HIPAA Compliant Fax Services: Which Sign a BAA

HIPAA compliant fax services are online fax services that sign a business associate agreement (BAA) for the faxes they store or transmit for you: eFax lists BAA coverage on eFax Business, Corporate and Unite, Fax.Plus signs BAAs with Enterprise customers, Documo says every Cloud Fax plan includes a signed BAA, Doximity applies its BAA to its fax service for clinicians, and RingCentral's BAA covers RingCentral Fax. Faxing PHI itself is allowed: HHS says providers may share PHI for treatment "as long as they use reasonable safeguards when doing so" (HHS). Curve Compliance, which signs its own BAA on every plan for HIPAA-compliant ad tracking, checked each vendor's page on October 26, 2026.

Book a call. If your practice also runs ads, the same care applies to what your website sends to ad platforms. Curve Compliance sends conversions server-side, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup. Book a call with Curve.

Is faxing HIPAA compliant?

Yes, with safeguards. HHS says "The Privacy Rule allows covered health care providers to share protected health information for treatment purposes without patient authorization, as long as they use reasonable safeguards when doing so. These treatment communications may occur orally or in writing, by phone, fax, e-mail, or otherwise." Its examples include "A laboratory may fax, or communicate over the phone, a patient's medical test results to a physician" (HHS FAQ).

The safeguards HHS names are practical. For example, "when faxing protected health information to a telephone number that is not regularly used, a reasonable safeguard may involve a provider first confirming the fax number with the intended recipient." And "a covered entity may pre-program frequently used numbers directly into the fax machine to avoid misdirecting the information" (HHS FAQ). That FAQ covers treatment; other disclosures follow the Privacy Rule's other permissions.

Which online fax services sign a BAA?

Each row comes from the vendor's own page, fetched October 26, 2026, and the rows are in no order of preference. A row marked Specific plans means the BAA is offered only on the plans named.

Service	Signs a BAA?	Plans covered	How you get it	Source
eFax	Specific plans	eFax Business, eFax Corporate and eFax Unite, which eFax lists as its products with BAA coverage	Listed as a feature of those plans	eFax
Fax.Plus	Specific plans	Enterprise only, with Advanced Security Controls enabled alongside the BAA	Request and sign it on an Enterprise account	Fax.Plus
Documo (formerly mFax)	Yes	Every plan; one BAA covers all Documo products	Included on every account	Documo; mFax is now Documo
Doximity	Yes, for covered entities	Its electronic fax service and other tools it identifies as secure for PHI	Incorporated into the Doximity Terms of Service by reference	Doximity Privacy Policy
RingCentral Fax	Yes, for paying customers	RingCentral Fax is on the list of services its BAA covers	Ask RingCentral for its BAA	RingCentral and HIPAA

Where a service has a BAA Directory entry, its name links to it, with the vendor's own words.

Service by service

eFax. eFax's HIPAA page lists "Business Associate Agreement (BAA)" among the features of its HIPAA plans and names eFax Business, eFax Corporate and eFax Unite as the products with BAA coverage (eFax).

Fax.Plus. Asked which plans include a BAA, Fax.Plus answers: "Enterprise only. Fax.Plus signs BAAs with Enterprise customers, and Advanced Security Controls (ASC) is enabled alongside the BAA for HIPAA compliance" (Fax.Plus).

Documo. Documo says "mFax, mSign, and mDrive have unified under one brand" (Documo). For Documo Cloud Fax, "Every plan includes a signed BAA," and "A single BAA covers all Documo products, with custom enterprise language available" (Documo).

Doximity. For covered entities that send PHI through a Doximity tool it identifies as secure, "such as our communication tools, AI tools, member messaging, or electronic fax service," Doximity says "such information will be handled in accordance with the Doximity Business Associate Agreement" (Doximity).

RingCentral Fax. "RingCentral makes available a business associate agreement (BAA) for our paying Covered Entity customers in alignment with HIPAA requirements," and its list of covered services starts "RingCentral Fax, RingEX, RingCX" (RingCentral). For phone lines too, see HIPAA compliant phone systems.

