Passport retains transmission records for every fax sent and received through the platform. Those records include the timestamp of the transmission, the sending number, the receiving number, the transmission status, and the delivery confirmation. They do not include the content of the fax itself, which is destroyed after delivery using FIPS 140-2 compliant deletion as part of Lane’s content handling architecture.
The retention of transmission metadata is the compliance record that organizations need for HIPAA audit control requirements, CLIA survey responses, CAP accreditation reviews, and legal proceedings. The content of the document is not what is retained. The fact that the transmission occurred, when it occurred, between which parties, and whether it was successfully delivered is what the audit trail captures.
Why Retention Matters for Compliance
HIPAA’s Security Rule requires covered entities to retain documentation of their security policies and procedures for six years from the date of creation or the date when they were last in effect, whichever is later. The audit logs that document fax activity involving PHI are part of that documentation requirement.
For clinical laboratories subject to CLIA, the documentation of result reporting, including critical value notification, needs to be available for CLIA survey and CAP accreditation review. For organizations that may be involved in legal proceedings where the timing of a fax transmission is relevant evidence, the audit record needs to be available for the period during which litigation could arise.
How to Access Transmission Records
Transmission records are accessible through the Enterprise Status Manager, which provides a searchable interface for all fax activity. Records can be filtered by date range, sending number, receiving number, transmission status, and workgroup. For compliance reviews or legal proceedings that require documentation of specific transmissions, the search capability allows the relevant records to be identified and produced without a manual review of the entire log.
For organizations with specific retention requirements that differ from Lane’s standard retention period, or with questions about how transmission records interact with their broader HIPAA documentation retention program, contact the Lane team or schedule a strategy call to discuss your specific requirements.
