Medical documents and fax
Belgium: the points to check before sending a medical document, and the situations that call for a secure channel.
In Belgium, faxing a medical document remains lawful, subject to Article 9 of the GDPR: health data are among the most closely protected categories. Between care providers, the expected route is eHealthBox. Fax is justified when the recipient offers nothing else: check the number, limit the content, and warn the person who will collect the pages in advance.
Four points to remember
Medical information falls under 'special categories': transmitting it requires safeguards commensurate with the risk.
Doctors, hospitals, pharmacists, health insurers: the eHealth platform and its secure eHealthBox messaging service are preferable to fax for their exchanges.
A misdirected fax prints in plain sight at a complete stranger's premises: nothing matters as much as verifying the number.
Faxeroo secures the transfer of your PDF to its servers, then erases the file; the final leg, over the telephone network, remains unencrypted.
Where fax still holds its own in healthcare
The fax machine has not disappeared from every practice or hospital department. It still serves for an imaging request, a report sent to a physiotherapist with little equipment, a certificate for a service that publishes only a fax number, or a document the patient must forward personally.
The patient, in fact, is often the one sending: eHealthBox is closed to them, reserved for identified providers and institutions, whereas a fax goes straight to a secretary's office. It is the patient who decides to transmit their own data; their vigilance centres on the accuracy of the number.
Among professionals, usage is declining as medical software increasingly connects to eHealth; the fax machine survives as a fallback or for correspondents still off the network.
What the regulations require
The GDPR prohibits health data processing by default (Article 9), then carves out exceptions — notably medical care provided by a healthcare professional bound by secrecy. The Belgian law of 30 July 2018 complements this framework on the protection of individuals, and Article 458 of the Criminal Code maintains healthcare professionals' duty of confidentiality.
None of these texts mentions fax by name; they require technical and organisational measures proportionate to the risk (Article 32 of the GDPR). A document disclosing a diagnosis, treatment or hospital stay sets the bar very high: an unencrypted channel whose delivery cannot be controlled is only occasionally defensible — and only with extensive safeguards.
For further guidance, the Data Protection Authority publishes its recommendations on its website; your professional regulatory body and the eHealth portal add their own instructions.
Fax or secure messaging: comparing protections
Each row explains how a channel works; no legal ranking is implied. Choose based on what the message contains, who receives it, and the guidance from your professional regulator.
| Transmission channel | Protection provided | Limitation | Recommended use |
|---|---|---|---|
| eHealthBox (eHealth platform) | Encrypted messaging, sender and recipient identified | Restricted to registered healthcare providers and organisations only | Routine correspondence between healthcare professionals |
| Regional health networks (Réseau Santé Bruxellois, Réseau Santé Wallon) | Access to documents conditional on patient consent and a therapeutic relationship | Transferring a single document to an arbitrary recipient: out of scope | Healthcare professionals' access to reports and results |
| Traditional fax machine | No protection online: everything depends on the number dialed | Pages printed on arrival, in full view of anyone passing by | Occasional use, recipient notified, content kept minimal |
| Internet fax (Faxeroo) | HTTPS transfer to servers, file deletion after sending | Last telephone leg unencrypted, as with any fax | Occasional sending without a machine, for patients or practices |
Five checks before sending medical information
Check the number. Take it from a current document the recipient has issued, or ask them to confirm it verbally. A number taken from a fax received years ago may have changed ownership; one transposed digit can send a report to a third party.
Check the machine's location. A polyclinic's reception fax machine is not the same as the one in a doctor's private office. If the location is shared, schedule a sending time so that someone can collect the pages promptly.
Mark the confidentiality notice on the transmission report. It states who the pages are intended for, how many there are, and the number to call back, along with an instruction: notify the sender, then destroy any pages received by mistake. The report itself contains no medical data.
Send only what is essential. The relevant page of the protocol rather than the entire file; no full national registry number, no irrelevant medical history, no data on other family members.
Confirm receipt. A quick follow-up call or message verifies that the pages arrived with the intended recipient — and warns you fast if they did not.
What Faxeroo does — and does not do
Faxeroo sends a PDF from a browser to a Belgian landline, or to six other countries, without opening an account. The file uploads to our servers over HTTPS, is used solely for transmission, then disappears automatically. No advertising is inserted into your pages.
Our servers pass the document to the recipient's fax machine over the same telephone route used for any other fax. The final leg is unencrypted: this is a protocol limitation we cannot overcome with any setting. Also, Faxeroo does not receive faxes, so do not use it to gather results or prescriptions.
Two checkpoints leave time to fix a mistake before sending: email validation first, followed by roughly 55 seconds in which you can still cancel. Use that pause to recheck the number. For routine exchanges between healthcare professionals, eHealthBox is still the preferred option.
Frequently asked questions
- Patient: can I send my records to the hospital by fax?
- Yes. The records are yours: fax remains an option if the department accepts it. Have them confirm their number and include a cover sheet with your contact details, so they can call you back if anything is missing.
- Sending medical data by fax: is it prohibited in Belgium?
- Neither Belgian nor European law prohibits it by name. However, the GDPR requires security proportionate to the risk, which makes fax questionable as an everyday channel. Up-to-date recommendations can be found on the Data Protection Authority's website.
- Medical document sent to an incorrect number: what to do?
- Contact the recipient immediately to have the pages destroyed, document the incident, and determine whether it requires notification to the DPA within 72 hours. Our page on misdirected faxes outlines the steps to follow.
Data and security
This topic
- A fax, from screen to paper: security
- What to do within the hour, how to classify the data breach, and how to prevent it from happening again.
- Fill in a few fields, download the PDF, and put it on the first page of your send.
- Sending a fax containing personal data without breaching European regulations.
Keep reading
Pages chosen to help you prepare a send, track it, or keep proof of it.