WARNING: Your Fax Machine Could be Used to Hack You!
September 11, 2018
American businesses have used fax machines to transmit images via telephone lines since the late 1980s. Now, almost forty years later, many organizations are still relying on these workhorses to do business. As of 2015, about 46.3 million fax machines were still in use, of which 17 million are believed to be operating in the United States. With so much new, cutting-edge technology available at our fingertips today, we’re still relying on antiquated technology, that could put your organization at risk and vulnerable to a hack. This is a huge problem – especially if you work with PHI!
A study shows just how vulnerable fax machines are
People assume that since fax machines have served businesses for forty plus years and have never posed an issue before, they’re not a cybersecurity risk. Surely these dinosaurs could never be the root cause of a cyber attack like a crippling network virus! Oh, could they ever be!
A recent study indicated that fax machines may present an opening where hackers can infiltrate an organization’s network. The report showed that cybercriminals can infiltrate any home or corporate network by exploiting all-in-one printer-fax machines. Hackers can send an image file over the phone line that contains malicious software. That image file lets them take control of the device and access the rest of the network, enabling them to insert a virus or ransomware of their choosing. All the hackers need is a fax number to gain access to the entire corporate network. Think about how easy it is to find out a company’s fax number, and you quickly realize how vulnerable your organization may be.
Protecting clients’ PHI when faxing
If you must use a fax capability, keep these pointers in mind:
- Consider using a more secure way of transferring information, like efax, secure email or postal mail. Check out our blog on HIPAA compliant email encryption. If you must fax, be sensible about the information you send.
- If you have to fax PHI, only send the information that is important for the claim or the issue at hand.
- Always use a cover letter to avoid casual reading.
- For any new recipients, send a test fax before sending the actual document.
- Locate all fax machines in a secured room that is only accessible to employees.
- Use a secure, dedicated fax machine for transmitting PHI. Do not publish this number on your website or business card.
- Configure your fax machine so that it does not save any copies of information you have sent.
- If you are using a traditional fax machine, pre-program important or frequently used numbers to avoid sending faxes to the wrong recipients. Make sure the recipient of the PHI is aware the fax is coming and is waiting by the fax machine.
- If your fax machine can’t support a software update, replace it or get rid of it completely.
- If the manufacturer hasn’t released a patch to fix the vulnerability, only fax using a segmented part of the network that does not connect to critical data.
- If you use an all-in-one print, copy, fax machine, disconnect it if a supplier or client does not use the fax functions.
- Most efax companies today encrypt any information they store, but you need to check to make sure they have a valid SSL/TLS license.
- eFax companies you use should sign a Business Associate Agreement and state they encrypt any of your information stored on their site.
Migrating away from sending faxes is advisable. Make your company HIPAA compliant. Don’t allow this ‘back-door” compromise your business.
Sign up for Our Blog
May 14, 2019
Jason Karn, Total HIPAA Chief Compliance Officer, spoke with Greg Manson, Direct of Audit and Compliance at Carolinas IT, about the process of hiring a Managed Service Provider (MSP). In… Read More ›Read More
April 15, 2019
Jason Karn, Total HIPAA’s Chief Compliance Officer, recently spoke with David Smith, a nationally recognized healthcare benefits consultant and regulatory expert, to discuss how fully-insured, self-funded, and hybrid employee benefits… Read More ›Read More