美国卫生与公众服务部从未告诉医疗保健行业停止使用传真。其指导意见指出，只要采取了合理且适当的保障措施，隐私规则允许医生通过传真向另一家医疗提供者披露受保护的健康信息用于治疗。
HHS has never told healthcare to stop faxing. Its guidance says the Privacy Rule permits physicians to disclose PHI to another provider by fax for treatment, as long as reasonable and appropriate safeguards are in place.
以当天上午发送的两份相同的转诊表为例。一份通过加密且有日志记录的通道传输，该通道受签署的业务伙伴协议（BAA）管辖，并且光学字符识别软件将其索引到病历中。另一份则放在共用走廊的出纸盘里。相同的文件、相同的法律，却代表着截然不同的合规立场。
Take two identical referral forms sent the same morning. One moves through an encrypted, logged channel covered by a signed business associate agreement (BAA), and OCR software indexes it into the chart. The other sits in an output tray in a shared hallway. Same document, same law, two very different compliance positions.
《健康保险流通与责任法案》对传真周围的保障措施进行监管。传真需要符合该法案的规定吗？对于发送受保护健康信息的受保实体或业务伙伴而言，是的。但是传真机、应用程序或云服务无法代为机构实现合规。该规则要求明确机构是否围绕每一次披露采取了合理的保障措施。
HIPAA regulates the safeguards around a fax Does a fax need to be HIPAA compliant? For a covered entity or business associate sending protected health information, yes. But a fax machine, an app or a cloud service can’t be compliant on an organization’s behalf. The rule asks whether the organization has reasonable safeguards around each disclosure.
美国卫生与公众服务部表示，受保实体“必须针对通过传真发送的受保护健康信息，制定合理且适当的管理、技术和物理保障措施”，例如确认接收者的号码以及选择预先编程常用号码。一旦传真的页面变成数字文件，安全规则的保障措施标准同样适用。
Covered entities, HHS says, “must have in place reasonable and appropriate administrative, technical, and physical safeguards” for PHI sent by fax, such as confirming the recipient’s number and choosing to pre-program frequently used numbers. Once a faxed page becomes a digital file, the Security Rule’s safeguard standards apply as well.
iFax创始人兼首席执行官亚当·科布尔表示：“大多数人从询问传真服务是否符合该法案的规定开始，而这是错误的出发点。该法案不会对传真机或应用程序进行认证。我更希望人们询问谁可以打开该文件、对其进行的任何操作是否有日志记录，以及业务伙伴协议是否涵盖了读取该页面的软件，而不仅仅是传输该页面的线路。”
“Most people start by asking whether a fax service is HIPAA compliant, and that’s the wrong place to start,” says Adam Korbl, Founder and CEO of iFax. “HIPAA doesn’t certify a fax machine or an app. I’d rather people ask who can open the document, whether anything done to it is logged, and whether the BAA covers the software reading the page, not just the line carrying it.”
科布尔提出的所有问题都关乎工作流程。一份完好无损到达但放在共用队列中或被归档到错误病历中的传真，仍然会泄露患者的信息，而且该行业的泄露数据已经很高：《健康保险流通与责任法案》杂志统计，截至2026年1月上旬，光学字符识别门户网站上记录的2025年大型医疗保健数据泄露事件达772起，创下纪录。
Korbl’s questions all concern the workflow. A fax that arrives intact but sits in a shared queue, or gets filed to the wrong chart, can still expose a patient’s information, and the industry’s breach numbers are already high: The HIPAA Journal counted 772 large healthcare data breaches on the OCR portal for 2025 as of early January 2026, a record.
合规传真工作流程现已涵盖的内容OCR引擎、提取模型和路由规则如今都处理页面，且这些步骤中的每一步都承载着与传输相同的义务。
What a compliant fax workflow covers now OCR engines, extraction models and routing rules all handle the page now, and each of those steps carries the same obligations as the transmission.
加密是显而易见的切入点。《健康保险流通与责任法案》期刊（The HIPAA Journal）指出，根据当前的《安全规则》（Security Rule），它是一项“可寻址”（addressable）的规范，这一标签导致一些受保障实体认为它是可选的——而它其实从未可选过。对于云传真而言，加密应当覆盖至静态和传输中的OCR文本以及存储的图像。每一次发送、接收、查看和路由决策也都应当留下可供日后调阅的条目。
Encryption is the obvious place to begin. Under the current Security Rule it’s an “addressable” specification, a label The HIPAA Journal notes has led some covered entities to treat it as optional when it never was, and for cloud fax it should reach the OCR text as well as the stored images, at rest and in transit. Every send, receipt, view and routing decision should also leave an entry that someone can pull up later.
业务伙伴协议（BAA）从法律上将各项安排维系在一起。美国卫生与公众服务部（HHS）的业务伙伴协议范本条款概述了合同对供应商的要求，包括《安全规则》保障措施、违规报告以及针对分包商的匹配条款。根据美国卫生与公众服务部的云服务指导意见，存储电子受保护健康信息（ePHI）的云服务提供商即使没有密钥，也是业务伙伴，而管道例外（conduit exception）“仅限于纯传输服务”。
The BAA holds the arrangement together legally. HHS’s sample BAA provisions outline what the contract must require of a vendor, including Security Rule safeguards, breach reporting and matching terms for subcontractors. Under HHS cloud guidance, a cloud provider storing ePHI is a business associate even without the key, and the conduit exception “is limited to transmission-only services.”
按照这一逻辑，传输传真信号的电话运营商属于管道，而存储副本的云传真平台通常属于业务伙伴。如果OCR或数据提取在另一家独立公司运行，该公司也需要受到覆盖，通常是通过与供应商签订分包商业务伙伴协议来实现。
By that logic, a phone carrier moving the fax signal counts as a conduit, while a cloud fax platform storing copies generally counts as a business associate. If OCR or data extraction runs at a separate company, that company needs coverage too, usually under a subcontractor BAA with the vendor.
