Short answer: in 2026, a medical practice should no longer use fax as its primary channel for exchanging health data. Anything concerning an identified patient — a report, a lab result, a letter to a colleague, a prescription — belongs in MSSanté, the French secure health messaging system, and in the DMP (shared medical record) built into Mon espace santé. What remains is a very real residual zone: correspondents who publish nothing but a fax number (certain hospital departments, care homes, insurers, court registries, colleagues abroad). For those, the right answer is not to keep a fax machine plugged into a dead socket, but to switch to online fax with delivery by email, named-user access and an archivable transmission log.
The fax machine in a medical practice has become a paradoxical object. It is simultaneously indispensable — because some laboratory, imaging department or health insurance fund still accepts nothing else — and indefensible, because it drops a page containing a diagnosis into an output tray, in a corridor where patients walk past. Between the two, the practitioner navigates by sight.
What the regulations actually require
Three sets of rules shape the subject, and they do not quite say the same thing.
Medical confidentiality (article L.1110-4 of the French public health code) prohibits disclosing information about a patient to an unauthorised third party. It prescribes no technical channel: it makes the sender responsible for ensuring the information reaches the right recipient, and only that recipient. That is precisely where fax falls short — not in transport, but in delivery.
The GDPR and the CNIL's guidance require measures that are "appropriate" to the risk. Health data is sensitive data within the meaning of article 9: the bar is high. In its recommendations on health data security, the CNIL stresses access control and traceability — two notions that a device sitting in a reception area does not satisfy. We covered this framework in detail in our article on fax confidentiality and the GDPR.
The interoperability framework of the Agence du Numérique en Santé (ANS) and the Ségur du numérique en santé programme have, for several years now, been driving the shift of exchanges towards MSSanté and the DMP. Practice-management software vendors certified under Ségur natively support sending reports to secure messaging and feeding the patient record. In this landscape, fax has no regulatory status: it is tolerated, not recommended.
No text explicitly forbids sending a medical document by fax. But no text will protect you either if that document lands in the wrong output tray.
The difference between "permitted" and "defensible"
That is the distinction that matters in the event of an audit or a complaint. A transmission via MSSanté is defensible by design: recipient identified in the national directory, encryption, timestamping, traceability on the operator's side. A fax transmission rests on one thing alone: that you dialled the right number. Transpose two digits, and the histopathology report ends up at a dental practice.
What must go through MSSanté, and nothing else
The practical rule is simple: if the document names a patient and contains clinical information, it belongs in MSSanté.
That covers:
- consultation, hospitalisation and operative reports;
- laboratory and imaging results;
- referral letters between colleagues;
- prescriptions sent to a pharmacy or a supplier;
- medical certificates intended for a healthcare professional.
MSSanté is free for professionals, backed by the ANS health directory, and accessible either through a dedicated webmail or directly from practice software. Access requires a CPS card or an e-CPS: if your Vitale and CPS card reader is starting to produce erratic readings, a replacement approved CPS card reader costs less than half a day of reception staff time lost working around the problem.
The DMP: feed it, don't send through it
A common confusion: the DMP is not a transmission channel between professionals. It is the patient's record, viewable by them through Mon espace santé and by the professionals they authorise. You feed it; you do not "send" a document to a colleague via the DMP. The two systems are complementary: MSSanté for point-to-point exchange, DMP for lasting sharing.
The grey area: correspondents who only have a fax
This is the reality on the ground, and it is stubborn. In 2026, a community practitioner still regularly runs into these cases:
| Correspondent | Channel often imposed | Alternative available? |
|---|---|---|
| On-call hospital department | Direct fax to the ward | Varies by facility |
| Care homes, home nursing services | Reception fax | MSSanté if the facility is connected |
| Insurer, provident scheme, medical adviser | Fax or postal mail | Web portal sometimes |
| Court registry, tribunal (expert reports) | Fax | Registered mail |
| Colleague abroad | International fax | Rarely MSSanté (French-only system) |
For these flows, two rules.
First rule: anonymise whatever can be anonymised. An administrative form, an appointment request, a confirmation of a surgical slot does not need to carry a full diagnosis. Reducing the information load mechanically reduces the risk.
Second rule: stop faxing from a shared machine. This is the heart of the matter.
Why the reception-desk fax machine is no longer viable
It has no line left
Since 2018, no new PSTN connections have been sold, and the technical shutdown of the copper network is progressing town by town according to a schedule published by Arcep and the operators. Many renovated practices, or those set up in new buildings, have nothing but a fibre router. Plugging the fax into the router's "TEL" port amounts to running a modem over a compressed voice channel: transmission failures, truncated pages and mid-document disconnections are the norm, not the exception. The topic is covered in detail in our article on fax over VoIP and the failure of T.38.
