Data Security

This is a great question. Before we jump into it, let’s summarize the three types of faxing set out in the referenced article:

1. “Walk-up Faxing” (on a copper line)
2. “Virtual Fax” (it’s really email![1])
3. “Real-Time T.38 Fax Lines” (still e-mail, but with a better connection)

The “T.38” as a “best practice” intrigued me, so I dug in to see if there was any case law featuring it.

There is! And it digs into the capability of the T.38: [2]

Defendant further attacks Richard’s credibility by claiming that his testimony reveals his failure to understand the intricacies of fax technology. These critiques are frivolous. For example, defendant claims Richard’s credibility is undermined by his allegedly inaccurate testimony that: (1) MessageVision used only the T.30 protocol; and (2) a device such as MessageVision’s that uses the T.38 protocol cannot use the T.30 protocol. Even if defendant is correct that Richard’s testimony reflects his limited comprehension of fax technology—a proposition that appears to be dubious at best—defendant’s argument is contradicted by the fact that his own expert admits that T.38 converts to T.30 when a fax is sent using APX 1000.

Well then.[3]

So, with “the intricacies of fax technology” now established as a legal niche, let’s take the questions about faxing and regulatory compliance acronym-by-acronym.

• FERPA
• HIPAA
• SOX[4]

1. Libraries, Fax Lines, and FERPA

FERPA does not apply to public libraries, so we’ll discuss it in the context of school libraries.

Academic libraries at institutions that receive federal assistance have to follow the “Family Education Rights Privacy Act,” which (among many other things) restricts third-party access to education records.[5]

As an example: if I am a student at ABC College, I need to borrow something via an inter-library loan, and (for some odd, steampunky reason) the lending library will only receive loan requests by fax, FERPA could restrict third-party access to the request, if the request lists me (the student) by name as the borrower.[6]

In this case, the manner in which the fax is sent (copper, email, fancy T.38) does not matter. What matters is that either a) I consented for my FERPA-protected education record to be shared with a third party or b) inter-library lending is set up in a way that makes lending libraries (sorta) part of the institution under 34 CFR § 99.31.[7]

After that, the fax simply has to be sufficiently secure to get it from point A (the library) to point B (the other library) without disclosure to a third party.[8]

So that’s FERPA.

2. Libraries, Fax Lines, and HIPAA

HIPAA and other laws related to medical privacy are important and high-stakes; the fine for a HIPAA violation is $50,000 dollars.

Before we delve into this, aside from a hospital librarian or librarian serving a program providing health services, there is NO CIRCUMSTANCE under which a public, academic or public library should be engaging in a HIPAA-governed communication.[9]

What do I mean by “HIPAA-governed communication?” Here’s the type of information governed by HIPAA:[10]

Individually identifiable health information

The term “individually identifiable health information” means any information, including demographic information collected from an individual, that—

(A) is created or received by a health care provider, health plan, employer, or health care clearinghouse; and

(B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and—

(i) identifies the individual; or

(ii) with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.

If your library is not transmitting this type of information,[11] you can stop sweating about HIPAA, even if patrons are using your fax to send it, or (at an academic library) the health center on campus has to abide by it.

Now, if you are a library in a teaching hospital, etc., here is the deal: your institution needs to step up and provide you with 100% assurance that you have the right policies, technology, and practices to be compliant.[12] This includes assurance of a fax line that is secure, which can be any of the three solutions, so long as it is set up right and maintained properly.[13]

So that’s HIPAA.

3. Libraries, Fax Lines, and SOX

While the accountants who audit your library or larger institution may (rightly) hold themselves to the standard set by “Sarbanes-Oxley” (SOX), which was passed in 2002 to protect investors in publicly traded companies, SOX does not govern the data transmission practices of a public or academic library.

But the mention of SOX in the Forbes article referenced in the question intrigued me—it says, “Virtual fax... can be problematic if your business has certain regulatory compliance requirements to support (for example, HIPAA, FERPA and SOX).”

So, I took a look to see if there has been a SOX case involving an insecure fax... and there is!

