HIPAA and Fax in 2026: When E-Fax Is the Right Tool

Start with the answer: HIPAA does not ban fax. Healthcare still depends on it for referrals, prescriptions, records requests and payer paperwork, and the HHS Privacy Rule lets covered entities send protected health information (PHI) by fax when they use reasonable safeguards. E-fax, which delivers faxes to email or a portal instead of a paper machine, is often the safer and easier choice, as long as the service is set up with the right controls and a business associate agreement.

What HIPAA actually requires

Two rules matter. The Privacy Rule requires covered entities to use appropriate administrative, technical and physical safeguards to protect the privacy of PHI, and to limit uses and disclosures to the minimum necessary for the purpose. The Security Rule applies to electronic PHI and requires a risk analysis, access control, audit controls, integrity and transmission security measures, among other standards. The rules are technology-neutral. They do not name fax, and they do not say which products to use. They ask you to assess your risks and make reasonable choices.

Paper fax and e-fax are different under the rules

A traditional fax sends a paper page from one machine to another. The Security Rule is about electronic PHI, and HHS has not treated a paper-to-paper fax as electronic PHI in the usual sense, but the Privacy Rule's safeguards still apply to the paper: where the machine sits, who sees the page, and what happens to unclaimed pages. An e-fax service changes this. The message exists as a file, it travels over the network, it is stored on a server and it is delivered to a mailbox or portal. That makes it electronic PHI, so the Security Rule applies to the service and to how you use it.

Business associate agreements

A business associate is a vendor that creates, receives, maintains or transmits PHI on a covered entity's behalf. HHS guidance on cloud services says that a provider that stores PHI, even in encrypted form without the key, is generally a business associate and needs a written agreement. An e-fax provider that keeps faxes on its servers falls in that group. The agreement spells out permitted uses, safeguards, breach reporting and return or destruction of data. A provider that will not sign one is not an option for PHI. Also review who else touches the data: carriers and sub-processors.

When e-fax is the right tool

• You must receive documents from partners who only fax. E-fax gives you a number and delivers to the right team without a machine in a hallway.
• You want an audit trail: who received, opened, forwarded or deleted a fax and when.
• Staff work in several offices or remotely and need access without being physically present.
• You want to route faxes by number to departments, so a referral does not sit in a general tray.
• You need retention and search, with controlled deletion.

When a paper machine or another channel makes sense

Sometimes the simplest approach is fine: a small office with one machine in a locked room and a confirmation routine. Other times fax is the wrong channel. If both sides can use a secure portal, direct messaging or encrypted email, those may be easier to audit. The right answer depends on your partners and your risk analysis. Document the choice.

What to check in an e-fax service

• A signed business associate agreement.
• Encryption in transit and at rest, and a clear statement of where data is stored.
• Access control: unique users, multi-factor authentication, role-based access to numbers and folders.
• Audit logs you can export.
• Delivery by secure portal or encrypted email rather than plain email attachments, or a documented decision about the risk if plain email is used.
• Retention settings and a deletion process you control.
• Clear incident notification terms.
• Integration with your phone system and your records or archive.

Reducing the human errors

Most reported fax problems are misdirected faxes. Use stored recipient numbers, test a new number with a cover page that has no PHI, confirm receipt for sensitive documents, and keep cover sheet wording limited to what the recipient needs. Add a confidentiality notice, remembering that it does not replace safeguards. Train staff, and have a short procedure for reporting a misdirected fax so you can assess whether it is a reportable breach.

What may change in 2026

In January 2025 HHS published a proposed rule to update the Security Rule, including stronger expectations for encryption, multi-factor authentication, asset inventories and testing. A proposal is not a final rule. Check the current status of rulemaking and its effective dates with counsel. Whatever happens, an e-fax setup that already has encryption, strong access control and good logging is in a better position.

A short checklist

Include fax in your risk analysis. Choose paper or e-fax on purpose and write it down. Sign a business associate agreement with any e-fax vendor. Turn on multi-factor authentication and audit logs. Train staff on cover sheets and misdirected faxes. Review quarterly. Our team can set up fax with your phones and your compliance needs. Start with our Voice, Fax and SMS service.

Sources

• HHS, HIPAA Privacy Rule summary
• HHS, HIPAA Security Rule summary
• HHS, Guidance on HIPAA and Cloud Computing
• HHS, Business associates

This article is general information, not legal or compliance advice. Rules and enforcement priorities change; confirm what applies to your firm with qualified counsel and your regulator's current guidance. Last reviewed November 9, 2026.

Keep reading

Next · InfrastructureWhen Microsoft 365 Is Down: Email Continuity ExplainedMicrosoft 365 outages are rare but real, and they stop email, calendars and Teams together. This guide explains what happens to messages when the service is down and how email continuity keeps your people working.7 min read

• SEC Regulation S-P Amendments: A Practical Checklist for Investment Advisers and Broker-Dealers7 min
• The Florida Information Protection Act: A Breach-Response Checklist for Florida Businesses7 min