Rethinking the Fax Machine: Moving Past "We've Always Done It That Way" in Tribal Health IT
Written by Robby Jakovljevic, Director of IT, Paskenta Band of Nomlaki Indians in General Articles
Date: October 19, 2026
I'm the Director of IT for the Paskenta Band of Nomlaki Indians in Northern California, with a government, enterprises, and a health clinic. Our clinic still sends and receives faxes. Most of them are electronic faxes now, and it took real work to get there. When I moved us from faxes on a phone line to electronic fax, everybody who had been using the old fax machine pushed back. Nobody gave me a specific reason. The reason was always the same: this is the way we've always done it. If you run IT for a tribal health program, I'd guess you have heard the same sentence. I have never thought fax was secure. To me, it has always been an ancient technology that people refuse to let go of. We don't keep old technology because it's safe. We keep it because it's familiar, and familiar feels safe.
Older than the telephone
The fax machine is older than most people think. Alexander Bain, a Scottish clockmaker, received British patent number 9745 on May 27, 1843, for what he called an "Electric Printing Telegraph." It was the first fax machine, built from two pendulums kept in step at each end of a telegraph wire. Alexander Graham Bell received his telephone patent on March 7, 1876. By then, Bain's fax was thirty-three years old. Fax was designed for a world where the only people who could reach the wire were the people at each end of it. That world ended a long time ago.
What the confirmation sheet says
A traditional fax protects very little. It travels over the phone network as an open signal, without encryption. The confirmation sheet, the one that says "transmission OK," proves only that a machine at that number answered. It doesn't tell you whose machine it was, who picked up the paper, or whether the paper sat in a shared tray in a busy hallway for three hours. And a fax can't be recalled. If one digit is wrong, the document goes to whoever owns that number. That isn't a theoretical risk. In 2017, as reported by the HIV news outlet POZ, a hospital in New York City paid a settlement of about $387,000 to the US Department of Health and Human Services after a patient's HIV status and other sensitive health information were faxed to his employer instead of being mailed to the post office box he had asked for. No hacker was involved. Somebody used the fax machine the way it is designed to be used, to the wrong place.
The rule that looked away
Many people in healthcare believe the law prefers fax. Here is why. The HIPAA Security Rule sets requirements for protecting health information in electronic form. When the federal regulations define electronic media, they include a sentence that has shaped healthcare for more than twenty years: certain transmissions, "including of paper, via facsimile," are not considered electronic if the information didn't exist in electronic form immediately before it was sent.
That sentence doesn't say paper fax is secure. It says paper fax is not electronic, so the rules written for electronic information don't reach it. The privacy rules still apply, which is why a fax sent to the wrong number is still a breach. But nobody certified the fax machine. It was simply left outside the definition. An exemption isn't a certification. I'm not a lawyer, and this isn't legal advice. I'm only pointing out that "the law treats fax differently" and "the law says fax is safe" are two very different sentences.
The fax that hacked the network
Then there is the machine itself. In August 2018, at the DEF CON security conference, researchers from Check Point presented an attack they called Exploit. They started from one question: what could an attacker do with nothing more than a phone line and a fax number? They sent a specially crafted color fax to an office all-in-one printer, took control of it, and from there reached a computer on the same network. The printer maker had already released a fix, but the lesson outlasts any single fix. The fax line was supposed to be the old, separate, boring part of the office. It turned out to be a door into the network, open to anyone who knew the number. Every multifunction printer in our environment came with a built-in fax connector. I refuse to connect them. It's the simplest security control I have: a door I never install can't be left open.
Most faxes aren't faxes anymore
Many faxes now arrive as a PDF in an inbox, after passing through someone else's servers. That is what our clinic uses today. Electronic fax is better than the machine in the hallway: no paper tray, no jam, and no patient records left where anyone walking past can read them. But I have to be clear about what it is. It is a digital document that still has to travel as a fax, because many of the offices we work with accept nothing else.
Not just the clinic
Fax isn't only a healthcare habit. Under the federal prior authorization rule finalized in January 2024, according to the Centers for Medicare & Medicaid Services, insurers can still send decisions by fax, and the required electronic interfaces don't have to be in place until January 1, 2027. And the Washington State Auditor's Office, in its guidance on wire transfers, lists fax both as a way to send wire instructions to a bank and as one of the channels criminals use to impersonate vendors and managers.
