a reference only when the recipient needs it. A name or partial identifier can itself be sensitive in context; reducing information on the cover does not make the packet anonymous. For field-by-field help, see how to fill out a fax cover sheet.
HIPAA fax disclaimer examples (confidentiality statement wording)
Each statement below is an example fax confidentiality statement you can paste into the notice box of the HIPAA fax cover sheet generator or your own template. They are suggested routing notices, not required statutory wording or a substitute for your organization's approved notice. Choose one and have the appropriate person review it for your workflow.
1. Short confidential notice
This fax is intended only for the recipient named above and may contain confidential information. If you received it in error, notify the sender by telephone and securely destroy all copies. Do not use or disclose the contents.
This version keeps the cover brief. It tells the wrong recipient how to respond without adding patient details to the notice itself.
2. Medical information notice
This fax may contain protected health information intended only for the named recipient. If it reached you by mistake, contact the sender using the callback number on this page. Do not forward or disclose the contents, and securely destroy unintended copies as directed. This notice does not establish HIPAA compliance.
Use your organization's incident instructions if they differ. The intended recipient still needs an authorized handling and storage process for the attachments.
3. Notice with missing-page instructions
Confidential medical documents follow this cover. Please route them directly to the named recipient or department. If any page is missing or unreadable, contact the sender. If you are not the intended recipient, notify the sender immediately and do not use or disclose the documents.
This version adds a practical callback request. Asking for a callback is not proof someone received or reviewed every attachment. Keep the final transmission result and confirm receipt when the workflow needs it.
How to write your own confidentiality statement
A good statement does four things in two to four sentences: names who the fax is for, flags that it may contain confidential or protected health information, tells an unintended recipient what to do (call the sender, destroy copies) and prohibits further use or disclosure. Leave out legal threats, patient details and any claim that the fax "is HIPAA compliant". Have your privacy officer approve the final wording and use it consistently.
The minimum necessary rule and the cover
HHS's minimum necessary guidance generally requires reasonable steps to limit PHI to the intended purpose. It also lists exceptions, including disclosures to or requests by a healthcare provider for treatment and disclosures to the individual.
Do not state that every treatment fax must meet the minimum necessary standard in the same way. The relevant purpose and exception matter. Reasonable safeguards still apply, and a routing cover rarely needs a detailed medical history, full SSN or password.
Decide what belongs in the authorized document packet separately from what belongs on the front page. If a recipient specifically requires an identifier, verify that requirement and follow your organization's policy instead of omitting information essential to routing.
A cover sheet does not replace a BAA
When a covered entity uses a service that creates, receives, maintains or transmits PHI on its behalf, evaluate the business associate relationship. HHS explains the BAA requirement and the written assurances it provides. Obtain the agreement for the actual organization and service before disclosing PHI where required.
An app description, encryption badge or downloaded cover is not the agreement. Confirm which paid plan, users and workflows the BAA covers. The staff member accepting it must be authorized to bind the organization; a patient cannot accept a clinic's agreement on its behalf.
SingleFax's HIPAA Secure flow presents the electronic BAA before sending. Review the controls and customer responsibilities, including access, recipient verification and document handling. Use that protected web flow for PHI, rather than the ordinary email gateway or a consumer sharing shortcut.
Put the disclaimer on a cover
The fastest route is the free HIPAA fax cover sheet generator: pick the medical purpose, paste your approved statement and download the PDF. Prefer a static file? The medical PDF is suitable for printing; the medical Word file lets you edit the fields. There is also a pharmacy cover for prior-authorization routing.
Keep the cover to one page. Review the final export for clipped fields and accidental second pages, and count every uploaded page. If you use the sender's built-in generated cover, check whether it is counted separately from uploaded document pages. Avoid uploading a completed cover and then accidentally adding a second one with outdated details.
Free template availability does not imply that an ordinary free fax service signs a BAA or supports your organization's workflow. Choose the transmission service independently of the document design.
Send PHI through the protected workflow
For SingleFax, select HIPAA Secure, complete the authorized organization's BAA requirements, verify the destination and review the packet and quote. The price is $6.50 for 1–10 document pages or $10 for 11–100; above 100 pages add $0.08/page, up to 1,000 total pages. Destination adjustments and payment terms appear before checkout.
SingleFax uses payment on successful delivery, with $0 on failure. A pending bank authorization can remain until the bank releases it. The cover does not change those terms.
Organizations needing a continuing number can review business plans: Standard with the HIPAA add-on is $10.80 monthly, or $108 billed annually, with 300 pooled send/receive pages per month. Check destination allowances and overage terms before choosing a plan.
When you keep a blank master template, restrict who can change its routing fields and notice. Create a separate completed cover for each packet so a previous patient reference or destination cannot accidentally carry into the next send.
Check the whole packet before sending
Confirm the receiving department, current fax number, permitted disclosure and complete attachments. Remove unrelated pages, inspect signatures and make sure the cover count matches. Save the exact sent packet and final transmission result according to your organization's record policy.
If a fax is misdirected, follow the incident process promptly and involve the privacy officer. A successful transmission status does not show the intended person opened it, and a confidentiality notice does not settle any required incident assessment.
Sources, downloads and prices checked 8 October 2026.