Reporting by fax: alerting the authorities without getting it wrong

Short answer: alerting, reporting or notifying a public authority today goes primarily through online portals — the French Health Ministry's portal for reporting adverse health events, the CNIL's online procedure, the ARS help desks. But several channels still accept fax, and a few still list it as an official route: departmental units for collecting child protection concerns (CRIP), certain public prosecutor's duty desks, inspection units, ARS on-call services outside working hours. In those cases, the rule is simple: a neutral cover sheet, a complete form, a number checked twice, and a transmission report kept with the file.

What "reporting" means, legally

French administrative vocabulary distinguishes three actions that are often confused.

Alerting means giving urgent warning to trigger immediate action: a cluster of infections in a care home, a break in the cold chain for a batch of vaccines, a patient in danger. Speed matters more than form.

Reporting means bringing to an authority's attention a fact that calls for its assessment: a child protection concern, a suspicion of elder abuse, a safety failure. A report commits its author and must be dated, sourced and detailed.

Notifying means fulfilling a legal obligation set out in a statute: notification of a serious adverse event associated with care (EIGS) under Article L.1413-14 of the French Public Health Code, notification of a notifiable disease, or notification of a personal data breach to the CNIL within 72 hours under Article 33 of the GDPR.

These three actions do not carry the same deadlines, the same recipients or the same evidentiary requirements. Fax is only relevant to some of them — but for those, it still matters a great deal.

Why not every alert channel has moved online

The digitisation of reporting has advanced considerably since 2017, the year the single portal signalement.social-sante.gouv.fr opened. Santé publique France, the Haute Autorité de santé and the French National Agency for Medicines Safety have all connected their respective channels to it. For a healthcare professional notifying an EIGS or an adverse drug reaction, this is now the standard route.

Three areas nonetheless hold out.

The first is emergencies outside working hours. A portal requires a username, a password, sometimes a CPS card and a reader. At three in the morning, in a ward where the night nurse must alert the departmental on-call service, the fax number printed on the laminated quick-reference sheet works with no prior authentication. Several ARS still list, in their crisis management guides, an on-call fax number alongside the telephone number.

The second is decentralised departmental jurisdiction. CRIPs report to the departmental councils, not to the State. There are around a hundred of them, each with its own organisation. Some have an online form; others publish a postal address, an email address and a fax number. A school doctor or a senior nurse who has to pass on a child protection concern uses the channel indicated by their department — not the one they would prefer.

The third is the judicial route. Reporting to the public prosecutor, provided for by Article 40 of the French Code of Criminal Procedure for all civil servants, and by Article 226-14 of the Criminal Code for professionals bound by confidentiality, is done in writing. Prosecutors' duty desks receive faxes daily: the time-stamped transmission report serves as proof of the filing date, which matters when the speed of response may later be called into question.

An email proves that a message left a server. A fax report proves that an identified fax machine picked up, accepted the document and confirmed receipt page by page. In a procedure where you will be asked "when did you raise the alarm?", that distinction carries weight.

Before sending: the six checks

A misdirected report is not merely ineffective, it is potentially a breach in itself — it may amount to disclosing confidential information to an unauthorised third party. This six-point check takes two minutes.

The point most often overlooked is the first. Genuine overlaps exist: abuse in a medico-social establishment may fall simultaneously within the remit of the ARS, the departmental council and the public prosecutor. The answer is not to choose, but to send to the right level and to state explicitly in the body of the report which other authorities are also being notified. This mention avoids duplicated proceedings and protects the author of the report.

The cover sheet of a report

A fax comes out into a paper tray, often in a shared room. The cover sheet is the only part everyone sees. It must be informative for the receiving service and opaque to a passer-by.

What it contains:

• the generic subject: "Report — Article 40 CPP" or "Child protection concern" or "EIGS notification", with no details;
• the named recipient service, with the wording CONFIDENTIAL — TO BE DELIVERED IN PERSON;
• the identity and professional capacity of the sender, with their RPPS or ADELI number where applicable;
• a direct call-back number;
• the total number of pages, cover sheet included;
• the date and time of sending.

What it never contains: the name of the person concerned, their date of birth, a diagnosis, a criminal classification, or a summary of the facts. Those elements belong on page 2 onwards. The CNIL regularly points out, in its recommendations on the processing of health data, that data minimisation also applies to how transmitted documents are laid out — not just to their content.

Drafting the body of the report

Three principles, borrowed from the Haute Autorité de santé's guidance on EIGS notification and from the templates circulated by the CRIPs.

Separate facts from interpretations. Write "the child has a 4 cm bruise on the outer side of the left arm, observed on 24 August at 2 p.m." rather than "the child has clearly been hit." The author's role is to describe; the authority's role is to assess.

