Is Online Fax HIPAA Compliant? What Healthcare Offices Should Know
HIPAA applies to organizations, not products. Learn what a Business Associate Agreement is, which safeguards to look for in an online fax service, and how to reduce misdirected-fax risk.
This article is for general information and isn't legal advice.
It is one of the most common questions healthcare offices ask: "Is online fax HIPAA compliant?" The honest answer is that no software product is HIPAA compliant on its own. HIPAA compliance is something your organization achieves through its policies, training, agreements and choice of tools. An online fax service can support that effort, or make it harder.
Who HIPAA applies to
The HIPAA Privacy and Security Rules apply to covered entities (health plans, healthcare clearinghouses and most healthcare providers that conduct standard electronic transactions) and to their business associates, meaning vendors that create, receive, maintain or transmit protected health information (PHI) on their behalf. A fax service that stores and transmits faxes containing PHI is generally a business associate.
Because compliance is an organizational responsibility, you will see careful providers avoid saying their product is "HIPAA certified." There is no official government certification for HIPAA compliance.
The Business Associate Agreement (BAA)
Before a covered entity lets a vendor handle PHI, HIPAA requires a written Business Associate Agreement. A BAA describes how the vendor may use and disclose PHI, requires appropriate safeguards, and sets out obligations such as reporting breaches. Using a vendor to handle PHI without a BAA is a common compliance gap.
FaxToFax offers a BAA on Business plans. If your office will send or receive PHI, choose the Business plan and sign the BAA before you start.
Safeguards to look for
The Security Rule asks covered entities and business associates to implement administrative, physical and technical safeguards. When evaluating an online fax service, look for features that help you meet those expectations:
- Encryption of faxes in transit and at rest.
- Access control, with individual user accounts and roles rather than a shared login.
- Strong sign-in and automatic sign-out after inactivity.
- Audit logs showing who sent, viewed or deleted documents.
- Retention controls so records are kept as long as needed and then removed.
- Notifications that do not expose PHI. Alerts should tell you a fax arrived without including the document.
How FaxToFax supports your HIPAA safeguards
- Faxes are stored in an encrypted inbox and accessed only through the web app.
- Passwordless sign-in with a one-time email code, so there are no shared or reused passwords.
- Automatic sign-out after 30 minutes of inactivity by default (owners can choose 15, 30 or 60).
- Team roles: owner, admin, member and viewer.
- An append-only audit log with CSV export.
- Retention settings with automatic deletion.
- In-app and browser new-fax alerts that never contain the document.
- A BAA available on Business plans.
These features support your safeguards; they do not replace your risk analysis, policies or workforce training. Read more on our security page.
The biggest real-world risk: misdirected faxes
Many fax-related privacy incidents are not hacks. They are faxes sent to the wrong number. A transposed digit can send lab results to a stranger's home office. Practical steps help:
- Enter numbers carefully. FaxToFax shows each number back to you, with its flag, before anything is sent.
- Save frequently used numbers as contacts after verifying them.
- Periodically confirm that saved numbers for referral partners are still current.
- Use a cover page with a confidentiality notice and instructions for misdirected faxes.
- Send only the minimum necessary information.
Policies your office should have
- Who may send and receive faxes, and with what role.
- How fax numbers are verified before first use.
- How long faxes are retained and who reviews the audit log.
- What to do when a fax is misdirected or received in error.
Summary
Online fax can be part of a HIPAA-compliant workflow when your organization signs a BAA with the provider, configures appropriate access and retention, and trains staff. FaxToFax offers a BAA on Business plans and safeguards built for the HIPAA Security Rule. For more context, see fax vs email for sensitive documents and what to put on a fax cover sheet. Ready to begin? Get started and choose the plan that fits your practice.