美国卫生与公众服务部关于拨错传真号码的建议同样适用于路由规则。如果规则出现失误，将转诊归档到错误的患者名下，其结果与拨错号码没有两样。在进行任何归档之前，工作人员应当对不确定的匹配结果进行人工检查。
HHS’s advice on misdialed fax numbers applies to routing rules as well. If a rule misfires and files a referral under the wrong patient, the result is no different from a misdialed number. Staff should look over uncertain matches before anything gets filed.
在这方面，供应商可以完成大量工作。iFax表示，其医疗保健平台将传输中和静态的AES-256加密与已签署的业务伙伴协议、基于角色的访问以及审计日志相结合，并在同一受控基础设施内部运行OCR。这处理了技术层面。至于政策、员工培训和风险分析，则依然需要由受保障实体来管理。
Here a vendor can do a lot of the work. iFax says its healthcare platform pairs AES-256 encryption in transit and at rest with signed BAAs, role-based access and audit logs, and runs OCR inside the same controlled infrastructure. That handles the technical side. Policies, staff training and the risk analysis are still the covered entities to manage.
访问控制补全了这一清单，而跳过它的代价是有据可查的。2024年对Change Healthcare的网络攻击始于某个未启用多因素身份验证的系统上的受损凭据，该事件最终影响了大约1.93亿个人。
Access control rounds out the list, and skipping it has a documented cost. The 2024 Change Healthcare attack began with compromised credentials on a system where MFA wasn’t turned on, and it ultimately affected approximately 193 million individuals.
安全规则正在追赶软件的发展，据报道卫生与公众服务部已开始将人工智能写入规则中，尽管最大的变动目前仍处于提案阶段。2025年1月6日公布的安全规则修订版将规定对电子受保护健康信息（ePHI）进行强制加密（仅有有限的例外情况），要求使用多因素身份验证，并呼吁进行年度技术资产清查和网络绘图。它还直接点名了人工智能：风险分析“必须考虑的内容中，除其他事项外，必须包括人工智能工具访问的ePHI类型和数量、数据向谁披露以及输出结果提供给谁”。
The security rule is catching up with software that reads HHS has started writing AI into the rules, though the biggest changes are still proposals. The Security Rule overhaul published on January 6, 2025 would make encryption of ePHI mandatory with limited exceptions, require multi-factor authentication and call for an annual technology asset inventory and network map. It also names AI directly: a risk analysis “must include consideration of, among other things, the type and amount of ePHI accessed by the AI tool, to whom the data is disclosed, and to whom the output is provided.”
时间表尚不确定：在收到近5000条公众意见后，最终行动目前的预期目标是2027年7月。民权办公室（OCR）自身的估计显示，第一年的合规成本为90亿美元，该提案将给予相关机构在最终规则出台后240天的时间来实现合规。不过，这些都不太可能改变各自的职责分工：供应商提供工具，而诊所机构仍负责运营该项目。
Timing is uncertain: after nearly 5,000 comments, final action is now targeted for July 2027. OCR’s own estimate put first-year compliance costs at $9 billion, and the proposal would give organizations 240 days after the final rule to comply. None of that is likely to change who does what, though: vendors provide the tools, and practices still run the program.
科布尔表示：“我们可以为诊所提供加密、审计追踪以及供OCR运行的受控场所。相关政策、员工培训、风险分析，这些都属于诊所自身，而不是我们的。”
“We can give a practice the encryption, the audit trail and a controlled place for OCR to run. The policies, the staff training, the risk analysis, that’s for the practice’s to own, not ours.”Korbl says.
当员工自行引入人工智能工具时，这种分工就会变得模糊。据《 Axios》报道，在由Imprivata委托进行的、针对250名医疗安全与人工智能领导者的调查中，72%的人表示人工智能工具或智能体在未获得正式IT批准的情况下就被部署了。从未经IT批准的工具不太可能出现在资产清查中，更不用说对照业务伙伴协议（BAA）进行检查了，而卫生与公众服务部所提议的那种资产清查要求正是为了将它们找出来。
That division gets blurry when staff bring in AI tools on their own. In an Imprivata-commissioned survey of 250 health security and AI leaders, 72% said AI tools or agents are being deployed without formal IT approval, Axios reported. Tools that IT never approved are unlikely to appear in an asset inventory, let alone be checked against a BAA, and an inventory requirement like the one HHS proposed is meant to surface them.
调查还发现，28%的机构已经在生产环境中使用智能代理人工智能（agentic AI），而44%的机构正在对其进行试点或测试。
The survey also found that 28% of organizations have agentic AI in production already, while 44% are piloting or testing it.
购买一叠文件，运行程序。某家诊所可能会购买一叠合规文件。合规性不是那样出售的。它必须在诊所内部运行，配备得到更新的书面政策以及接受过相关培训的员工。无法提供加密、访问控制、审计日志以及已签署的商业伙伴协议（BAA）的传真供应商不应进入候选名单。对于AI层，购买者应进一步深入了解，查明实际读取发生在哪里、商业伙伴协议是否延伸到那个范围、自动化操作是否被记录日志，以及是谁在检查软件不确定匹配结果。
Buy the stack, run the program A practice can buy a compliant document stack. Compliance isn’t sold that way. It has to be run from inside the practice, with written policies that get updated and staff who are trained on them. A fax vendor that can’t produce encryption, access controls, audit logs and a signed BAA shouldn’t make the shortlist. For the AI layer, buyers should push further and find out where the reading actually happens, whether the BAA extends that far, whether automated actions are logged and who checks the matches the software isn’t sure about.