A fax went to the wrong number
What to do in the first hour, how to decide whether it is a reportable breach, and how to stop it happening again.
When a fax reaches the wrong number, call the recipient at once, ask them to destroy the pages and confirm in writing. If the document held personal information, assess the risk: under PIPEDA, a breach creating a real risk of significant harm must be reported to the Privacy Commissioner of Canada, and provincial laws add their own rules.
Four things to know
Time works against you: every hour lost leaves the document longer in someone else’s hands.
Personal information that lands with the wrong recipient counts as a privacy breach, even if nobody has read the pages yet.
Under PIPEDA, every breach of security safeguards must be recorded and the record kept for 24 months, whether or not it is reported.
Prevention takes a few habits: a checked number, typed twice, reread during the cancellation window.
In the first hour: contain it
Start by identifying the number that was actually dialled. With FaxTelecom it appears on the tracking page of the fax and, if you chose the option, on the PDF transmission receipt. On a fax machine, check the transmission report or the activity log.
Then call that number. Many fax lines belong to a business or a clinic that can be reached by phone, and their details often appear in a business directory. Explain that a confidential document reached them by mistake, without describing what it contains, and ask that it be destroyed without being copied or passed on.
Follow up in writing, by email or letter, and ask for a reply confirming the destruction. Even a short answer helps show the risk was reduced. If nobody picks up, log each attempt with its date and time.
Finally, alert your privacy officer or whoever handles privacy in your organization. They will lead the assessment.
Assess: is it a reportable breach?
Under PIPEDA, which covers private-sector organizations in most provinces, a fax holding a client’s name and account details, an employee file or a medical note that is received by an outsider is a breach of security safeguards. An invoice between two companies with no identifiable individual is not.
The test is whether the breach creates a real risk of significant harm, such as humiliation, damage to reputation, financial loss or identity theft. Look at how sensitive the information is and how likely it is to be misused: who received it, whether they confirmed destruction, how many people are affected. If the test is met, report to the Office of the Privacy Commissioner of Canada and notify the individuals as soon as feasible.
Health information custodians follow their provincial statute instead. In Ontario, PHIPA requires custodians to notify the individual at the first reasonable opportunity and, in prescribed cases, the Information and Privacy Commissioner. Alberta’s HIA and PIPA, and British Columbia’s PIPA, set their own thresholds. Check your commissioner’s website for the forms and criteria.
These steps belong to the organization that decided to send the fax. A transmission service such as FaxTelecom delivers the document to the number entered: it does not know what the content is and cannot recall a fax once delivered.
What your breach record should contain
PIPEDA’s breach regulations require a record of every breach of security safeguards, reported or not, kept for 24 months. Provincial laws have similar expectations. A simple form is enough if it covers these headings.
| Heading | Example for a misdirected fax | Why it matters |
|---|---|---|
| What happened | Three-page discharge summary sent on a Tuesday morning to a number with two digits swapped | Reconstructs the incident without relying on memory |
| Information and people affected | One patient: name, date of birth, diagnosis | Measures how serious it is |
| Discovery | Call from the intended recipient an hour later saying nothing arrived | Shows when the organization became aware |
| Actions taken | Call to the unintended recipient, destruction confirmed by email | Shows the risk was contained |
| Decision and reasons | Reported to the commissioner or not, with the reasoning | Supports the decision if questioned later |
| Corrective measures | Stored number fixed, double entry introduced | Prevents a repeat |
Stop it from happening again
Most mistakes come from two swapped digits, a number taken from an outdated source or a speed-dial key nobody has updated in years. The fixes are simple and cost almost nothing.
Check the format before sending. The FaxTelecom number checker flags a country code entered twice, a number of the wrong length or a mobile number, which no fax can reach. It cannot tell you who owns the line: only a reliable source can.
Type sensitive numbers twice, or ask a colleague to read them back before a delicate send. For regular correspondents, keep a dated list of verified numbers and review it on a fixed schedule.
Use the delays you are given. At FaxTelecom, transmission starts only after you click the link in the confirmation email, followed by a countdown of about 55 seconds during which you can cancel. Rereading the number then takes seconds; fixing the mistake afterwards takes far longer.
Frequently asked questions
- Does the unintended recipient have to destroy the document?
- They usually have no contract with you, but most businesses and clinics agree readily. A polite request, confirmed in writing, and a reply confirming destruction are your best evidence that the risk was reduced.
- Do I always have to report a misdirected fax?
- No. Under PIPEDA, reporting is required only when there is a real risk of significant harm. The internal record is required in every case, along with the reason you did or did not report.
- Can FaxTelecom cancel a fax that has already gone through?
- No. Once the pages reach the recipient’s machine, no service can take them back. You can still cancel during the countdown of about 55 seconds before transmission starts.
Security and data
In this section
Where to go next
Hand-picked pages to help you prepare, send or prove your fax.
Recent guides
Blog articles on the same subject.