A confidential cover sheet is a single page placed on top of sensitive documents before you send them by fax, mail, or interoffice delivery, warning anyone who handles the package that the contents are private and identifying the intended recipient. The routing information helps the documents reach the right person; the confidentiality notice does the legal work. What that notice should say depends on whether you’re sending medical records, legal materials, or government information.
Fields Every Cover Sheet Should Include
Whatever industry you’re in, the same practical fields make a cover sheet usable and create a paper trail if something goes wrong.
- Sender information. Your full name, organization, phone number, and fax number or email address.
- Recipient information. The intended recipient’s full name, organization, phone number, and fax number or email address.
- Date and time. Fax machines print this automatically; handwritten or typed entries work for mailed documents.
- Page count. The total number of pages including the cover sheet itself, for example “Page 1 of 6,” so the recipient can confirm nothing was lost.
- Subject or reference line. A brief description of the enclosed documents, written carefully so it doesn’t expose the confidential content to anyone glancing at the cover page.
- Confidentiality notice. A statement that the contents are confidential and that unintended recipients should contact the sender and destroy or return the documents.
Everything except the confidentiality notice is routing. The notice is the piece that changes depending on what you’re sending.
Confidentiality Language for Medical Records
When a healthcare provider, insurer, or other covered entity faxes or mails documents containing protected health information, federal privacy rules shape what the cover sheet should say. The HIPAA Privacy Rule at 45 CFR 164.530(c) requires covered entities to maintain “appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information.”1eCFR. 45 CFR 164.530 – Administrative Requirements A properly worded cover sheet is one of those safeguards.
A HIPAA-compliant cover sheet typically states that the transmission contains confidential health information protected by federal law, identifies the intended recipient by name, and instructs anyone who receives it by mistake to notify the sender immediately and destroy all copies. No specific regulation dictates the exact wording, but the notice should be clear enough that an accidental recipient understands they cannot read, copy, or forward the documents.
Keep Patient Details Off the Cover Sheet
A common and costly mistake is printing patient names, diagnoses, or account numbers directly on the cover sheet where anyone walking past the fax machine can see them. HIPAA’s “minimum necessary” standard at 45 CFR 164.502(b) requires covered entities to limit protected health information to the minimum needed to accomplish the purpose of the disclosure.2eCFR. 45 CFR 164.502 – Uses and Disclosures of Protected Health Information The cover sheet’s purpose is routing and legal notice, not clinical detail. Use a generic reference number or case identifier in place of patient-identifying information.
If a Fax Goes to the Wrong Number
A misdirected fax containing unencrypted health information can trigger HIPAA’s breach notification requirements. Under 45 CFR 164.404, a covered entity that discovers an impermissible disclosure of unsecured protected health information must notify each affected individual in writing within 60 calendar days of discovering the breach.3eCFR. 45 CFR 164.404 – Notification to Individuals
Not every misdirected fax qualifies as a reportable breach. Organizations must conduct a risk assessment weighing factors like whether the information was actually viewed, who received it, and whether the risk has been mitigated. If the unintended recipient confirms they destroyed the pages without reading them, the assessment may show a low probability of compromise and no report would be required. That assessment must be documented either way.
Attorney-Client and Work-Product Notices
Law firms and corporate legal departments routinely stamp cover sheets with language asserting that the attached documents are protected by attorney-client privilege or the work-product doctrine. A typical notice states the materials are intended solely for the named recipient, that any unauthorized review or distribution is prohibited, and that accidental recipients should return or destroy the documents.
Most people overestimate what these disclaimers do. Courts have consistently held that a boilerplate privilege notice does not create privilege where it wouldn’t otherwise exist. Association of Corporate Counsel practitioner surveys reflect that judges view blanket disclaimers as “pro forma” and largely irrelevant to privilege determinations. Overusing the disclaimer on every routine communication may dilute its value when it matters. If the underlying communication doesn’t meet the requirements for privilege (a confidential communication between attorney and client for the purpose of legal advice), no cover sheet language will save it.
Including the notice is still standard practice. If privileged documents are accidentally disclosed, a clear cover sheet strengthens the argument that the disclosure was inadvertent and that you took reasonable steps to protect confidentiality. Skip it, and you’ve made opposing counsel’s argument easier.
Government Cover Sheets
Federal employees and government contractors deal with two distinct types of cover sheets, each governed by its own regulations.
