A healthcare group's move from fax machines to HIPAA-ready e-fax inside its EHR
A multi-clinic healthcare group with several locations and a shared electronic health record system, a leader in its segment.
- Scale
- Several clinics, 1 EHR, 1 e-fax service, a replacement for every standalone fax machine
- Engagement
- A phased rollout, one clinic at a time, after a short design and review period
The challenge
Referrals, lab results and authorizations still arrived by fax, and the paper sat in trays at each clinic. Staff retyped or scanned pages into the record by hand, documents went missing, and nobody could say who had seen a page. The group's referral partners would not give up fax, so the group needed to keep it and make it safe.
A healthcare group with several clinics and one shared electronic health record still received referrals, lab results and authorizations by fax. The paper sat in trays, staff retyped or scanned pages into the chart by hand, and nobody could say who had seen a page. Referral partners would not give up fax, so the group needed to keep it and make it safe. The client is not named on this page, and this is an illustrative engagement that describes the kind of work our team does; details are composite.
The work started with an inventory of every fax number and machine in use. Each number was kept or ported, so partners saw no change on their side. The new fax path runs through the Communicator, with encryption in transit and at rest and a signed business associate agreement with every vendor that touches a page, because a fax with patient information is protected health information.
The central piece was the integration with the record system. An incoming fax is filed in the correct patient chart, and an outgoing fax is sent from the chart, so the steps of printing, scanning and retyping disappear. Documents that cannot be matched automatically go to a small review queue with a named owner, so nothing sits in a tray.
Access follows roles: each clinic sees only its own queues. An audit log records who viewed, sent, forwarded or deleted each page. Retention follows the group's own policy, the change was entered in its risk analysis, and a runbook covers outages and misdirected faxes. Staff were trained clinic by clinic before the old machines were retired, and the devices were wiped and recycled under a written process.
The group's fax traffic now lands in the patient record, and compliance staff can answer who saw which document and when. Referral partners kept using fax as before. This is a controls improvement and not a certification of HIPAA compliance, and it is not legal advice; the group's compliance officer and counsel decide what meets the rule.
What our team delivered
- A review of every fax number and machine in use, with each number kept or ported so referral partners saw no change
- HIPAA-ready e-fax through the Communicator, with encryption in transit and at rest and a signed business associate agreement with every vendor in the path
- An integration that files incoming faxes into the right patient chart in the EHR and sends outgoing faxes from the chart, with no paper step
- Role-based access so each clinic sees only its own queues, and an audit log of who viewed, sent, forwarded or deleted each page
- Retention settings matched to the group's own policy, a documented risk analysis entry for the change, and a runbook for outages and misdirected faxes
- Staff training in each clinic before its machines were retired, with the old devices wiped and recycled under a written process
Result
The group's fax traffic now lands in the patient record, and the trays of paper are gone. Compliance staff can answer who saw which document and when. The group's referral partners kept using fax as before. This is illustrative and describes the kind of work our team does; details are composite, and a controls review is not a certification of HIPAA compliance.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Show 3 more
Clayton Communicator seat
Business voice, e-fax and text messaging for each user, with Microsoft Teams integration, from one service and one bill.
Live within 10 business days; porting takes longer
$32 per user, per month
E-fax, HIPAA-ready
Send and receive faxes from email or a web portal, with encryption and access logs. For practices and offices that still must fax.
Live within 5 business days
$19 per fax number, per month
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
One phone system, every channel
Desk phones, softphones and Microsoft Teams reach the Clayton Communicator core through a session border controller (SBC) and a SIP trunk to the carrier. The core handles voice, e-fax and business SMS (registered for 10DLC), writes call recordings to an encrypted vault, and connects to your ERP so a call opens the right record.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.