Medical Faxing in 2026: Sending Without Breaching Confidentiality

Short answer: in 2026, fax is not banned in healthcare, but it is no longer the reference channel. For any exchange between healthcare professionals, secure health messaging (MSSanté) is the expected tool; fax retains a legitimate place as a fallback channel and for correspondents who aren't equipped — on-call pharmacies, court registries, administrative departments, organisations abroad. Provided three rules are respected: a number verified before every send, a reception process that never prints in a corridor, and a record kept with the document. The real risk isn't the technology: it's the mistyped digit.

In a group practice, a diagnostic laboratory or a care home, the fax machine — or its online replacement — still rings every day. Prescriptions sent to a pharmacy, imaging reports, funding requests, prior-authorisation forms, transmissions to an emergency department that isn't answering its inbox: fax survives because it is the only channel everyone still has, with no shared directory, no account to create, no app to install.

The problem is that this channel carries health data, which is the most sensitive category European law recognises. Here's how to hold both ends: keep faxing when you have to, without exposing a patient.

What the rules say in 2026

Three legal frameworks shape the question, and none of them mentions fax by name.

Professional confidentiality (Article 226-13 of the French Criminal Code, Article L.1110-4 of the Public Health Code) requires that information about a person receiving care be known only to those who need it. The medium is irrelevant: a fax landing in the wrong tray is the same breach as a file left in a waiting room.

The GDPR classes health data as a special category (Article 9) and requires "appropriate" security measures (Article 32). The assessment is proportionate to the risk: the CNIL doesn't demand the same arrangements for an appointment request as for a histopathology report.

The Ségur framework and the doctrines of the Agence du Numérique en Santé have for several years pushed towards MSSanté for professional-to-professional exchanges, and towards Mon espace santé for exchanges with patients. The direction of travel is clear: fax is no longer in the target model.

The CNIL has repeatedly issued reminders about faxing health data — its consistent position is that sending by fax remains possible when no safer channel is available, subject to reinforced organisational precautions. That is precisely the space we're operating in.

Fax in healthcare in 2026 is the spare tyre. You don't drive on it every day, but you don't empty the boot either.

What can still go by fax, and what shouldn't

Let's sort it out, service by service.

Two rows deserve a comment.

Results sent to the patient. Many patients ask, "can you fax it to me?" A personal fax number is almost always shared: a workplace, a building management office, a copy shop. This is a refusal on principle, replaced by handing the document over in person, sending it by post, or depositing it in Mon espace santé.

Correspondents abroad. A report to send to a colleague in Germany, a records request to a clinic in Portugal, a medical repatriation to coordinate: national health messaging systems don't talk to one another. Fax remains the lowest common denominator — our compatible countries page gives an idea of the coverage, and the pitfalls specific to international sending are detailed in our dedicated guide to sending a fax abroad.

The real risk: the wrong number

Ask any data protection officer at a healthcare organisation: the number-one fax incident isn't interception. It's sending to the wrong recipient. A transposed digit, an old number still stored in a machine's memory, a correspondent who has moved and whose line has been reassigned to a shop.

The classic scenario: an admin office sends out a batch of reports on a Friday evening using speed-dial keys programmed three years earlier by a colleague who has since left. Two numbers out of forty no longer correspond to anything medical. Nobody notices, because the transmission report says "OK" — the fax did arrive, just not with the right person.

Five habits that eliminate most of the risk:

1. A single written, dated directory. No numbers in the machine's memory, no sticky notes on the cabinet. A list kept up to date, with the date of last verification next to each correspondent. A simple ring binder with alphabetical dividers is more than enough; what matters is that there is only one reference copy.
2. An annual check of the most-used numbers, via a verification call.
3. The first-send rule. For a new correspondent, send a cover sheet alone first, get confirmation, then send the documents.
4. Double-reading for any sensitive named document: the person dialling reads the number out loud, a second person checks it against the document.
5. Immediate removal of a correspondent as soon as anything abnormal comes back.

And if the mistake happens anyway: call the number reached, request destruction, log the incident in the data breach register, assess whether to notify the CNIL within 72 hours. A medical fax sent to an unauthorised recipient is a personal data breach within the meaning of Article 33 of the GDPR, with maximum sensitivity. Failing to document it makes everything worse.

Reception: where confidentiality is really lost

An incoming fax is an open document sitting on a cabinet. In many organisations, the fax machine is still in the front office, sometimes in a corridor used by patients, delivery drivers and outside contractors.

Moving to fax-to-email solves the paper problem — provided you don't create another one.

