Is Faxing HIPAA Compliant? What Safeguards Clinics Need

The short answer

Traditional analog fax is generally HIPAA compliant. HHS has consistently treated fax as an acceptable method for transmitting PHI when physical safeguards are in place. Fax does not require a BAA with your telephone provider.

Internet fax is a different situation. Services that convert fax to digital files and route them over the internet need a signed BAA from the provider before you use them for PHI.

Why fax is still in healthcare

Fax has been the subject of jokes about healthcare’s technology lag for two decades. The reason it persists is not inertia. It is the transmission model.

When your clinic sends a fax over a standard phone line, the document travels point-to-point between your machine and the recipient’s machine. Nothing sits on an intermediate server. There is no cloud storage. The carrier does not retain the content. The audit trail is straightforward: your fax log records the number dialed, transmission time, and confirmation code.

Email is harder to audit. A message from your clinic to a referring physician passes through your email server, your email provider’s infrastructure, the internet, the recipient’s email provider, and then their server. Each hop is a potential breach point and a potential BAA requirement.

CMS and major payers also still require fax for specific workflows: prior authorization requests, referral documentation, and certain claims processes. As long as payer requirements include fax, clinics will keep fax machines.

Required safeguards for HIPAA-compliant faxing

HHS has published guidance on fax safeguards. These are not suggestions. They are the practices that determine whether a fax-related breach is treated as a HIPAA violation.

Fax machines must be in secure areas. A machine sitting in open reception, visible and accessible to patients and visitors, is a physical safeguard failure. Put it behind the front desk or in a staff-only area.

Verify the recipient’s fax number before sending any PHI. Sending to a wrong number is the most common fax-related HIPAA violation. For frequently used numbers, keep a verified directory. For new recipients, call to confirm the number before transmitting.

Every fax containing PHI needs a cover sheet with a HIPAA confidentiality notice, the intended recipient’s name, and instructions for the recipient if they receive it in error.

Incoming faxes should not sit in an output tray where any passing staff member or visitor can read them. Designate someone to retrieve and distribute incoming faxes promptly.

Maintain a transmission log recording the date, time, recipient number, page count, and confirmation status for each outgoing fax. These logs satisfy HIPAA’s audit control requirements.

Internet fax: a different compliance question

Digital fax services work differently. When you send a fax through eFax or a similar service, your document is uploaded to their servers, converted to digital format, and transmitted over the internet. The content touches their infrastructure.

That makes them a business associate under HIPAA. You need a signed BAA before using any internet fax service for PHI.

Not all internet fax providers offer BAAs. Before selecting a service, confirm BAA availability directly. Providers that advertise HIPAA compliance and offer BAAs include Sfax, eFax Corporate, and RingCentral Fax (on business plans). Consumer-grade fax services typically do not offer BAAs.

If your current internet fax service does not offer a BAA, stop using it for PHI immediately and request a BAA or switch providers.

Where fax fits in the broader compliance picture

Fax handles document transmission. It does not handle what happens after the fax arrives.

A prior authorization request comes in by fax. Someone needs to process it, track the follow-up, communicate with the payer, and document the outcome. That workflow, the task coordination that follows the fax, is where many small clinics run into compliance gaps.

PHIGuard covers that coordination layer. When a fax triggers a follow-up task, PHIGuard provides a structured way to assign it, track completion, and maintain a record of who did what. It does not replace fax. It handles the work that starts after the fax arrives. BAA included at every pricing tier starting at $20/month for up to 10 staff.