HIPAA Print and Scan Compliance: A Practical Checklist

Despite the shift to electronic health records, printers and scanners remain a vital and vulnerable part of every healthcare environment. Patient charts, prescriptions, referrals, insurance authorizations and billing statements are still printed every day, while intake forms, referral letters and insurance cards are scanned into clinical systems. Yet many organizations lack adequate safeguards for how that protected health information (PHI) is printed, scanned, handled and disposed of.

The scale of the problem is clear in official figures. Of the 74,299 smaller healthcare breaches (affecting fewer than 500 people) reported to the US Department of Health and Human Services in 2024, 44,304 involved paper records: 60% of the total, and more than any other location, according to HHS's annual report to Congress. Many of those breaches stem not from sophisticated cyberattacks but from gaps in everyday operations, including printing and scanning.

This guide sets out what HIPAA expects for printed and scanned PHI and provides a practical checklist to assess your organization's risk.

What does HIPAA require for printing and scanning?

HIPAA does not use the words "printer" or "scanner," but it governs PHI in any medium, including paper. All three core rules apply:

• Privacy Rule: protects all forms of PHI, including printed and scanned documents.
• Security Rule: requires administrative, physical and technical safeguards for electronic PHI, which covers print jobs as they travel from clinical systems to the printer, scanned documents as they travel to their destination, and any data stored on the device.
• Breach Notification Rule: requires notification of any breach of unsecured PHI, including paper records.

A document left on a printer tray, collected by the wrong person or thrown away without shredding can lead to regulatory penalties and, more importantly, the exposure of sensitive patient information.

Scanning raises the stakes further. Once a paper document is scanned, it becomes electronic PHI, and the Security Rule's technical safeguards apply in full. A scan sent to the wrong email address or saved to an open network folder can expose PHI instantly, and to far more people than a single misplaced page.

HIPAA print and scan compliance checklist

Use this checklist to assess whether your print and scan workflows meet HIPAA expectations:

These controls also reflect the guidance in NIST SP 800-66 Rev. 2, the National Institute of Standards and Technology's guide to implementing the HIPAA Security Rule, and the HHS Security Risk Assessment Tool.

Common mistakes that lead to HIPAA violations

Even well-meaning teams can fall short. Common examples include:

• Unattended printouts left in shared areas.
• Auto-released jobs that print without authentication.
• Misdirected mail and faxes, a recurring cause of the smaller breaches reported to HHS.
• Scanning to the wrong place, such as personal email accounts, unrestricted email addresses or open network folders.
• Recycling PHI instead of shredding it.
• Shared logins used to access print queues or scan functions.
• Returning leased devices without wiping their internal storage.
• No audit trail available during a compliance review or breach investigation.

These issues have real consequences:

• Affinity Health Plan paid more than $1.2 million in 2013 after returning leased photocopiers without erasing the PHI stored on their hard drives.
• Cornell Prescription Pharmacy paid $125,000 in 2015 after unshredded documents containing the PHI of 1,610 patients were found in an open dumpster.

Penalties are significant. Under the current schedule, which took effect in January 2026, civil penalties start at $145 per violation and can reach $2,190,294 per year for each provision violated. More examples are available in the HHS enforcement case examples.

What's changing

In January 2025, HHS proposed the first major update to the HIPAA Security Rule in over a decade. The proposal would make multi-factor authentication and encryption mandatory and require organizations to keep an inventory of the technology assets that handle electronic PHI. Networked printers, scanners and multifunction devices would fall within that inventory.

HHS now expects final action no earlier than July 2027, and the current Security Rule remains in force. Providers that authenticate users at every device and encrypt print and scan data today will be well prepared whatever the final rule requires.

How secure print and scan management helps

A secure print and scan management solution such as FollowMe automates many of the safeguards HIPAA expects:

• Secure pull printing: documents print only when the authorized user authenticates at the device.
• Secure scanning: users sign in before they scan, and documents are routed to approved destinations rather than to any email address or folder.
• Fast, secure identification: encrypted identity card readers and mobile wallet authentication let clinicians sign in at the device quickly without compromising security.
• Audit logging: every print and scan is tied to a specific user and device.
• Encryption: print jobs are protected in transit and at rest, and scans can be sent to their destination over encrypted connections.
• Data loss prevention: print restriction, archiving and compliance auditing help keep sensitive patient information from leaving through print.
• Policy enforcement: access rules can be applied by role, department or device.
• Print roaming: clinicians can collect jobs at any enabled device, so a single printer fault does not hold up patient care.

FollowMe works with existing identity systems and supports on-premises, cloud and hybrid environments, making it well suited to modern healthcare settings. For a wider view of print security across regulations including GDPR and NIS2, read Managing Printing Proactively: Securing Information and Preventing Data Loss.

Frequently asked questions

Does HIPAA apply to printed documents?

Yes. The Privacy Rule protects PHI in any form, including paper, so printed documents need the same care as electronic records.

Does HIPAA apply to scanned documents?

Yes. Once a paper record is scanned, it becomes electronic PHI. The Security Rule's safeguards, including access controls, audit controls and transmission security, then apply to the scanned file and to wherever it is sent.

Do I need to log every print and scan job?

HIPAA does not name print or scan logs specifically, but the Security Rule requires audit controls for systems that handle electronic PHI. Print and scan logs are the practical way to show who printed or scanned patient information and to investigate an incident if one occurs.

What is the most effective way to make printing and scanning HIPAA compliant?

Require authentication before any job is released or any document is scanned, restrict scans to approved destinations, keep audit logs, encrypt print and scan data, wipe device storage before disposal, shred printed PHI and train staff regularly.

Protecting patient trust

HIPAA compliance is not just a digital issue. Print and scan environments carry unmonitored risk that often hides in plain sight. With a few deliberate safeguards, healthcare organizations can meet their legal obligations and, more importantly, protect the trust patients place in them.

Want help evaluating your print and scan environment? Contact us to learn how FollowMe supports HIPAA compliance.

Key sources: US Department of Health and Human Services, Annual Report to Congress on Breaches of Unsecured Protected Health Information, 2024; US Department of Health and Human Services, HIPAA for Professionals; NIST, SP 800-66 Rev. 2.