Technology

This is a great question. Before we jump into it, let’s summarize the three types of faxing set out in the referenced article:

1. “Walk-up Faxing” (on a copper line)
2. “Virtual Fax” (it’s really email![1])
3. “Real-Time T.38 Fax Lines” (still e-mail, but with a better connection)

The “T.38” as a “best practice” intrigued me, so I dug in to see if there was any case law featuring it.

There is! And it digs into the capability of the T.38: [2]

Defendant further attacks Richard’s credibility by claiming that his testimony reveals his failure to understand the intricacies of fax technology. These critiques are frivolous. For example, defendant claims Richard’s credibility is undermined by his allegedly inaccurate testimony that: (1) MessageVision used only the T.30 protocol; and (2) a device such as MessageVision’s that uses the T.38 protocol cannot use the T.30 protocol. Even if defendant is correct that Richard’s testimony reflects his limited comprehension of fax technology—a proposition that appears to be dubious at best—defendant’s argument is contradicted by the fact that his own expert admits that T.38 converts to T.30 when a fax is sent using APX 1000.

Well then.[3]

So, with “the intricacies of fax technology” now established as a legal niche, let’s take the questions about faxing and regulatory compliance acronym-by-acronym.

• FERPA
• HIPAA
• SOX[4]

1. Libraries, Fax Lines, and FERPA

FERPA does not apply to public libraries, so we’ll discuss it in the context of school libraries.

Academic libraries at institutions that receive federal assistance have to follow the “Family Education Rights Privacy Act,” which (among many other things) restricts third-party access to education records.[5]

As an example: if I am a student at ABC College, I need to borrow something via an inter-library loan, and (for some odd, steampunky reason) the lending library will only receive loan requests by fax, FERPA could restrict third-party access to the request, if the request lists me (the student) by name as the borrower.[6]

In this case, the manner in which the fax is sent (copper, email, fancy T.38) does not matter. What matters is that either a) I consented for my FERPA-protected education record to be shared with a third party or b) inter-library lending is set up in a way that makes lending libraries (sorta) part of the institution under 34 CFR § 99.31.[7]

After that, the fax simply has to be sufficiently secure to get it from point A (the library) to point B (the other library) without disclosure to a third party.[8]

So that’s FERPA.

2. Libraries, Fax Lines, and HIPAA

HIPAA and other laws related to medical privacy are important and high-stakes; the fine for a HIPAA violation is $50,000 dollars.

Before we delve into this, aside from a hospital librarian or librarian serving a program providing health services, there is NO CIRCUMSTANCE under which a public, academic or public library should be engaging in a HIPAA-governed communication.[9]

What do I mean by “HIPAA-governed communication?” Here’s the type of information governed by HIPAA:[10]

Individually identifiable health information

The term “individually identifiable health information” means any information, including demographic information collected from an individual, that—

(A) is created or received by a health care provider, health plan, employer, or health care clearinghouse; and

(B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual, and—

(i) identifies the individual; or

(ii) with respect to which there is a reasonable basis to believe that the information can be used to identify the individual.

If your library is not transmitting this type of information,[11] you can stop sweating about HIPAA, even if patrons are using your fax to send it, or (at an academic library) the health center on campus has to abide by it.

Now, if you are a library in a teaching hospital, etc., here is the deal: your institution needs to step up and provide you with 100% assurance that you have the right policies, technology, and practices to be compliant.[12] This includes assurance of a fax line that is secure, which can be any of the three solutions, so long as it is set up right and maintained properly.[13]

So that’s HIPAA.

3. Libraries, Fax Lines, and SOX

While the accountants who audit your library or larger institution may (rightly) hold themselves to the standard set by “Sarbanes-Oxley” (SOX), which was passed in 2002 to protect investors in publicly traded companies, SOX does not govern the data transmission practices of a public or academic library.

But the mention of SOX in the Forbes article referenced in the question intrigued me—it says, “Virtual fax... can be problematic if your business has certain regulatory compliance requirements to support (for example, HIPAA, FERPA and SOX).”

So, I took a look to see if there has been a SOX case involving an insecure fax... and there is!

Here is what happened as told by Judge Denise Cote in Seybold v. Groenink:[14]

In October 2004, while the chairman of ABN’s Managing Board, defendant Rijkman Groenink, met with Federal Reserve Bank regulators in New York over the Eastern European transactions, he received a fax at the Ritz-Carlton Hotel concerning the results of an internal ABN investigation regarding Iran-Libya transactions. Groenink allegedly ordered his aides to destroy the report and to stop sending sensitive documents to the United States.