Standard Form 705 for Classified Information
Standard Form 705 is the federal government’s cover sheet for documents classified at the “Confidential” level. It is prescribed by the GSA and the Information Security Oversight Office and is used across federal agencies to physically mark and protect classified national security information.4General Services Administration. Confidential (Cover Sheet) Separate cover sheets exist for Secret (SF-704) and Top Secret (SF-703) materials. These forms are ordered through standard government supply channels and are not typically relevant to private-sector users.
Standard Form 901 for Controlled Unclassified Information
Controlled Unclassified Information, or CUI, sits below classified material but still requires protection. Standard Form 901 serves as the cover sheet for CUI documents. The form includes fields for CUI categories, limited dissemination controls, special handling instructions, and points of contact. Anyone handling documents attached to SF-901 must protect the information from unauthorized disclosure, and access must be consistent with a lawful government purpose.5General Services Administration. Standard Form 901 – CUI Cover Sheet
The mandatory marking requirements for CUI are detailed in 32 CFR 2002.20. Every CUI document must carry a banner marking that includes the CUI control marking (either the word “CONTROLLED” or the acronym “CUI”), any applicable category or subcategory markings, and a designation indicator identifying the agency that classified the information.6eCFR. 32 CFR 2002.20 – Marking Defense contractors handling covered defense information face additional requirements under DFARS 252.204-7012.7Acquisition.GOV. DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting
Finding and Filling In a Template
Most word processing programs, including Microsoft Word, Google Docs, and LibreOffice, include fax cover sheet templates you can adapt by adding a confidentiality notice. For government use, GSA provides the official forms through its website and internal ordering systems. Healthcare organizations often maintain pre-approved templates that their compliance team has already reviewed for HIPAA language.
Work through the fields systematically when filling one in. Double-check the recipient’s fax number or mailing address against your records. A transposed digit is the most common cause of misdirected faxes, and in a healthcare or legal context, that mistake can trigger breach notification obligations. Verify the page count after assembling the full packet, not before.
If you’re filling in a printed blank form by hand, use black ink and print clearly. Smudged or illegible sender information defeats the purpose of the cover sheet, because the accidental recipient has no way to notify you of the error. For digital templates, adding your organization’s logo and contact information to the header helps the recipient identify the source, but it’s cosmetic rather than legally required.
Sending the Documents
The cover sheet goes on top of the stack, facing up, so it’s the first thing the recipient sees. For fax transmissions, feed the cover sheet and documents into the machine, confirm the recipient’s number on the display, and send. Most fax machines generate a transmission confirmation report showing the date, time, destination number, and page count. Keep that report. It’s your proof that the documents were sent to the correct number, and it becomes important evidence if a dispute arises over whether the transmission occurred.
For physical mail, place the cover sheet and documents inside an opaque envelope that prevents anyone from reading through the paper. Use a delivery method with tracking confirmation, such as certified mail, FedEx, UPS, or a professional courier. Tracking doesn’t prevent interception, but it proves when the package was delivered and who signed for it.
Email and Digital Transmission
Email has largely replaced fax in many offices, but a confidentiality notice still matters. It typically appears either as a separate PDF attachment or as disclaimer text in the email body or signature block. The practical content is the same: identify the intended recipient, state that the contents are confidential, and instruct accidental recipients to delete the message and notify the sender.
Adding a disclaimer to an email does not encrypt the message or prevent forwarding. For genuinely sensitive material like medical records or privileged legal documents, encryption is the real safeguard. Many email platforms offer built-in encryption or secure portal options where the recipient accesses the documents through a password-protected link rather than as an open attachment. The confidentiality notice and the encryption work together. One establishes intent and legal notice; the other provides actual technical protection.
Common Mistakes That Undermine the Cover Sheet
The cover sheet only works if the rest of the transmission process supports it. These errors show up repeatedly:
- Detailed subject lines. Writing “Lab results for John Smith, DOB 03/15/1982” on the cover sheet exposes protected information to anyone who sees the page. Use a case number or generic description instead.
- Skipping the page count. Without a total, the recipient has no way to know if pages were lost. Missing pages in a legal filing can mean missed deadlines or incomplete medical records.
- Wrong fax number. Verify the number before sending. Some offices program frequently used numbers into speed dial to reduce the risk of manual entry errors.
- Reusing a template without updating fields. Sending a cover sheet with the previous recipient’s name still on it is worse than sending no cover sheet at all, because it actively misdirects the documents.
- Assuming the cover sheet replaces encryption. A confidentiality notice on an unencrypted email is a polite request, not a technical barrier. If the information warrants a cover sheet, it probably warrants encryption too.