Medical documents and fax
Belgium: the points to check before sending a medical document, and the situations that call for a secure channel.
In Belgium, faxing a medical document remains lawful, subject to Article 9 of the GDPR: health data are among the most closely protected categories. Between care providers, the expected route is eHealthBox. Fax is justified when the recipient offers nothing else: check the number, limit the content, and warn the person who will collect the pages in advance.
Four points to remember
Medical information falls under 'special categories': transmitting it requires safeguards commensurate with the risk.
Doctors, hospitals, pharmacists, health insurers: the eHealth platform and its secure eHealthBox messaging service are preferable to fax for their exchanges.
A misdirected fax prints in plain sight at a complete stranger's premises: nothing matters as much as verifying the number.
Faxeroo secures the transfer of your PDF to its servers, then erases the file; the final leg, over the telephone network, remains unencrypted.
Where fax still holds its own in healthcare
Faxes have not completely vanished from every clinic or hospital ward. They are still used for an imaging request, a report addressed to a physiotherapist with limited equipment, a certificate for a service that lists only a fax number, or a document a patient must personally forward.
The patient, in fact, is often the one sending: eHealthBox is closed to them, reserved for identified providers and institutions, whereas a fax goes straight to a secretary's office. It is the patient who decides to transmit their own data; their vigilance centres on the accuracy of the number.
Among professionals, usage is declining as medical software increasingly connects to eHealth; the fax machine survives as a fallback or for correspondents still off the network.
What the regulations require
The GDPR prohibits health data processing by default (Article 9), then carves out exceptions — notably medical care provided by a healthcare professional bound by secrecy. The Belgian law of 30 July 2018 complements this framework on the protection of individuals, and Article 458 of the Criminal Code maintains healthcare professionals' duty of confidentiality.
None of these texts mentions fax by name; they require technical and organisational measures proportionate to the risk (Article 32 of the GDPR). A document disclosing a diagnosis, treatment or hospital stay sets the bar very high: an unencrypted channel whose delivery cannot be controlled is only occasionally defensible — and only with extensive safeguards.
For further guidance, the Data Protection Authority publishes its recommendations on its website; your professional regulatory body and the eHealth portal add their own instructions.
Fax or secure messaging: comparing protections
Each row explains how a channel works; no legal ranking is implied. Choose based on what the message contains, who receives it, and the guidance from your professional regulator.
| Transmission channel | Protection provided | Limitation | Recommended use |
|---|---|---|---|
| eHealthBox (eHealth platform) | Encrypted messaging, sender and recipient identified | Restricted to registered healthcare providers and organisations only | Routine correspondence between healthcare professionals |
| Regional health networks (Réseau Santé Bruxellois, Réseau Santé Wallon) | Access to documents conditional on patient consent and a therapeutic relationship | Transferring a single document to an arbitrary recipient: out of scope | Healthcare professionals' access to reports and results |
| Traditional fax machine | No protection online: everything depends on the number dialed | Pages printed on arrival, in full view of anyone passing by | Occasional use, recipient notified, content kept minimal |
| Internet fax (Faxeroo) | HTTPS transfer to servers, file deletion after sending | Last telephone leg unencrypted, as with any fax | Occasional sending without a machine, for patients or practices |
Five checks before sending medical information
Confirm the number by checking a recent document from the recipient or requesting their verbal confirmation. A fax number from an outdated document may have been reassigned, and a single transposed digit can divert a report to an unauthorized third party.
Verify where the machine is located. A polyclinic's front desk fax is not identical to the one in a doctor's private office. If the device is shared, agree on a sending time so that someone can pick up the pages without delay.
Mark the confidentiality notice on the transmission report. It states who the pages are intended for, how many there are, and the number to call back, along with an instruction: notify the sender, then destroy any pages received by mistake. The report itself contains no medical data.
Send only what is essential. The relevant page of the protocol rather than the entire file; no full national registry number, no irrelevant medical history, no data on other family members.
Confirm receipt. A quick follow-up call or message verifies that the pages arrived with the intended recipient — and warns you fast if they did not.
What Faxeroo does — and does not do
Faxeroo sends a PDF from a browser to a Belgian landline, or to six other countries, without opening an account. The file uploads to our servers over HTTPS, is used solely for transmission, then disappears automatically. No advertising is inserted into your pages.
Our servers transmit the document to the recipient's fax machine using the same telephone line as any other fax. The last segment is unencrypted, a protocol limitation we cannot resolve through settings. Also, Faxeroo does not accept incoming faxes, so avoid using it to collect results or prescriptions.
Two checkpoints leave time to fix a mistake before sending: email validation first, followed by roughly 55 seconds in which you can still cancel. Use that pause to recheck the number. For routine exchanges between healthcare professionals, eHealthBox is still the preferred option.
Frequently asked questions
- Patient: can I send my records to the hospital by fax?
- Yes. The records remain yours: fax stays an option if the department approves it. Have them confirm their number and attach a cover sheet with your contact information, so they can return your call if anything is missing.
- Sending medical data by fax: is it prohibited in Belgium?
- Neither Belgian nor European law prohibits it by name. However, the GDPR requires security proportionate to the risk, which makes fax questionable as an everyday channel. Up-to-date recommendations can be found on the Data Protection Authority's website.
- Medical document sent to an incorrect number: what to do?
- Contact the recipient immediately to have the pages destroyed, document the incident, and determine whether it requires notification to the DPA within 72 hours. Our page on misdirected faxes outlines the steps to follow.
Data and security
This topic
- A fax, from screen to paper: security
- What to handle within an hour, how to categorize the unauthorized data disclosure, and how to keep it from recurring.
- Fill in a few fields, download the PDF, and put it on the first page of your send.
- Faxing pages that identify real people, without falling foul of EU data protection rules.
Keep reading
Pages chosen to help you prepare a send, track it, or keep proof of it.