HIPAA Fax Cover Sheet for NEMT: Printable Form for PCS Forms, Standing Orders, and Trip Logs

Fax is still one of the ways clinics, health plans, and brokers move NEMT papers, such as a medical necessity form, a standing order, or a day’s trip list. WellTrans’s Indiana agreement (revised October 16, 2025) requires its providers to keep a fax line, to receive trip reservations by fax or its secure website each day, and to confirm receipt. It charges $100 each time the fax line or machine cannot take a fax for an hour or more during business hours. MTM Health’s Rhode Island handbook (last updated July 1, 2026) has providers email or fax a written incident and accident report within 24 hours.

A cover sheet is the page a stranger reads first when a fax lands at the wrong number. This one tells that person whose fax it is and what to do, and it says nothing about the rider.

How to use this template

1. Confirm the fax number before the first fax to any office. Call the office’s main number and ask for its fax number, rather than copying one off a form or a fax you received. Write it in your fax directory with the date and the name of the person who gave it. Dial from that directory, not from memory.
2. Fill in Part 1 for each fax and put it on top. One sheet per transmission. Use your trip, authorization, or claim number on the reference line, and tick what is enclosed.
3. Send only the pages the office needs. A day manifest listing twelve riders does not go to a clinic that needs one trip record. Print or copy only that record.
4. Tick the notice box in Part 1 when the papers came from a substance use treatment program, such as a methadone clinic. The section on those papers below says why.
5. Watch the confirmation page. It should show the number you meant, the page count, and a successful result. Staple it to your copy and fill in a line of Part 2. If it shows a different number or a failure, check the number with the office before you send again.
6. If a fax reached the wrong number, work Part 3 the same day. The first call matters more than the paperwork.
7. Go through Part 4 once a year, and again when you change a fax machine, a copier lease, or an online fax service.

For what to teach staff about faxes, texts, and email, see the NEMT HIPAA policy template.

The template

Part 1: Fax cover sheet (one per fax)

Field	Write the entry here
Date and time sent
From (company name)
Sender’s name and role
Callback number (a line a person answers)
Sender’s fax number
To (office or company)
Attention (department or role, not a rider)
Recipient’s fax number
Pages, including this one
Our reference (trip, authorization, or claim number)
Reply needed by (date)

Enclosed (check all that apply)

Check	Kind of papers
☐	Medical necessity or physician certification form (PCS)
☐	Standing order request or renewal
☐	Trip log, manifest page, or signed trip record
☐	Claim backup (trip record, authorization, remittance page)
☐	Incident or accident report
☐	Other (describe the kind of paper, never the rider)

Confidentiality notice (leave this printed on every sheet)

This fax is for the office named above and may hold private health information that the law protects. If you are not that office, please do not read, copy, or pass on any page. Call ______________________ right away, tell us what you received, and shred the pages or send them back to us.

Substance use treatment records (check if the papers came from a treatment program)

Check	Notice
☐	42 CFR part 2 prohibits unauthorized use or disclosure of these records.
☐	A copy of the patient’s consent is attached, or a short note says what the consent covers.

Part 2: Send log

Date and time	Sent to (office and person)	Fax number, and how it was checked	Pages	Our reference (no rider names)	Confirmation page kept (yes or no)	Sent by (initials)

Part 3: Wrong-number checklist

Step	Done (date, time, initials)
1. Call the number you dialed. Say only that you sent a fax there by mistake, and do not read out any rider details. Ask who has the pages, what they did with them, and whether anyone copied or forwarded them.
2. Ask them to stop reading, not to copy or pass on any page, and to shred the pages or send them back.
3. Write down the name, role, and phone number of the person you spoke with, and the time of the call.
4. Ask for a short note, by fax or email, saying the pages were destroyed or returned.
5. Check the right number with the office, then send the papers again with a new cover sheet.
6. Remove or correct the bad number in your fax directory and on every speed dial.
7. Tell your HIPAA contact the same day, and open a line in your HIPAA breach log.
8. Tell your broker or health plan if your agreement requires it, on the agreement’s deadline.
9. Complete the four-factor risk assessment and write down the result.