It exposes documents
A page received on a fax machine remains physically accessible to anyone walking by. In a group practice, a health centre or a multi-professional health hub, that means: receptionists, locums, trainees, cleaning staff, sometimes patients. A cross-cut document shredder in the copy room only solves the end of the paper's life, not its stay in the tray.
It records nothing usable
The slip printed at the bottom of the machine is flimsy evidence: thermal paper, illegible within two to five years, not linked to any patient record. We have devoted a full guide to archiving faxes and their evidential value.
The recommended setup for a practice in 2026
The objective: a residual fax flow, ring-fenced, logged, with no hardware.
1. A dedicated fax number, received in a named mailbox
Online fax delivers the fax as a PDF into a mailbox — and the choice of that mailbox is what determines security. Never route clinical data to a generic address consulted by the whole reception team. Prefer a dedicated mailbox with restricted access and strong authentication. How it works is set out in our fax-to-email guide, and the receive a fax page explains how to set things up on the number side.
2. A clean scan rather than a smartphone photo
Medical documents are dense: lab tables, curves, stamps. A black-and-white PDF at 200 dpi minimum, properly framed, with no cast shadow, gets through where a photo fails. A duplex desktop scanner with document feeder pays for itself within weeks in a practice digitising old paper files. For home visits and locum work, a USB-powered portable scanner does the same job on the move. If your transmissions come back illegible, our article on scanning and contrast settings goes through the parameters one by one.
3. A cover sheet suited to medical confidentiality
It must carry the confidentiality notice, the practice's identity, the page count and clear instructions in case of misdelivery. It must never state the reason for sending or the patient's name in clear text if the document itself already contains it. Our cover sheet template can be reused directly.
4. A verified list of correspondents
Most incidents come not from a technical flaw but from a wrong digit. Keep a list of validated numbers — verified by a check call, not copied from an old letterhead — and have it proofread. A ring binder with dividers for whatever paper remains, kept up to date, beats a sticky note stuck under the monitor.
5. A deletion policy
PDFs received are not meant to stay in an email inbox. They are filed into the patient record in the practice software, then deleted from the mailbox. The retention period follows that of the medical record — twenty years from the last consultation for a healthcare establishment, under article R.1112-7 of the public health code, a sensible benchmark for community medicine.
Special case: international
A patient followed abroad, a colleague in Switzerland, Belgium or North Africa, a repatriation insurance file: MSSanté does not cross borders. Fax, by contrast, remains a recognised worldwide standard. Check the dialling code and country availability on the supported countries page, and read our guide to sending faxes abroad before your first attempt: the causes of failure are classified there by origin.
Frequently asked questions
Can I still fax a lab result to a colleague?
Technically yes, but it is discouraged from a regulatory standpoint. If the colleague has an MSSanté address — which is the case for the vast majority of professionals listed in the ANS health directory — that is the route to use. Fax is only justified if no secure alternative exists on the recipient's side, and the transmission must then be documented.
Is fax banned for health data?
No. There is no general prohibition. But in the event of an incident, it is up to the data controller to demonstrate that the security measures were appropriate. A fax to a shared machine, with no control over who receives it, is hard to justify before the CNIL.
My fax machine stopped working after the router was changed. What should I do?
That is the classic symptom of the move to VoIP. Don't go looking for a magic setting: switch to an online fax service, which preserves your usage without depending on hardware. Number porting is covered in our article on keeping your fax number after the PSTN shutdown.
Does a received fax carry the same weight as a signed letter?
No, and that applies in medicine too. A fax is prima facie evidence: it establishes that a transmission took place to a given number, at a given time. It does not authenticate the signature. For a certificate intended for legal use, the signed original document remains necessary.
Should the transmission receipt be kept in the patient record?
Yes, when the transmission concerns an act of care: a referral, the transmission of a result, a request for an opinion. The receipt, attached to the document sent, proves the practitioner's diligence. With fax-to-email, it arrives as a confirmation email to be archived as a PDF.
How long should received medical faxes be kept?
Align the period with that of the medical record: twenty years after the patient's last visit is the usual benchmark. Thermal paper does not survive that long — systematic digitisation is not a convenience, it is a practical necessity.
Key takeaways
- MSSanté is the default route for any named document containing clinical information; the DMP feeds the patient's record, it does not replace exchanges between colleagues.
- Fax remains useful at the margins: unconnected facilities, insurers, court registries, foreign correspondents.
- The physical fax machine is the real problem, not the protocol: no more PSTN line, exposed documents, zero traceability.
- Online fax solves all three: no hardware, delivery by email to a restricted-access mailbox, archivable transmission log.
- Anonymise whatever can be anonymised, verify numbers with a check call, and archive document + receipt as PDFs.
- Align retention periods with those of the medical record, not with the lifespan of thermal paper.
To test a transmission before reconfiguring anything at the practice, the form is directly available from the home page, and special cases are gathered in the FAQ.
Tagsfaxsecuritypaperlessvoip