The fax is not on the safe list. It is on the list of disguises.
The other side
I want to be understanding to the people who keep the fax, because some of their reasons are real. Nearly every clinic, pharmacy, lab, and insurance office has a fax number. Not all of them can receive secure email from outside, and the electronic systems that were supposed to replace fax often can't talk to each other. A fax needs no account, no password, and no training. When a pharmacy needs a prescription confirmed and the only door it will open is a fax number, a clinic that refuses to fax is a clinic whose patients wait.
There is one argument I don't accept: fax still works when everything else fails. If the internet goes down, the electronic health record is offline. The phones are offline because they run over the internet. Nobody can sign in, because sign-in runs through a cloud service. You can't pull up a patient's chart to fax it. If the internet is down and the fax machine still works, who cares? We have much larger problems.
Quantum computers and a fax machine
In August 2024, the National Institute of Standards and Technology released its first finalized post-quantum encryption standards, noting that some experts expect a quantum computer able to break today's encryption within a decade. We are racing to protect encryption from a computer that doesn't exist yet, while patient records move every day on a channel with no encryption at all. Nobody needs a quantum computer to read a fax. A tap on the line will do. So will one wrong digit. We prepare for the risks in the headlines while living with the risks in the hallway.
The most dangerous phrase
Psychologists have names for why the hallway risk gets no attention. Robert Zajonc's research in the 1960s showed that people like things more simply because they have seen them before: the mere-exposure effect. In 1988, William Samuelson and Richard Zeckhauser described status quo bias: people stick with whatever is already in place. Put those together, and you have the fax machine.
Grace Hopper, the computing pioneer and US Navy rear admiral, put it more simply. In a 1976 interview with Computerworld, traced by Quote Investigator, she said the most dangerous phrase a data processing manager can use is "We've always done it that way." She wasn't talking about everyone. She was talking about people in IT. People like me. That phrase is dangerous for an IT Director in particular, because we are the ones people trust to tell them when something old has become a risk. If we say "we've always done it that way," nobody else in the building will say anything different. In December 2018, England's Health Secretary banned the National Health Service from buying fax machines and ordered more than 8,000 still in use phased out by March 31, 2020, with quarterly checks until each organization declared itself fax-free.
What to ask
This isn't really an article about fax machines. Fax is just the clearest example I know of something every organization has: a tool, a process, or a habit that survives only because it's familiar. For tribal leaders and IT leaders: pick one thing in your organization that people defend with "we've always done it that way." Ask what it protects. Not how it feels. What it actually protects. If the answer is familiarity, you've found your fax machine. The machine will still print "transmission OK." It always does. That was never the question.
Older than the telephone
The fax machine is older than most people think. Alexander Bain, a Scottish clockmaker, received British patent number 9745 on May 27, 1843, for what he called an "Electric Printing Telegraph." It was the first fax machine, built from two pendulums kept in step at each end of a telegraph wire. Alexander Graham Bell received his telephone patent on March 7, 1876. By then, Bain's fax was thirty-three years old. Fax was designed for a world where the only people who could reach the wire were the people at each end of it. That world ended a long time ago.
What the confirmation sheet says
A traditional fax protects very little. It travels over the phone network as an open signal, without encryption. The confirmation sheet, the one that says "transmission OK," proves only that a machine at that number answered. It doesn't tell you whose machine it was, who picked up the paper, or whether the paper sat in a shared tray in a busy hallway for three hours. And a fax can't be recalled. If one digit is wrong, the document goes to whoever owns that number. That isn't a theoretical risk. In 2017, as reported by the HIV news outlet POZ, a hospital in New York City paid a settlement of about $387,000 to the US Department of Health and Human Services after a patient's HIV status and other sensitive health information were faxed to his employer instead of being mailed to the post office box he had asked for. No hacker was involved. Somebody used the fax machine the way it is designed to be used, to the wrong place.
The rule that looked away
Many people in healthcare believe the law prefers fax. Here is why. The HIPAA Security Rule sets requirements for protecting health information in electronic form. When the federal regulations define electronic media, they include a sentence that has shaped healthcare for more than twenty years: certain transmissions, "including of paper, via facsimile," are not considered electronic if the information didn't exist in electronic form immediately before it was sent.
