Despite the shift to electronic health records, printers and scanners remain a vital and vulnerable part of every healthcare environment. Patient charts, prescriptions, referrals, insurance authorizations and billing statements are still printed every day, while intake forms, referral letters and insurance cards are scanned into clinical systems. Yet many organizations lack adequate safeguards for how that protected health information (PHI) is printed, scanned, handled and disposed of.
The scale of the problem is clear in official figures. Of the 74,299 smaller healthcare breaches (affecting fewer than 500 people) reported to the US Department of Health and Human Services in 2024, 44,304 involved paper records: 60% of the total, and more than any other location, according to HHS's annual report to Congress. Many of those breaches stem not from sophisticated cyberattacks but from gaps in everyday operations, including printing and scanning.
This guide sets out what HIPAA expects for printed and scanned PHI and provides a practical checklist to assess your organization's risk.
HIPAA does not use the words "printer" or "scanner," but it governs PHI in any medium, including paper. All three core rules apply:
A document left on a printer tray, collected by the wrong person or thrown away without shredding can lead to regulatory penalties and, more importantly, the exposure of sensitive patient information.
Scanning raises the stakes further. Once a paper document is scanned, it becomes electronic PHI, and the Security Rule's technical safeguards apply in full. A scan sent to the wrong email address or saved to an open network folder can expose PHI instantly, and to far more people than a single misplaced page.
Use this checklist to assess whether your print and scan workflows meet HIPAA expectations:
| HIPAA safeguard | Print and scan workflow control |
| Access controls | Badge, PIN or single sign-on authentication at the device before any job is released or any document is scanned |
| Audit controls | Logged records of who printed or scanned what, when and where |
| Encryption | Print jobs and scanned documents encrypted in transit and at rest |
| Scan destinations | Scans sent only to approved destinations, such as the electronic health record or document management system, with scan-to-email limited to approved recipients |
| Physical safeguards | Devices placed away from public areas, with lockable trays where needed |
| Device and media controls | Device storage, including stored print and scan data, wiped before a device is returned, moved or disposed of |
| Disposal | Secure bins and shredding, with verified destruction of printed PHI and of paper originals once scanned, where your retention policy allows |
| Training and awareness | Regular staff education on handling printed PHI, scanning to the right destination and using devices securely |
These controls also reflect the guidance in NIST SP 800-66 Rev. 2, the National Institute of Standards and Technology's guide to implementing the HIPAA Security Rule, and the HHS Security Risk Assessment Tool.
Even well-meaning teams can fall short. Common examples include:
These issues have real consequences:
Penalties are significant. Under the current schedule, which took effect in January 2026, civil penalties start at $145 per violation and can reach $2,190,294 per year for each provision violated. More examples are available in the HHS enforcement case examples.
In January 2025, HHS proposed the first major update to the HIPAA Security Rule in over a decade. The proposal would make multi-factor authentication and encryption mandatory and require organizations to keep an inventory of the technology assets that handle electronic PHI. Networked printers, scanners and multifunction devices would fall within that inventory.
HHS now expects final action no earlier than July 2027, and the current Security Rule remains in force. Providers that authenticate users at every device and encrypt print and scan data today will be well prepared whatever the final rule requires.
A secure print and scan management solution such as FollowMe automates many of the safeguards HIPAA expects:
FollowMe works with existing identity systems and supports on-premises, cloud and hybrid environments, making it well suited to modern healthcare settings. For a wider view of print security across regulations including GDPR and NIS2, read Managing Printing Proactively: Securing Information and Preventing Data Loss.
Does HIPAA apply to printed documents?
Yes. The Privacy Rule protects PHI in any form, including paper, so printed documents need the same care as electronic records.
Does HIPAA apply to scanned documents?
Yes. Once a paper record is scanned, it becomes electronic PHI. The Security Rule's safeguards, including access controls, audit controls and transmission security, then apply to the scanned file and to wherever it is sent.
Do I need to log every print and scan job?
HIPAA does not name print or scan logs specifically, but the Security Rule requires audit controls for systems that handle electronic PHI. Print and scan logs are the practical way to show who printed or scanned patient information and to investigate an incident if one occurs.
What is the most effective way to make printing and scanning HIPAA compliant?
Require authentication before any job is released or any document is scanned, restrict scans to approved destinations, keep audit logs, encrypt print and scan data, wipe device storage before disposal, shred printed PHI and train staff regularly.
HIPAA compliance is not just a digital issue. Print and scan environments carry unmonitored risk that often hides in plain sight. With a few deliberate safeguards, healthcare organizations can meet their legal obligations and, more importantly, protect the trust patients place in them.
Want help evaluating your print and scan environment? Contact us to learn how FollowMe supports HIPAA compliance.
Key sources: US Department of Health and Human Services, Annual Report to Congress on Breaches of Unsecured Protected Health Information, 2024; US Department of Health and Human Services, HIPAA for Professionals; NIST, SP 800-66 Rev. 2.