Submission Date
Question
In this RAQ’s section 2, “Libraries, Fax Lines, and HIPAA,” you say, there is NO CIRCUMSTANCE under which a public, academic or public library should be engaging in a HIPAA-governed communication.” You also say, “If your library is not transmitting this type of information, you can stop sweating about HIPAA, even if patrons are using your fax to send it.”
Just so that we are crystal clear: this means that if patrons need to use a fax machine to correspond with a doctor’s office, it’s okay as long as they are the ones who physically use the fax machine? If they require help, can staff tell them how to use the machine as long as we don’t handle the physical documents?
Answer
Not quite.
What this means is that so long as the information is being transmitted as a library service, and not as library business, it is not subject to HIPAA.
This means that when helping a patron send a fax to their doctors, library workers can handle the documents and even push the buttons on the fax machine without violating HIPAA.[1]
That said, may libraries put guardrails around workers’ handling of sensitive documents (banking and health being two of the major categories), regardless of whether such handling is “legal.” This is to protect workers from accusations of identity theft and invasion of privacy, as well as from the distressing by-products of reading patrons’ confidential information.[2]
Fax machines are not the most intuitive of technology, so there is a strong chance some patrons may ask for help.[3] In addition, the small buttons and other operational aspects of a fax machine can be a challenge for people with certain disabilities.
To enable assistance but protect workers, if a library wants to be able to help patrons with physical actions related to handling sensitive documents (faxing, copying, scanning[4]) there should be a clear reason, and protocol.
There are all sorts of options for this, but here is any example to post near a fax machine:
If you need physical assistance faxing a document:
- Please let a library worker know.
- The library worker will give you a folder.
- Put your documents to be faxed in the folder.
NOTE: If your documents don’t fit in the folder, are stapled, or the pages are too creased to be faxed, the Library cannot assist. Please return when the document is in a condition to be faxed. To protect our workers, we cannot prepare your documents.
- Keep the fax number handy!
- Let us know when you are ready, and as time allows, a library worker will: load the pages, enter the fax number, stay with you as the pages are transmitted, and return the pages to the folder for you to take back.
- Library workers are instructed to not review what is on the pages, and please do not ask them to. This is for everyone’s protection.
- The library worker will hand you the fax transmission report.
- If the fax fails, and we have time, we’ll help figure things out!
- For your privacy, our fax machines do not retain a copy of what was sent after [#] hours.
This type of protocol can be modified as needed,[5] but the important things are: please don’t ask us to review your documents, and please don’t ask us to manipulate your documents.
But to be clear, the reason for a library to adopt these protections is to protect workers and to respect patron privacy, not to comply with HIPAA. And because of the labor involved, a library can simply say: due to privacy concerns, we cannot assist with faxing.
Thank you for seeking this clarification!
[1]^ If a health insurance company or a doctor used the library’s fax machine to send health information, THAT might violate HIPAA, but the violation would be by the health insurance rep or the doctor, not the library.
[2]^ See Ask the Lawyer RAQ Filling Out Forms for Patrons.
[3]^ Many lawyers also refuse to learn how to use them, simply so they can credibly ask a paralegal to do the work. Not that I would engage in that type of ignorant elitism. Nope.
[4]^ I am leaving out most digital activity, because that’s covered in CLRC’s “Digital Navigators” guide.
[5]^ For instance, you can helpfully point out that creased pages can be addressed by making a fresh copy. But if I get that far into the weeds, I’ll start talking about what type of folder to use, or what font this notice could be in, and I have no legal basis to do that.