September 29, 2026
This story is fictional. If it sounds like your clinic, that’s between you and your privacy officer.
To whoever sends the faxes to (402) 555-0148:
This is the fourth time I have written, so I will try to keep it short(er).
My name is Dale Pruitt, and I’m the night manager at the Pizza Hut on Route 9. The fax machine is in the back, by the walk-in. We use it for the distributor’s order on Mondays and nothing else, and for years it did nothing else. Then last spring the phone company moved our fax line to a new number, and the machine began to ring at night.
The first one was a referral, though I did not know that word for it then. It was addressed to a Dr. Albrecht, neurology, on a cover sheet from your office with your logo, a little blue tree, and a paragraph telling me that if I was not the intended recipient I should notify the sender and destroy the document. I am not the intended recipient. I read it anyway, because the machine is next to the walk-in and the walk-in is where I eat.
There have been forty-one since. I keep them in a large-pizza box under the register, which is the cleanest thing we have that closes.
I called the number on the cover sheet. Your phone menu has nine options, none of them for a pizza place, and the last one put me on hold for physicians. I wrote to the address on the letterhead in June, July and August. Nobody has written back, and the faxes keep coming, so I suppose my letters went wherever the faxes are supposed to go.
I have gotten to know some of them. Not their faces, but their handwriting, or their doctors’. There is a man whose hands shake too badly to sign his name; his wife signs for him, and every time she writes the date under it, as if somebody might doubt her. There is a girl of fourteen with headaches. There is a Mrs. Teodora Vasquez, whose referral has come three times. The first said routine. The second said please expedite. The third came Tuesday, with STAT written across the top in red marker, and under it, in the same marker, pt calling daily.
She calls you every day, and you call me.
Last week I did what I should have done in April and looked up Dr. Albrecht. There was an obituary. He died two winters ago, at home, after a short illness. He is survived by his wife, two daughters and a golden retriever named Pepper, whom the family particularly wanted mentioned.
I don’t think he is going to call Mrs. Vasquez back. I wish somebody would.
Yours truly, Dale Pruitt, Night Manager
P.S. Every time one of your faxes comes through, our machine prints a page that says TRANSMISSION OK. I bet yours does too.
Before you read on: Is this one breach or forty-one? When did the clinic discover it? What failed first, the fax number or the referral?
Each fax disclosed PHI to someone with no right to it (45 C.F.R. § 164.502(a)), and each is presumed a breach unless the clinic’s documented risk assessment under § 164.402 shows a low probability of compromise. The four factors pull in both directions. The referrals carry names, dates of birth, diagnoses and insurance numbers, and the recipient is a stranger with no duty of confidentiality. On the other side, Mr. Pruitt kept the faxes in one box, has spent months trying to return them, and would almost certainly sign an attestation that he shared them with no one and has returned or destroyed them. An assurance like that is the kind of fact the third and fourth factors are meant to weigh, and with it the clinic might document a low probability for most of the forty-one.
The clinic probably discovered the breach in June. A breach counts as discovered on the first day it is known, or would have been known through reasonable diligence, to any workforce member other than the person who caused it (§ 164.404(a)(2)). Mr. Pruitt’s first letter reached the clinic’s mailroom that month, so the 60-day clock arguably started then and ran out in August while his letters sat unopened. For breaches affecting fewer than 500 people, the clinic still owes each affected patient a letter and must log the breach for the Secretary within 60 days after the end of the calendar year (§ 164.408(c)).
The referral template kept a dead neurologist’s number for two years, and each confirmation page, which shows only that some machine picked up, told the staff the referral had arrived. Mrs. Vasquez was waiting for an appointment that no one was ever going to schedule, which makes this a patient-safety failure as well as a privacy one.
To prevent a repeat, check every number in the referral directory whenever a provider leaves and on a regular schedule, send a test page before PHI goes to any new number, and track each referral until the receiving office confirms an appointment. Send any letter addressed to “whoever sends the faxes” to the privacy office. Where the receiving provider can accept it, Direct secure messaging or the EHR’s referral exchange takes the phone number out of the chain.
Takeaway: TRANSMISSION OK means a machine answered; confirm whose machine it was. The facts in this case are confusing, which happens a lot in an investigation. Keep asking questions until you understand who, what, when, where, and why.