Field	Entry
Number dialed
Number it should have been
How the mistake happened (typed wrong, old number, speed dial, other)
Who answered (name, role, organization)
Papers sent (kind of paper, pages, our reference)
What the recipient did with the pages
Written confirmation received (date)
Reported to our HIPAA contact (date)
Reported to the broker or plan (date and person told)

Part 4: Machine and service check (yearly)

Question	Answer and date
Is the fax machine in a room that visitors and riders cannot walk into?
Does the fax machine or copier keep copies on a hard drive? (ask the company that leases or services it)
What does the lease say happens to the hard drive when the machine goes back?
Date the hard drive was last overwritten
Does every online fax service we use have a signed business associate agreement? (service name and date signed)
Date every number in the fax directory was confirmed with its office

Reviewed by (name and date): ______________________________

What HIPAA says about a cover sheet

Nothing in 45 CFR Part 164, which holds the Privacy, Security, and Breach Notification Rules, mentions a fax cover sheet or sets its wording (eCFR as of October 2026). The rules ask for safeguards instead. A covered entity must have appropriate administrative, technical, and physical safeguards for protected health information and must reasonably safeguard it from unintentional disclosures (45 CFR 164.530(c)). A business associate may use or disclose it only as its business associate agreement and the Privacy Rule allow (164.502(a)(3)), and must protect electronic information under the Security Rule (164.302). HIPAA for NEMT providers explains which of those you are.

So the sheet is one safeguard among several. The confidentiality notice on it only asks a stranger to do the right thing, and it does not undo a wrong-number fax: what counts afterward is who received the pages and what they did with them. The checked number, the minimum pages, and the saved confirmation page are what show you took reasonable care.

What the law does require on page one

Federal law makes it unlawful to send a fax from a computer or other electronic device unless the date and time sent, the name of the business or person sending it, and the phone number of the sending machine or sender are marked at the top or bottom of each page or on the first page (47 CFR 68.318(d); 47 U.S.C. 227(d)). Machines made since December 20, 1992 must print it on each page themselves. Part 1 carries the same facts, so the first page meets the rule even when your machine or service adds no header.

Keep ads off the sheet. A fax that advertises your services to an office that did not ask for it falls under the FCC’s junk fax rule, which requires an established business relationship, a fax number the office gave you or published, and an opt-out notice on the first page (47 CFR 64.1200(a)(4)).

Check the number and send the minimum

When someone you do not know asks for rider papers by fax, a covered entity must first verify who they are and their authority to receive them (45 CFR 164.514(h)(1)(i)). HHS explained in 2000 that providers often do this by calling the requester back through the organization’s main switchboard rather than a direct number (65 FR 82462, 82719). The same call is the easy way to confirm a number you are about to send to.

HIPAA also limits what you send. A covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary for the purpose, with an exception for disclosures to a health care provider for treatment (45 CFR 164.502(b)). That is why Part 1 holds a reference number and a kind of paper, and why the manifest of twelve riders stays home. The minimum necessary entry shows how that rule applies to a driver’s day.

If a fax goes to the wrong number

A disclosure HIPAA does not allow is presumed to be a breach unless you show a low probability that the information was compromised, using at least four factors: what the information was, who got it, whether it was actually viewed, and how far you reduced the risk (45 CFR 164.402). The three exceptions rarely fit a fax to an outside office. The one for a mix-up between two authorized people covers staff at the same company, not a stranger.

HHS used this very case as its example in the January 25, 2013 final rule (78 FR 5642). A covered entity that faxes health information to the wrong physician practice, whose doctor calls to say it arrived by mistake and was destroyed, may be able to show a low risk after doing an assessment. HHS declined to write an exception for faxes to the wrong number, because the answer depends on who received it, what it held, and what you did about it (78 FR 5646). It adds that a recipient bound by HIPAA, such as another clinic, may mean a lower probability of compromise, which you weigh with the other factors (78 FR 5643).

