Yes, you can fax protected health information (PHI) under HIPAA, but only with the right safeguards in place. The core focus of HIPAA standards is protecting PHI regardless of the technology used to transmit it. It could be fax or other document exchange methods.
Healthcare faxing remains common for sending and receiving patient referrals, intake forms, and other sensitive documents. This guide explains what HIPAA-compliant faxing involves, the key requirements, and how to choose a trusted healthcare fax service that makes compliance easier to maintain.
On This Page
Key takeaways
- HIPAA permits faxing PHI for permitted purposes with reasonable safeguards. It does not specifically “approve” fax machines or software.
- Online fax can establish safeguards through encryption, access controls, audit logs, and a signed business associate agreement (BAA).
- No tool guarantees compliance on its own. Policies, training, and risk analysis still matter.
Is a Fax HIPAA Compliant?
Short answer: A fax isn’t compliant or non-compliant on its own. HIPAA permits faxing PHI when the sender has a lawful purpose and applies reasonable administrative, physical, and technical safeguards.
According to HHS, the Privacy Rule permits covered entities (e.g., hospitals) to share PHI for treatment without patient authorization, provided they use reasonable safeguards.
The HHS offers a practical example: when faxing to a number that isn’t regularly used, a reasonable safeguard is to confirm the number with the intended recipient first.
How you fax changes how easy those safeguards are to apply:
Traditional fax machine | Online (cloud) fax | |
Exposure | Printed pages can sit in shared trays | Faxes arrive in a secured, access-controlled account |
Misdirected faxes | Manual dialing; insufficient record beyond a confirmation sheet | Saved contacts reduce keying errors; delivery records are kept |
Audit trail | Usually none | Activity logs show who sent or viewed what, and when |
Vendor agreement | Usually not applicable | Providers are required to sign a BAA |
Note: There is no government certification for fax software. Compliance depends on how your organization and your vendor operate, so “HIPAA compliant fax” describes the process instead of a product.
HIPAA Fax Requirements: What the Rules Say
Three HIPAA rules shape how organizations handle faxed PHI:
- Privacy Rule: Governs when PHI can be used and disclosed, including the minimum necessary standard. Disclosures for treatment between providers are exempt from that standard.
- Security Rule: Governs how electronic PHI is protected, which applies to online fax systems.
- Breach Notification Rule: Governs what to do when PHI is exposed.
Related Read: The Three Rules of HIPAA: Easy Guide
Regulatory watch: HHS proposed a major Security Rule update in January 2025 that would turn encryption, currently an addressable specification, into a required safeguard. Final action has reportedly been pushed to at least July 2027, and the current rule remains in force in the meantime. Treat strong encryption as the baseline now.
Best Practices for HIPAA-Compliant Faxing
Always verify before you send
Confirm each recipient and fax number, especially numbers you rarely use. Send only the pages needed. Never leave documents unattended at a machine, and lock your computer or phone screen when you step away from an online fax session.
Use a HIPAA fax cover sheet
Include sender and recipient details, page count, and a confidentiality notice. Keep patient information off the cover sheet. HIPAA doesn’t mandate a specific disclaimer, but one helps a misdirected recipient know what to do. A cover sheet helps reduce risk in addition to other safeguards.
Our fax cover sheets for HIPAA-compliant faxing are a good starting point.
Require a signed BAA before using a fax service for PHI
A cloud fax provider that stores or processes PHI acts as a business associate, so you need a legally signed BAA that defines permitted uses, safeguards, and breach reporting. If a provider won’t sign one, don’t use it for PHI.
See our BAA template for what to expect.
Keep audit trails
Audit controls are part of the HIPAA Security Rule’s technical safeguards. They require mechanisms to log, monitor, and audit fax activity that contains or uses electronic protected health information. Fax logs that show who sent, received, accessed, or opened a fax, and when those events occurred, can support investigations, security reviews, and required activity reviews.
As part of HIPAA requirements, covered entities and business associates must retain required Security Rule documentation for at least six years. Whether a particular fax log is treated as required documentation depends on the organization’s policies, its use of the log for compliance evidence, and other applicable legal or contractual requirements. Confirm the retention period with your compliance officer.
Limit exposure to the minimum necessary
When faxing, share only what the recipient needs, grant staff access by role, and train them on what to do if a fax is misdirected. Keep PHI off portable devices unless they’re encrypted, and review your risk analysis regularly.
Common mistakes to avoid ❌:
- Dialing the wrong fax number
- Faxing without a cover sheet
- Leaving an inbox unsecured
- Using a fax service to fax PHI without a BAA
- Having no written policies and procedures
Disclaimer: This article is educational and isn’t legal advice. Consult your compliance officer or counsel.
What to Look for in a HIPAA-Compliant Fax Service
Use this checklist when comparing and choosing secure fax providers:
Feature | Why it matters |
Signed BAA | Vendors handling PHI are business associates |
Encryption in transit and at rest | Protects ePHI from interception and unauthorized access |
Access controls and authentication | Limits who can send, view, and manage faxes |
Audit logs and delivery confirmations | Supports accountability and compliance reviews |
EHR/EMR integration or API | Reduces manual routing and re-keying |
Automation and OCR | Speeds indexing and document handling |
Multi-user, high-volume support | Scales across locations and teams |
iFax is one secure fax option built for healthcare and business use. It offers a BAA, encrypted transmission, activity logs, team inboxes, EHR fax integration, a programmable Fax API, OCR, and automation rules for inbound and outbound faxing.
As with any vendor, software supports compliance but doesn’t guarantee it. Your policies, training, and risk analysis still do the heavy lifting.
HIPAA Faxing FAQs
What is HIPAA compliant faxing?
HIPAA-compliant faxing refers to sending and receiving PHI via fax in accordance with the administrative, physical, and technical safeguards HIPAA requires, such as encryption, access controls, audit logs, and a signed business associate agreement (BAA) with your fax provider.
Do I need a BAA to fax PHI through a service?
Yes. For any vendor that handles PHI on your behalf, the BAA should cover permitted uses, safeguards, and breach reporting.
What if a fax reaches the wrong recipient?
Immediately document what happened, ask the recipient to securely destroy or return the pages, and assess the incident under the Breach Notification Rule. Involve your privacy and compliance officer.
Fax PHI Online With Confidence
HIPAA-compliant faxing comes down to three things working together: trained people, clear processes, and a platform with the right safeguards. When your team knows how to handle PHI, your procedures are written down, and your online fax provider meets all requirements, secure faxing becomes part of the everyday workflow.
See how iFax supports HIPAA-compliant faxing. Request a demo or contact sales.
