HHS OCR continues enforcing HIPAA safeguards on how PHI is transmitted

The HHS Office for Civil Rights enforces the HIPAA Security Rule's requirement that covered entities apply administrative, physical, and technical safeguards to protected health information in transit. Faxing PHI is permitted, but the sending practice is responsible for confirming the destination and controlling access — the reason healthcare senders favor a channel that logs each transmission and its recipient.