Here is what happened as told by Judge Denise Cote in Seybold v. Groenink:[14]

In October 2004, while the chairman of ABN’s Managing Board, defendant Rijkman Groenink, met with Federal Reserve Bank regulators in New York over the Eastern European transactions, he received a fax at the Ritz-Carlton Hotel concerning the results of an internal ABN investigation regarding Iran-Libya transactions. Groenink allegedly ordered his aides to destroy the report and to stop sending sensitive documents to the United States.

So, if you are at a library near a business school prepping students for stellar careers in international business... it may be helpful to show that we must all fax wisely.

Does this mean your library needs a T.38? No, but it does mean that asking questions and developing secure systems is important.

You may even want to do the research and see if you can fight to keep at least one copper line.[15] There is strength in having a diversity of technology.[16]

Thank you for an excellent question!

Update 7/23/2025: We received a followup question on this topic; read our answer here.

The concerns raised by the member are valid: absolutely, Artificial Intelligence (AI) OR real people can use published documents, including policies, to exploit a target.

What’s interesting is that this issue actually pre-dates AI; it emerged early in the Internet era, when (often nefarious) people would use information published on websites—along with other techniques—to exploit targets.

Here is a fictional example:

A business’s website includes its protocol for visitors, photos of the interior of its office, and its fiscal policy. A would-be thief we’ll call “Cooper” reviews the protocol, assesses the office interior, and uses the information to gain access to a manager’s office, where Cooper acquires the serial number of a computer. Coopers then calls that office, pretending to be IT (the serial number aids this impersonation) and gets a username and password for the business’s online banking system, which Cooper uses to access accounts described in the fiscal policy.

Poof! Money gone.

To guard against this, many businesses take a careful risk management approach to what they publish (and hopefully admonish people who put their passwords on Post-its).

However, anyone who reads the news knows that financial fraud based on social engineering and computer intrusion is only going up and artificial intelligence is helping with those attacks.

So, is it time to stop publishing public library policies and other documents?

No.

Published policies—even fiscal controls that set out the process for validating checks and the maximum amount of cash to keep in a safe—are not a skeleton key for hackers (AI or otherwise).

Of course, public institutions have always had to be careful about what information they make available. Staging areas and other resources for responding to terrorism and active shooters must be restricted to avoid exploitation by would-be attackers. Bank account numbers and other account-specific information should not be published. Computer passwords, the location of servers, and other sensitive information should be restricted. These considerations should be made in the drafting phase, not when the policy is ready for publication.

That said, because many of their records are FOILable,[1] public libraries should not rely on restricting access to them for security.

Rather, all public library workers and trustees with any part to play in data, financial, and physical security should be trained in the following:[2]

• Never to provide their password to anyone;
• Follow fiscal controls at all times;
• Follow all IT security rules at all times;
• Notify the IT provider in the event of a suspected data breach, virus, or attack;
• Never allow unauthorized people into restricted areas;
• Report lost keys immediately;
• Secure password lists;
• Never access sensitive information on personally owned devices (like the bank accounts username and password on a director’s cell phone);
• Immediately report and document all outside requests for system and/or fiscal information (passwords, location of servers, banking information);
• Remember that big hacks/ransomware attacks usually start with human failure (giving a password, leaving things logged in, loss of device).

So, are the member’s concerns valid? YES. Exploitive people can use AI to find, copy, and use your library’s policies in attempt to gain access to critical systems.

BUT, if the policies are not published, such people can look up public grant information, building records, or meeting minutes to make themselves sound legitimate for a different social engineering scheme. And if your policies are not available to your community, your library runs the risk of being accused of a lack of transparency.

Instead of restricting access to policies, libraries should develop policies that help prevent the library’s financial exploitation.

For example, a public library’s financial policies should prescribe appropriate internal controls and appropriate use of technology to verify transactions prior to them being irrevocable. For this, the newly released (2025) local government guidance from the New York State Comptroller is excellent.[3] This is mandatory reading for all public library treasurers, controllers, CFOs, accountants, bookkeepers, and directors.

In the same vein, IT policy should include either adequate internal resources to routinely update security and train employees, or a contract with a provider that provides the same assurance (for many public libraries, this is the role of the library system, and it is an increasingly complex and costly role).

While care in drafting policy is important, the essential elements of avoiding ransomware and other attacks are routine updates to security measures and routinely training of people to NOT BE FOOLED.

With the right training and adequate security, AI-powered or good ol’-fashioned hackers will have a tough time getting through, even if they try to use your own policy against you.[4] Train your people, and you don’t have to worry (too much) about training AI.