That sentence doesn't say paper fax is secure. It says paper fax is not electronic, so the rules written for electronic information don't reach it. The privacy rules still apply, which is why a fax sent to the wrong number is still a breach. But nobody certified the fax machine. It was simply left outside the definition. An exemption isn't a certification. I'm not a lawyer, and this isn't legal advice. I'm only pointing out that "the law treats fax differently" and "the law says fax is safe" are two very different sentences.
The fax that hacked the network
Then there is the machine itself. In August 2018, at the DEF CON security conference, researchers from Check Point presented an attack they called Exploit. They started from one question: what could an attacker do with nothing more than a phone line and a fax number? They sent a specially crafted color fax to an office all-in-one printer, took control of it, and from there reached a computer on the same network. The printer maker had already released a fix, but the lesson outlasts any single fix. The fax line was supposed to be the old, separate, boring part of the office. It turned out to be a door into the network, open to anyone who knew the number. Every multifunction printer in our environment came with a built-in fax connector. I refuse to connect them. It's the simplest security control I have: a door I never install can't be left open.
Most faxes aren't faxes anymore
Many faxes now arrive as a PDF in an inbox, after passing through someone else's servers. That is what our clinic uses today. Electronic fax is better than the machine in the hallway: no paper tray, no jam, and no patient records left where anyone walking past can read them. But I have to be clear about what it is. It is a digital document that still has to travel as a fax, because many of the offices we work with accept nothing else.
Not just the clinic
Fax isn't only a healthcare habit. Under the federal prior authorization rule finalized in January 2024, according to the Centers for Medicare & Medicaid Services, insurers can still send decisions by fax, and the required electronic interfaces don't have to be in place until January 1, 2027. And the Washington State Auditor's Office, in its guidance on wire transfers, lists fax both as a way to send wire instructions to a bank and as one of the channels criminals use to impersonate vendors and managers.
The fax is not on the safe list. It is on the list of disguises.
The other side
I want to be understanding to the people who keep the fax, because some of their reasons are real. Nearly every clinic, pharmacy, lab, and insurance office has a fax number. Not all of them can receive secure email from outside, and the electronic systems that were supposed to replace fax often can't talk to each other. A fax needs no account, no password, and no training. When a pharmacy needs a prescription confirmed and the only door it will open is a fax number, a clinic that refuses to fax is a clinic whose patients wait.
There is one argument I don't accept: fax still works when everything else fails. If the internet goes down, the electronic health record is offline. The phones are offline because they run over the internet. Nobody can sign in, because sign-in runs through a cloud service. You can't pull up a patient's chart to fax it. If the internet is down and the fax machine still works, who cares? We have much larger problems.
Quantum computers and a fax machine
In August 2024, the National Institute of Standards and Technology released its first finalized post-quantum encryption standards, noting that some experts expect a quantum computer able to break today's encryption within a decade. We are racing to protect encryption from a computer that doesn't exist yet, while patient records move every day on a channel with no encryption at all. Nobody needs a quantum computer to read a fax. A tap on the line will do. So will one wrong digit. We prepare for the risks in the headlines while living with the risks in the hallway.
The most dangerous phrase
Psychologists have names for why the hallway risk gets no attention. Robert Zajonc's research in the 1960s showed that people like things more simply because they have seen them before: the mere-exposure effect. In 1988, William Samuelson and Richard Zeckhauser described status quo bias: people stick with whatever is already in place. Put those together, and you have the fax machine.
Grace Hopper, the computing pioneer and US Navy rear admiral, put it more simply. In a 1976 interview with Computerworld, traced by Quote Investigator, she said the most dangerous phrase a data processing manager can use is "We've always done it that way." She wasn't talking about everyone. She was talking about people in IT. People like me. That phrase is dangerous for an IT Director in particular, because we are the ones people trust to tell them when something old has become a risk. If we say "we've always done it that way," nobody else in the building will say anything different. In December 2018, England's Health Secretary banned the National Health Service from buying fax machines and ordered more than 8,000 still in use phased out by March 31, 2020, with quarterly checks until each organization declared itself fax-free.
What to ask
This isn't really an article about fax machines. Fax is just the clearest example I know of something every organization has: a tool, a process, or a habit that survives only because it's familiar. For tribal leaders and IT leaders: pick one thing in your organization that people defend with "we've always done it that way." Ask what it protects. Not how it feels. What it actually protects. If the answer is familiarity, you've found your fax machine. The machine will still print "transmission OK." It always does. That was never the question.