1. Purpose
This policy establishes guidelines for the secure and compliant use of Synkwise’s electronic fax (eFax) module. The purpose is to ensure the confidentiality, integrity, and availability of Protected Health Information (PHI) transmitted via electronic fax, in accordance with HIPAA, applicable state regulations, and Synkwise’s internal security standards.
2. Scope
This policy applies to:
- All Synkwise platform users with access to the eFax module, including healthcare providers, nurses, caregivers, and administrative staff.
- All inbound and outbound electronic fax communications containing PHI or other sensitive information.
3. Authorized Use
- The eFax module must be used only for legitimate business and clinical purposes.
- Access is restricted to authorized users who have completed HIPAA training and been granted appropriate permissions in the Synkwise platform.
- PHI must never be sent to unverified fax numbers or non-authorized recipients.
4. Sending Electronic Faxes
- Verification: Confirm the recipient’s fax number and identity prior to sending.
- Minimum Necessary Rule: Only include the PHI necessary for the intended purpose.
- Cover Sheets: All outbound faxes containing PHI must include a HIPAA-compliant cover sheet with:
- Sender’s name, organization, and contact number
- Recipient’s name and fax number
- Confidentiality statement
- Encryption: Outbound faxes are transmitted through encrypted channels provided by Synkwise’s secure fax infrastructure.
5. Receiving Electronic Faxes
- Incoming faxes containing PHI must be reviewed promptly and routed to the appropriate patient record or designated staff.
- Faxes received in error must be reported immediately to a supervisor and deleted from the system after documenting the incident.
- PHI from received faxes must not be stored locally on personal devices.
6. Data Retention & Storage
- Fax documents are stored securely in the Synkwise EHR/EMAR in compliance with HIPAA and state retention requirements.
- Access to stored faxes is logged and monitored.
- Retention periods follow Synkwise’s Data Protection Policy.
7. Security & Compliance
- All eFax activity is logged, including sender, recipient, date/time, and transmission status.
- Users are prohibited from downloading fax attachments to unsecured or personal devices.
- Periodic audits will be conducted to verify compliance.
8. Incident Response
- Any suspected or confirmed breach of PHI via eFax must be reported immediately to Synkwise’s Privacy Officer.
- Incident handling will follow the Synkwise HIPAA Breach Notification Policy.
9. Training & Acknowledgment
- All users must complete training on secure fax handling procedures prior to system access.
- Users must acknowledge receipt and understanding of this policy.
10. Enforcement
- Violations of this policy may result in disciplinary action, including revocation of system access, employment termination, and potential legal consequences.