Now, if we want to talk about putting things behind a log-in to avoid misappropriation of content for the general good of society, that’s another story…

… for another “Ask the Lawyer.”[5]

Thanks for a great question!

This submission has it all—attention to detail, a blend of law and policy, and a reference to a past ATL.[1]

It also shows what’s at stake for libraries when we ask these two questions: who “owns” all that data on an ILS? Who sets the terms of cardholder access?

As the members questions point out, uncertainly about these issues can cause complications

Before we jump into the details, there is a critical take-away: while there is no one right answer to these questions, every library and every system should know their particular answers.

To make this answer as helpful as possible, we’ll spend a little time on why there is no single right answer to this issue. After we review the “why,” we’ll review the spectrum of approaches. And after all that, I’ll provide a diagnostic form so your library or system can assess where it stands.

The “Why”

Why is there “no one right answer” to who owns ILS data and who sets the terms of cardholder access? Because the law and its regulations give library systems and members infinite flexibility on those topics.

That flexibility means there is no prescribed model of ILS.[2] Instead, the law[3] simply conditions certain state aid on a system having “an automation program to support bibliographic control and interlibrary sharing of information resources of member libraries, and to coordinate and integrate the automated system or systems of such member libraries consistent with regulations of the commissioner.”

Those “regulations of the commissioner” state: “The plan of each public library system shall provide for coordination of the reference and interlibrary loan programs and functions of the public library system with the approved plan of the reference and research library system of which it is a member.”[4]

That’s it. There are no laws or regulations saying how that must be done.

Because of that, the “rules” of an ILS and its impact on cardholder access come from charters,[5] bylaws, contracts, and policy—all of which are set by a system’s board of trustees and then accepted by the member libraries.

This approach has led to there being a spectrum of ILS policies in New York State.[6]

Let’s explore this spectrum.

The ILS Spectrum

Library systems are formed to offer “improved and expanded”[7] library service.

To qualify for certain state aid under Education Law Section 273(d), systems must implement an “automation program to support bibliographic control and interlibrary sharing of information resources of member libraries, and to coordinate and integrate the automated system or systems of such member libraries consistent with regulations of the commissioner…”

How a system meets those requirements is up to the system. To illustrate how differently systems can do that, here is a range of solutions:[8]

One system puts major rules for ILS right in its bylaws, including that all ILS contracts and policy must be approved by the board. This is an “ILS by Bylaws and Board” model.[9]

Another system has bare-bones bylaws, but ILS policy, pricing, and contracts can only be approved by the board of trustees. This is an “ILS by Board Only” model.

Another system wants more “on the ground” input, and it wants that input to have power. It creates a council to assess ILS policy, pricing, and contracts, and those things can only be changed by the board of trustees after approval by the council. This is a “Two-Step Approval ILS Policy” model.

Another system finds bylaws and policy revision cumbersome and puts all the terms for the ILS in an “ILS Participation Contract” that must be approved by the system board and then by the board of each participating library. This is an “ILS by Contract” model.[10]

Another system wants to have ongoing stability, so it puts part of the ILS process in the bylaws, some in board-approved policy, and then outsources more mutable aspects (like pricing and desired tech functions) to a committee (or committees). The system believes in the power of shared governance, so it asks another group (usually of directors) to assess ALL changes to policy before approval by the board. And finally, it uses an annual contract process to confirm pricing and updated security measures. This is an “ILS By Everything” model.

See what I mean about diversity?[11] And these five models only illustrate a broad range of approaches; within this range, any number of permutations exist.[12]

Where your Library/System Stands

All this diversity and flexibility means it can be tough to sort out answers to the questions raised by the member:

• Who “owns” all that data on an ILS?
• Who sets the terms of cardholder access?

To answer them—because as was said at the beginning, no matter what the answer is, it must be clear—it is helpful to review certain documents while asking certain questions.

Here they are:[13]

And that’s it!

Who “owns” all that data on an ILS? It depends, but the rights and obligations of ownership should be clear between a system and its members.

Who sets the terms of cardholder access? It depends, but the rights and obligations of cardholders, member libraries, and the system should be clearly set in guidance, forms, contracts, and policies.

Thank you for submitting such a great question.