A Sneak Peek Behind the Curtain of Digital Fax Security in Healthcare

Often, efforts to apply digital security standards to healthcare information exchange only exacerbate the digital divide between large organizations and small, under-resourced facilities. That’s because modern frameworks for information sharing in healthcare, like FHIR and HL7, typically are out of reach for organizations that lack financial capacity for advanced data-sharing technologies and are more likely to use digital fax to exchange patient data. 

It’s an area that one national body is working to address by developing standards that will allow small or under-resourced organizations to share data using the technology these organizations are most likely to possess: digital fax. DirectTrust is leading the charge to establish a new Standard, bringing digital cloud fax into the healthcare fold much like direct secure messaging did for email and trusted instant messaging did for texting. 

The nonprofit trade alliance is committed to advancing trust in health data exchange. The organization’s work in convening experts to develop standards for protecting the security of faxed patient data is expected to result in the release of national standards for stakeholder review later this year.

Taking a Closer Look

Disparaging fax as a method for sharing patient information isn’t a new concept. It’s one that evokes images of the paper fax machines and the cumbersome act of manually typing information into electronic records or order forms so patients could get the prescriptions, care and services needed. 

Among the current administration, the rallying cry to end faxed communications in healthcare recently became louder. “There shouldn’t be paper, there shouldn’t be faxes, there shouldn’t be letters being sent. They should all be done digitally and automatically,” Mehmet Oz, MD, administrator for the Centers for Medicare & Medicaid Services, said this past June after meeting with health plans on ways to transform prior authorization.

But this outdated view of fax fails to recognize that many healthcare organizations rely on digital cloud fax, not paper fax. This more modern take on fax can even be combined with artificial intelligence (AI) to make workflows automated, strengthening information security and efficiency. 

In fact, AI can extract unstructured data from faxed PDFs and even documents with handwritten text and apply this information to the appropriate fields in a patient’s electronic medical record. This practical solution evens the information sharing playing field between small and large healthcare organizations, ensuring that all stakeholders have the information they need to make critical decisions. 

A Future-Forward Vision for Digital Fax

While some denounce the healthcare industry’s overreliance on fax, others are working to craft new standards that will strengthen the security frameworks surrounding this prevalent tool for sharing critical data. DirectTrust’s recommendations will seek to protect faxed data through robust identity assurance, metadata enhancements and other measures to ensure data is not only secure, but also usable. Here are two of the concepts the DirectTrust consensus body is exploring:

• Identity assurance and verification. Currently, there aren’t many controls preventing someone from sending a fax that appears to come from anyone a bad actor might want to imitate. They could even send it through the White House’s fax line to enhance the ruse. 

To lessen this risk, DirectTrust’s Interoperable Secure Cloud Fax Consensus Body is developing closed-network identity assurance protocols to verify that fax senders are actually who they claim to be and that faxes are transmitted only to the intended receiver. The desired impact: better end-to-end transmission security. 

• Enhanced metadata payload: Most fax communications are cryptic mysteries that must be opened and read to be understood. This triggers a clunky cycle of circulating messages throughout an organization until the information finally lands in the right department.

To streamline these inefficiencies in information transfer, DirectTrust’s Interoperable Secure Cloud Fax Consensus Body is adding enhanced metadata to clarify what kind of information a fax contains, who the intended recipient is, and what the recipient should do with the information. This extra layer of detail makes fax markedly more useful because the recipient will know, without even opening the message, that it contains lab results for Patient A from Dr. B. Detail like this allows these communications to be automatically routed into the right workflow so the information can be acted on expeditiously. 

Until we acknowledge the essential role that fax still plays in healthcare facilities—especially small, under-resourced facilities—and focus on bridging the digital divide between fax and the EHR, the nation’s healthcare system will be unable to achieve industry-wide interoperability. Embracing fax as a critical mode of healthcare communication is essential to bringing all facilities into healthcare’s interoperability fold.