HIPAA doesn’t certify printers or fax machines, and no device is HIPAA compliant on its own. What HIPAA requires is reasonable safeguards for patient information in any form, which for printing and faxing comes down to four things: keep printouts and faxes out of sight, confirm where faxes go, make sure any fax or print service that stores patient information has signed a business associate agreement, and wipe the copier before it leaves.
Talk to an advisor
Ask about your own setup.
We ask what you’re trying to accomplish and tell you what we’d look at first. It costs nothing to talk, and no price comes up on this call.
Printing: keep pages out of shared trays
The most common printing problem we see in clinics is a chart or lab result sitting at a shared copier near the front desk. Secure print release fixes it: jobs wait until the person who printed signs in at the device with a badge or PIN, and unreleased jobs are deleted after a set time. The EPA ENERGY STAR program estimates that 10 to 35 percent of printed pages are never picked up at all, which in a medical office means patient information left behind.
Print management software also keeps a log of who printed what, on which device, and when. That log is useful during a HIPAA risk assessment and after an incident, when the question is who had a document.
Faxing: what HHS allows
HHS says a provider may fax patient information to another provider for treatment, as long as the office uses reasonable safeguards, such as confirming the fax number before sending and keeping the fax machine in a secure location (HHS). In practice that means:
- 01Preprogram numbers you fax often and check them when they change.
- 02Use a cover sheet that identifies the sender and says what to do if it reaches the wrong person.
- 03Put the fax machine where patients and visitors can’t read incoming pages, or send incoming faxes to a secure inbox.
- 04Know who checks the fax inbox, and how often.
Online fax services and email fax
An online fax service stores the faxes it sends and receives, so it holds patient information on your behalf. HHS guidance says a cloud service that stores patient information for a practice is a business associate, even if the data is encrypted and the provider can’t read it (HHS). Before using one, get a signed business associate agreement. If the provider won’t sign one, don’t send patient information through it.
Copiers: wipe the drive before it leaves
Most office copiers keep images of what they copy, print, scan and fax on a hard drive (FTC). HHS says a practice can’t simply abandon patient information, and that electronic media must be cleared, purged or destroyed before disposal, pointing to NIST’s media sanitization guidelines (HHS). NIST SP 800-88 Rev. 2, published in September 2025, is the current version. When a leased copier goes back or an owned one is retired, get the drive wiped and keep the certificate.
What we do for practices
We sign a business associate agreement with every client that handles patient information, and we hold signed agreements with every vendor that can touch it. We run an annual HIPAA risk assessment with a written report, and printers, copiers and fax workflows are part of it. Under our managed print service, prints are released with a card or key, unreleased jobs are deleted after a set time, and retired devices go to certified recycling partners with documentation.
If your copier sits next to the front desk, Book a 15-minute call and we’ll tell you what we’d change first. See our healthcare IT services and compliance services.
Related reading
Frequently asked questions
Can you fax patient information under HIPAA?
Yes. HHS says providers may fax patient information for treatment with reasonable safeguards, such as confirming the fax number before sending and keeping the fax machine in a secure location. A cover sheet and a known process for checking incoming faxes help.
Is online fax HIPAA compliant?
It can be. An online fax service that stores faxes for you is a business associate under HHS guidance, so you need a signed business associate agreement before sending patient information through it. Without one, don’t use it for patient information.
Do printers and copiers need to be in a HIPAA risk assessment?
Yes, if they handle patient information. HIPAA’s risk analysis covers electronic patient information wherever it’s stored, and most copiers store images of documents on a hard drive. Include print release, logging and how each device is wiped before it leaves.
How do you dispose of a copier that held patient information?
Have the hard drive cleared, purged or destroyed before the copier leaves, following NIST SP 800-88, and keep a certificate. If the copier is leased, settle in the agreement who handles the drive. The FTC warns against pulling the drive yourself, because it may hold firmware.
Sources
- HHS, Can a physician’s office fax patient medical information to another physician’s office?
- HHS, Guidance on HIPAA and Cloud Computing
- HHS, What does HIPAA require of covered entities when they dispose of PHI?
- Federal Trade Commission, Digital Copier Data Security: A Guide for Businesses
- NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization, September 2025
- U.S. EPA ENERGY STAR, Imaging equipment
Next step
Let us handle this for you.
Copiers and printers sized to the work, prints released with a card or key, and toner shipped before you run out.
- 15 minutes
Tell us which question brought you here and how your office runs.
We’ll tell you how it applies to you and what we’d look at first.
If we’re not the right fit, we’ll say so.
15 minutes