Fax machines versus online fax

The HIPAA definitions treat the two differently. Under 45 CFR 160.103, "Certain transmissions, including of paper, via facsimile, and of voice, via telephone, are not considered to be transmissions via electronic media if the information being exchanged did not exist in electronic form immediately before the transmission" (45 CFR 160.103). A paper fax sent from a machine still needs the Privacy Rule safeguards above, and the phone carrier that only carries it acts as a conduit: HHS says "the conduit exception is limited to transmission-only services for PHI (whether in electronic or paper form), including any temporary storage of PHI incident to such transmission" (HHS).

An online fax service is different. It receives your faxes as files and keeps them in its cloud, and HHS says a cloud provider "that maintains ePHI for the purpose of storing it will qualify as a business associate, and not a conduit, even if the CSP does not actually view the information" (HHS). That is why the vendor's BAA matters, and why the Security Rule applies to the faxes it holds for you.

Email to fax adds a second vendor: your mailbox. Fax.Plus says that for its HIPAA accounts, "Inbound email is accepted only over enforced TLS" (Fax.Plus). Your email provider needs its own BAA; see HIPAA compliant email providers. Which rules apply depends on your setup, so talk to your counsel.

How Curve Compliance helps

Fax moves records between providers. Curve Compliance works on a different flow, the data your website and ads produce, under the BAA it signs on every plan. Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn, with only a fixed list of fields per platform, and it checks every event for PHI-like patterns and strips PHI before data reaches an ad platform.

For documents patients send you through your website, Curve Forms has file upload fields for PDF, JPG, PNG, WEBP, HEIC, DOC and DOCX files, on forms Curve hosts under the same BAA. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. For other tools in a practice, see the HIPAA compliant software list.

Sources, checked October 26, 2026: HHS FAQ on treatment communications by fax, e-mail or phone; HHS guidance on HIPAA and cloud computing; HHS guidance on the right of access; 45 CFR 160.103; eFax HIPAA compliance; Fax.Plus HIPAA compliant fax; Documo Cloud Fax; Documo, mFax is now Documo; Doximity Privacy Policy; RingCentral and HIPAA.

Frequently Asked Questions

What makes a fax service HIPAA compliant?

A signed BAA from the service for the faxes it stores or transmits for you, used with your own safeguards such as confirming numbers before sending (HHS). HHS does not certify products, so check the vendor's BAA and the plans it covers (HHS).

Is fax HIPAA compliant?

Yes. HHS says treatment communications "may occur orally or in writing, by phone, fax, e-mail, or otherwise," as long as providers use reasonable safeguards (HHS). An online fax service that stores your faxes also needs to sign a BAA (HHS).

Is faxing a HIPAA violation?

No, not in itself. HHS lists faxing among permitted treatment communications, and the risk it points to is a fax sent to the wrong place, which is why it suggests confirming new numbers and pre-programming frequent ones (HHS).

Where can I send a HIPAA compliant fax?

From a fax machine with HHS's safeguards (HHS), or from an online fax service that signs a BAA with you, such as eFax Business, Corporate or Unite, Fax.Plus Enterprise, Documo (formerly mFax), Doximity for clinicians, or RingCentral Fax.

Which is true regarding fax communication under HIPAA?

HIPAA permits it with reasonable safeguards (HHS). A paper fax from a machine is not a transmission via electronic media when the information was not in electronic form just before it was sent (45 CFR 160.103), while an online fax service stores faxes electronically and needs a BAA (HHS).

What has replaced faxing?

HHS's guidance lists electronic options alongside fax: providers may share PHI for treatment by e-mail as well as fax (HHS), and covered entities "may offer individuals the option of using electronic means (e.g., e-mail, secure web portal)" to request their records (HHS). Online fax services also let staff send and receive faxes from a browser instead of a machine (Documo).

Do people still use fax in 2026?

Yes. HHS still lists fax among the permitted ways to share PHI for treatment (HHS), and on October 26, 2026 eFax, Fax.Plus, Documo and RingCentral each offered fax service with a BAA on their own pages.

Is eFax HIPAA compliant?

eFax lists eFax Business, eFax Corporate and eFax Unite as its products with BAA coverage (eFax). Use one of those plans, with the BAA in place, before sending PHI.

Talk to Curve Compliance

Book a call. Your fax service covers your faxes. Curve Compliance covers the conversions your website and ads produce, sent server-side with PHI stripped before data reaches an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.