You carry the burden of showing that either every required notice went out or the incident was not a breach (164.414(b)). Your send log and the checklist in Part 3 are that evidence. A covered entity must keep that documentation for six years (164.530(j)), and your HIPAA breach log is the place to file it. A business associate must tell the covered entity without unreasonable delay and within 60 days of discovery at most (164.410(b)). A subcontractor owes the same report to the business associate that hired it (164.504(e)(5) and 164.314(a)(2)(iii)), so a report can pass up the chain. Agreements often set a shorter clock: WellTrans’s subcontractor agreement sets one business day. The steps, deadlines, and notices are in what to do after a NEMT data breach.

Online fax services and the machine itself

A fax machine that scans a paper page is not making an electronic transmission under HIPAA, even if the page was printed from a file (45 CFR 160.103, definition of electronic media; 78 FR 5576). A fax sent straight from a computer or app starts as an electronic file, so the Security Rule applies to it (164.312(e), transmission security). Fax machines and copiers that store pages are covered too. HHS said in 2013 that protected health information kept in a copier or fax device is subject to the rules, that you should monitor or restrict physical access to a fax machine that handles it, and that a leased machine should have its stored information removed before it leaves your hands (78 FR 5576).

The FTC’s guide to digital copiers adds that the hard drive keeps data about documents the machine copies, prints, scans, or faxes, that deleting or reformatting does not remove it, and that you should overwrite the drive at least once a month and settle in the lease who keeps or wipes it at turn-in (July 2017). HIPAA’s own rules require policies for the final disposal of hardware that holds electronic health information and for removing it before reuse (45 CFR 164.310(d)(2)).

For an online fax service, ask what it keeps. HHS says the conduit exception is narrow and covers transmission services, including temporary storage incident to transmitting. A company that maintains protected health information for you is a business associate even if it never views it (78 FR 5571). A phone company that only carries the call, with at most occasional random access to confirm it arrived, is a conduit. A service that holds your sent and received faxes in an account is storing them for you, so get a signed agreement before it touches rider papers. The conduit table in the dispatch outsourcing guide lists other vendors the same way, and the business associate agreement entry says what the contract must hold.

Papers from a substance use treatment program

A methadone clinic’s standing order or attendance sheet can identify a rider as a patient of a treatment program. Under 42 CFR 2.32, each disclosure made with the patient’s written consent must be accompanied by one of two written statements, plus a copy of the consent or a clear explanation of what it covers. The short statement is: “42 CFR part 2 prohibits unauthorized use or disclosure of these records.” The long one lists the uses and disclosures still allowed, including by a covered entity or business associate that received the record for treatment, payment, or health care operations.

The limits then follow the record. The part 2 restrictions apply to anyone who receives records directly from a part 2 program, a covered entity, or a business associate and is notified of the ban on redisclosure under 2.32 (42 CFR 2.12(d)(2)(i)(C)). No one who obtains such a record may use it against the patient in criminal charges or in a civil, criminal, administrative, or legislative proceeding without the patient’s consent or a court order (2.12(d)(1)). No rule tells a NEMT company to copy the notice onto its own cover sheet. Part 1 does it as a safeguard whenever you pass those papers on, so the limit stays attached to every copy. The methadone rides guide covers the rest of the privacy rules for those trips.

Forms that arrive by fax

Ohio treats a photocopy, an electronic copy, or a fax of the completed, signed, and dated practitioner certification form as valid as the original for documentation, when the member is not in a managed care plan (Ohio Administrative Code 5160-15-27, effective August 1, 2026). Managed care plans are not obliged to use that certification process. Illinois lists a fax receipt among the proof it accepts that you tried to get the required physician certification statement from the patient’s attending physician or another approved medical professional (HFS Handbook for Providers of Transportation Services, March 11, 2024, section 205.1). Your own send log gives you the same kind of record: keep the confirmation page with the request.

California plans publish their own fax numbers for the PCS, listed in the Medi-Cal PCS form guide. Check each plan’s number before you save it. The medical necessity form entry covers what each state asks you to keep.