A shared service mailbox, never a personal one. fax@practice-x.fr checked by several authorised people, not the address of Dr Y who is away for three weeks in August. We cover the principle in our guide to receiving a fax by email.

Hosting consistent with health data. As soon as a provider stores personal health documents, the question of HDS certification (approved health data host) arises, along with the location of the servers. Failing that, you drastically limit the retention period on the platform side: immediate download, automatic purge, no online archive.

A short retention period. The useful document is the one filed in the patient record, not the one lingering in the inbox. Once filed, delete it.

Controlled printing. If you still print, using a confidential print code on the department's copier prevents pages being abandoned in the output tray. And if the workstation is exposed, a privacy filter for the screen stops anyone reading it from an angle when a patient walks up to the desk.

The copper switch-off has already changed things

The timetable for shutting down the copper network, overseen by Arcep and rescheduled by Orange in early 2026 for several million lines, directly affects practices and small facilities. The consequences are very concrete.

Analogue fax machines become temperamental. Behind a VoIP adapter, fax modulation travels badly: truncated pages, failures halfway through a ten-page report, error reports with no explanation. Our article on T.38 and fax failures over VoIP describes the settings that can rescue a setup, but the truth is that replacing the hardware with an online service is often quicker.

The number must be kept. A fax number appears on prescription pads, door plaques, professional directories and laboratory agreements. Porting it to an online fax service needs to be prepared several weeks in advance.

Power matters. A router that reboots means a dead line. A small UPS for an internet router keeps access running through brief outages — also useful for the workstation running your practice software.

Paper documents still need scanning. Incoming letters, older files, hand-signed forms: a duplex scanner with automatic document feeder cuts the time spent preparing a send by five, and produces PDFs far more legible than hurried photocopies. On image quality itself, our settings are detailed in the article devoted to unreadable faxes.

The seven-point procedure to pin up in the front office

One sheet of A4, pinned above the workstation. Nothing more.

1. The channel. Does the correspondent have an MSSanté address? If so, use it. Fax is a fallback, and it should be justified in one line of the audit trail.
2. The necessary minimum. Send only the documents requested. Not the whole file because "it's simpler".
3. The cover sheet. Name of the receiving department, number of pages, confidentiality notice and instructions in case of error. The template is in our article on the fax cover page.
4. The number. Read twice, taken from the reference directory, never from a machine's memory.
5. A prior phone call for anything urgent or highly sensitive: "I'm sending you three pages now, please confirm receipt."
6. The record. Transmission report kept with the copy sent, in the file or in the outgoing-fax binder.
7. Anomalies. Repeated failures, an odd report, an unknown recipient → stop, report it, don't redial ten times.

This procedure adds fifteen seconds per send. It prevents the incident that costs you a complaint, a CNIL notification and lost trust.

Frequently asked questions

Is fax banned for health data?

No. No law prohibits it. But the GDPR's security obligation and the doctrines of the Agence du Numérique en Santé make MSSanté the expected channel between professionals. Fax remains defensible when no alternative exists at the recipient's end, provided you can justify the precautions taken.

MSSanté or fax: which should I choose for a report?

MSSanté as soon as the correspondent is registered — it's encrypted, identified and can be integrated into practice software. Fax comes in when the correspondent can't be reached that way: an organisation without the system, a correspondent abroad, a service outage.

Is online fax less secure than a fax machine?

Generally more secure. The document isn't printed, it doesn't sit in a tray, access is named and logged. The point of vigilance shifts to the provider: where the files are stored, for how long, under what certification. See also our comparison of fax versus secure messaging.

How long should a medical fax be kept?

As long as the document it carries: the retention period applicable to the patient record, generally twenty years from the last visit for a healthcare facility. The transmission report is kept with the document, not separately.

What should I do if a medical fax goes to the wrong number?

Call the recipient immediately to request destruction, log the incident in the breach register, assess the severity for the patient and, if the risk is high, notify the CNIL within 72 hours and inform the person concerned.

Key takeaways

• Fax isn't banned in healthcare, it has been downgraded: MSSanté first, fax as a documented fallback.
• The dominant risk is the wrong number, not interception: a single directory, double-reading, annual verification.
• Never fax results to a patient's personal fax number.
• On reception: shared service mailbox, short retention, no printing in a public-facing area.
• The copper switch-off means planning ahead for number porting and retiring the analogue fax machine.
• Every wrong-recipient incident is a data breach: record it, assess it, notify if necessary.
• To test a compliant send before rolling out the procedure, the form is accessible from the home page, and edge cases are covered in the frequently asked questions.