HIPAA Compliant Faxing: What Healthcare Providers Need to Know

Why Healthcare Still Relies on Fax

It surprises people outside the industry, but fax is the backbone of healthcare communication in the United States. An estimated 75% of all medical communication still happens via fax. Here's why:

• HIPAA recognizes fax as a secure transmission method. Unlike email, which requires encryption to be HIPAA compliant, traditional fax transmits data over the Public Switched Telephone Network (PSTN) — a point-to-point connection that's inherently difficult to intercept.
• Universal compatibility. Every hospital, clinic, pharmacy, insurance company, and government health agency has a fax number. Not all of them have secure email portals or electronic health record (EHR) interoperability.
• Legal acceptance. Faxed documents with signatures are accepted for prior authorizations, referrals, prescription orders, and claims processing.
• Audit trail. Fax provides delivery confirmation that can serve as proof of transmission for compliance purposes.

Fax isn't going anywhere in healthcare soon. What is changing is how faxes are sent — shifting from physical fax machines to online fax services.

What HIPAA Requires for Faxing

HIPAA doesn't ban any specific technology. Instead, it requires "reasonable safeguards" to protect Protected Health Information (PHI). For faxing, this translates to several practical requirements:

Administrative Safeguards

• Policies and procedures — Your organization must have written policies governing how fax is used to transmit PHI, who is authorized to send faxes containing PHI, and how misdirected faxes are handled.
• Training — Staff must be trained on proper fax procedures, including verifying fax numbers before sending and using cover sheets.
• Business Associate Agreements (BAAs) — If you use a third-party fax service (online or otherwise), that service is a Business Associate under HIPAA. You must have a signed BAA before transmitting any PHI through their platform.

Technical Safeguards

• Access controls — Only authorized personnel should be able to send faxes containing PHI.
• Transmission security — The fax transmission itself must be secure. Traditional PSTN fax meets this by default. Online fax services must use encryption (TLS) for the internet portion of the transmission.
• Audit controls — You must be able to track who sent what, when, and to whom. Delivery confirmations should be retained.

Physical Safeguards

• Fax machine placement — If using a physical machine, it should be in a secure area, not a public hallway where anyone can see incoming faxes.
• Prompt retrieval — Incoming faxes must be retrieved promptly to prevent unauthorized access.
• Disposal — Faxed documents containing PHI must be disposed of securely (shredding, not recycling).

What Makes an Online Fax Service HIPAA Compliant?

Not every online fax service is HIPAA compliant. Here's what to look for:

1. Willingness to Sign a BAA

This is the non-negotiable requirement. If a fax service won't sign a Business Associate Agreement, you cannot use it to transmit PHI. Period.

A BAA establishes:

• The service's obligations to protect PHI
• How they'll report breaches
• What happens to PHI when the agreement ends
• Their liability for unauthorized disclosures

2. Encryption in Transit and at Rest

The service must encrypt fax data:

• In transit — TLS encryption between your browser and the service's servers, and secure transmission to the recipient's fax machine
• At rest — If the service stores your fax documents (even temporarily), they must be encrypted on their servers

3. Access Controls and Authentication

The service should offer:

• User authentication (login required)
• Role-based access (not everyone sees every fax)
• Session timeouts
• Multi-factor authentication (ideally)

4. Audit Logging

The service must maintain logs of:

• Who sent each fax
• When it was sent
• The recipient's fax number
• Delivery status
• Who accessed stored faxes

5. Secure Document Handling

• Documents should be stored only as long as necessary
• Automatic deletion after a defined retention period
• Secure deletion that doesn't leave recoverable data

6. Data Center Security

The service should use data centers with:

• SOC 2 Type II certification (or equivalent)
• Physical access controls
• Redundancy and disaster recovery

HIPAA Compliance by Service

Feature	QuickFaxPro	eFax	Fax.Plus	RingCentral
Signs BAA	Contact us	Yes (enterprise)	Yes (business plan)	Yes (enterprise)
Encryption in transit	Yes (TLS)	Yes	Yes	Yes
Document auto-deletion	Yes (after delivery)	No (stored)	Configurable	No (stored)
Audit trail	Yes (per-fax status)	Yes	Yes	Yes
User authentication	Optional (pay-per-fax)	Required	Required	Required
SOC 2 certified	No	Yes	Yes	Yes

Important note: HIPAA compliance is not a certification that a service either has or doesn't have. It's a set of requirements that both you (the covered entity) and your service provider (the business associate) must meet together. No service can make you HIPAA compliant on its own — your internal policies and training matter just as much.

Best Practices for HIPAA Compliant Faxing

Whether you use a physical machine or an online service, these practices reduce your risk:

Before Sending

1. Verify the fax number. This is the single most important step. A misdirected fax containing PHI is a reportable breach. Call the recipient to confirm their number if you haven't faxed them before.
2. Use a cover sheet. Every fax containing PHI must have a cover sheet with a confidentiality notice. A standard notice reads: "This fax contains confidential information intended only for the named recipient. If you received this fax in error, please notify the sender immediately and destroy all copies."
3. Limit PHI to what's necessary. The HIPAA Minimum Necessary Rule applies to faxes. Don't fax an entire patient record if you only need to send a lab result.
4. Pre-program frequent numbers. If you fax the same recipients regularly, save their numbers to reduce the risk of manual entry errors.

During Transmission

5. Confirm delivery. Always check the delivery confirmation. If a fax fails, investigate before resending — the number may have changed.
6. Don't leave the machine unattended. If using a physical fax machine, stay nearby during transmission to handle any errors immediately.

After Sending

7. Retain confirmation records. Keep delivery confirmations for your audit trail. Most compliance officers recommend retaining them for at least 6 years (the HIPAA retention period).
8. Dispose of originals properly. If you printed a document specifically to fax it, shred it after confirming delivery.

Handling Misdirected Faxes

Mistakes happen. If a fax containing PHI is sent to the wrong number:

1. Contact the unintended recipient immediately and ask them to destroy the fax
2. Document the incident
3. Assess whether it constitutes a reportable breach (affecting 500+ individuals requires notification to HHS)
4. Review and update your verification procedures

QuickFaxPro's Security Features

QuickFaxPro was designed with document security as a priority:

• No document storage — Your PDF is deleted from our servers immediately after the fax is delivered. We don't keep copies of your documents.
• TLS encryption — All data between your browser and our servers is encrypted.
• Stripe-secured payments — We never see or store your credit card information. All payment processing is handled by Stripe, a PCI DSS Level 1 certified processor.
• Per-fax delivery tracking — Every fax gets a dedicated status page with real-time updates, giving you a clear audit trail.
• Automatic cover sheets — Free, professionally formatted cover sheets with space for confidentiality notices.

For healthcare organizations that need to send occasional outbound faxes — referrals, prior authorizations, prescription requests — QuickFaxPro's pay-per-fax model means you're not paying for a subscription for a capability you use intermittently.

If your organization requires a signed BAA, contact us to discuss your needs. We're committed to supporting healthcare providers with secure, simple faxing.

Conclusion

Fax remains deeply embedded in healthcare for good reason — it's secure, universal, and legally accepted. As the industry gradually transitions to online fax services, the key is ensuring your chosen service meets HIPAA requirements and that your internal procedures are solid.

The technology you use matters less than how you use it. Verify numbers, use cover sheets, limit PHI, retain confirmations, and train your staff. Those fundamentals keep you compliant regardless of whether you're using a fax machine in the corner or an online fax service on your laptop.