So, if you are at a library near a business school prepping students for stellar careers in international business... it may be helpful to show that we must all fax wisely.

Does this mean your library needs a T.38? No, but it does mean that asking questions and developing secure systems is important.

You may even want to do the research and see if you can fight to keep at least one copper line.[15] There is strength in having a diversity of technology.[16]

Thank you for an excellent question!

Update 7/23/2025: We received a followup question on this topic; read our answer here.

The concerns raised by the member are valid: absolutely, Artificial Intelligence (AI) OR real people can use published documents, including policies, to exploit a target.

What’s interesting is that this issue actually pre-dates AI; it emerged early in the Internet era, when (often nefarious) people would use information published on websites—along with other techniques—to exploit targets.

Here is a fictional example:

A business’s website includes its protocol for visitors, photos of the interior of its office, and its fiscal policy. A would-be thief we’ll call “Cooper” reviews the protocol, assesses the office interior, and uses the information to gain access to a manager’s office, where Cooper acquires the serial number of a computer. Coopers then calls that office, pretending to be IT (the serial number aids this impersonation) and gets a username and password for the business’s online banking system, which Cooper uses to access accounts described in the fiscal policy.

Poof! Money gone.

To guard against this, many businesses take a careful risk management approach to what they publish (and hopefully admonish people who put their passwords on Post-its).

However, anyone who reads the news knows that financial fraud based on social engineering and computer intrusion is only going up and artificial intelligence is helping with those attacks.

So, is it time to stop publishing public library policies and other documents?

No.

Published policies—even fiscal controls that set out the process for validating checks and the maximum amount of cash to keep in a safe—are not a skeleton key for hackers (AI or otherwise).

Of course, public institutions have always had to be careful about what information they make available. Staging areas and other resources for responding to terrorism and active shooters must be restricted to avoid exploitation by would-be attackers. Bank account numbers and other account-specific information should not be published. Computer passwords, the location of servers, and other sensitive information should be restricted. These considerations should be made in the drafting phase, not when the policy is ready for publication.

That said, because many of their records are FOILable,[1] public libraries should not rely on restricting access to them for security.

Rather, all public library workers and trustees with any part to play in data, financial, and physical security should be trained in the following:[2]

• Never to provide their password to anyone;
• Follow fiscal controls at all times;
• Follow all IT security rules at all times;
• Notify the IT provider in the event of a suspected data breach, virus, or attack;
• Never allow unauthorized people into restricted areas;
• Report lost keys immediately;
• Secure password lists;
• Never access sensitive information on personally owned devices (like the bank accounts username and password on a director’s cell phone);
• Immediately report and document all outside requests for system and/or fiscal information (passwords, location of servers, banking information);
• Remember that big hacks/ransomware attacks usually start with human failure (giving a password, leaving things logged in, loss of device).

So, are the member’s concerns valid? YES. Exploitive people can use AI to find, copy, and use your library’s policies in attempt to gain access to critical systems.

BUT, if the policies are not published, such people can look up public grant information, building records, or meeting minutes to make themselves sound legitimate for a different social engineering scheme. And if your policies are not available to your community, your library runs the risk of being accused of a lack of transparency.

Instead of restricting access to policies, libraries should develop policies that help prevent the library’s financial exploitation.

For example, a public library’s financial policies should prescribe appropriate internal controls and appropriate use of technology to verify transactions prior to them being irrevocable. For this, the newly released (2025) local government guidance from the New York State Comptroller is excellent.[3] This is mandatory reading for all public library treasurers, controllers, CFOs, accountants, bookkeepers, and directors.

In the same vein, IT policy should include either adequate internal resources to routinely update security and train employees, or a contract with a provider that provides the same assurance (for many public libraries, this is the role of the library system, and it is an increasingly complex and costly role).

While care in drafting policy is important, the essential elements of avoiding ransomware and other attacks are routine updates to security measures and routinely training of people to NOT BE FOOLED.

With the right training and adequate security, AI-powered or good ol’-fashioned hackers will have a tough time getting through, even if they try to use your own policy against you.[4] Train your people, and you don’t have to worry (too much) about training AI.

Now, if we want to talk about putting things behind a log-in to avoid misappropriation of content for the general good of society, that’s another story…

… for another “Ask the Lawyer.”[5]

Thanks for a great question!