Date and source every element. Who observed what, when, and in what circumstances. If the information was reported by a third party, say so: "according to statements by the mother, taken on…".

State what has already been done. Precautionary measures taken, people informed, care provided. An authority receiving a report must know immediately whether the situation is stable or calls for intervention within the hour.

One dense page is worth more than four diluted ones. Fax rasterises in black and white at 204 × 196 dots per inch: text at 11 or 12 point comes through very well, fine handwriting or an overloaded table far less so.

The transmission report, part of the file

This is the point internal procedures most often forget. The transmission report is not a read receipt: it certifies that a fax machine bearing a given identifier answered a given number, at a given time, and accepted a given number of pages. That is enough to establish a definite date of sending.

Three retention rules:

1. File the report with the copy of the report itself, in the case file for the event — not in a separate "fax" binder that will be lost at the next office move.
2. Keep the full time stamp, not just the date: in emergency procedures, the time is the useful piece of information.
3. Never attach the content of the report to the transmission report circulated internally: the transmission report may circulate for quality monitoring, the content may not.

If the fax goes through an online gateway, the confirmation arrives by email. It is then worth generating a time-stamped PDF of it and adding it to the file, rather than leaving the evidence sitting in a personal inbox that will vanish when the staff member leaves. Our FAQ sets out exactly what a transmission confirmation contains and how long it remains available, and the available countries page specifies the numbering formats to use outside France.

The special case of a data breach

Since the GDPR came into force, every data controller must notify the CNIL, within 72 hours, of any personal data breach likely to create a risk to individuals. That channel, however, is exclusively digital: the CNIL requires its online procedure and does not process notifications received by fax.

This is a point to watch for practices and establishments used to "faxing urgent matters": a misdirected fax — sent to the wrong number, containing a named report — is precisely a data breach within the meaning of Article 4(12) of the GDPR. You must then document the incident in the breach register, call the unintended recipient immediately to request destruction of the document, and notify the CNIL online if the risk warrants it. Here, fax is the cause of the incident, never the channel for reporting it.

What fax does not replace

It has to be said plainly: fax is a filing channel, not a channel for dialogue.

• It does not replace a phone call when there is immediate danger. An urgent report is always accompanied by a telephone call to the receiving service; the fax formalises what was said.
• It does not replace secure health messaging between professionals connected to MSSanté, operated by the Agence du numérique en santé. As soon as both ends are on it, that is the reference channel.
• It does not replace regulatory portals where a statute requires them: EIGS reporting, pharmacovigilance, CNIL notification.
• It does not amount to filing a criminal complaint. A report to the prosecutor under Article 40 is not a complaint; the victim or their representative retains their own avenues of redress.

Frequently asked questions

Does a report sent by fax carry the same weight as registered mail?

They are not the same kind of evidence. Registered mail with acknowledgement of receipt proves delivery to an identified recipient. The transmission report proves that a machine accepted the document at a precise time. In practice, administrative and judicial authorities accept both; for a report where the date of dispatch is critical, many professionals send the fax immediately and confirm by post the same day.

May I include a patient's name in a report sent by fax?

Yes, from page 2 onwards, if identification is necessary for the report to be handled — and it almost always is. The prohibition applies to the cover sheet, which remains visible in the output tray. This is data minimisation applied to layout, not a ban on identifying the person concerned.

What should I do if the report shows a transmission failure?

Do not treat the report as filed. Check the number on the authority's official website, try again, and failing that switch to another channel — a phone call, an institutional email address, physical delivery. Keep the failure report: it proves the attempt and its date, which may matter if the reporting deadline is later examined.

Must the person concerned be told that a report has been filed about them?

The rule varies with the framework. For a child protection concern, Article L.226-2-1 of the French Social Action and Families Code provides for informing the parents, unless doing so would be contrary to the child's interests. For a report to the prosecutor, no prior information is required and it may jeopardise the investigation. When in doubt, the departmental council or the prosecutor's office will answer the question over the phone.

How long should a copy of a report be kept?

It follows the retention period of the file it belongs to: medical file, social services file, HR file. It has no regime of its own. What must be logged separately is the existence of the transmission — date, recipient, author — in the organisation's register or tracking table.

In summary

• Alerting, reporting and notifying are not the same: deadlines, recipients and formats differ.
• Online portals are the standard route for EIGS, pharmacovigilance and CNIL notifications; the CNIL does not accept fax.
• Fax remains useful for out-of-hours on-call services, departmental CRIPs and prosecutors' duty desks.
• The cover sheet is neutral: generic subject, confidentiality wording, no sensitive data.
• The body of the report separates facts from interpretations, dates each element and states what has already been done.
• The transmission report is filed with the case file, time stamp included.
• An urgent fax is always backed up by a phone call to the receiving service.
• A misdirected fax is a data breach and must be handled as one.