Under HIPAA, which statement about faxing, voicemails, and related technologies is accurate?

• A. Faxing and voicemails are electronic media under HIPAA.
• B. VOIP is never considered electronic media.
• C. Faxing and voicemails are generally not electronic media, but voicemail transcription apps may require BAAs; VOIP may be electronic media.
• D. Faxing and voicemails are generally not electronic media, but voicemail transcription apps may require BAAs; VOIP may be electronic media.

Answer: (D)

HIPAA distinguishes electronic media—the means used to store or transmit electronic protected health information (ePHI)—from other ways PHI can be handled. How a communication method is classified shifts what safeguards apply and when a Business Associate Agreement is needed.

Faxing and voicemails are generally not treated as electronic media in this context, so they don’t automatically trigger the same electronic-media safeguards. When you add a voicemail transcription app, you’re sending PHI to a third-party service, which often means a Business Associate Agreement is required to protect that data as it’s handled by an external vendor. Voice over IP, on the other hand, is a digital, network-based way of transmitting voice and often storing ePHI, so it can be considered electronic media. That combination—faxing and voicemails not typically electronic media, voicemail transcription apps needing BAAs, and VOIP potentially qualifying as electronic media—captures the nuanced HIPAA treatment.