Healthcare runs on fax. Referrals, records requests, prior authorizations — the interoperability layer of American medicine is still, in 2026, a technology from the 1960s. Which means every practice eventually asks the same question: how do we fax without a HIPAA problem?
The good news: this is one of the easiest HIPAA questions there is. The bad news: vendors have wrapped it in enough fog to sell $50 “compliance plans” for something available under $14. Let’s clear the fog.
What HIPAA actually says about fax
HIPAA doesn’t mention fax machines, PDF, or the cloud. It requires that protected health information (PHI) be safeguarded with reasonable administrative, physical, and technical measures — and that any vendor who touches PHI on your behalf signs a Business Associate Agreement (BAA).
An online fax provider stores and transmits your PHI. That makes it a business associate. Therefore:
An online fax service is HIPAA-appropriate for your practice if and only if it will sign a BAA covering your account.
Everything else — “military-grade encryption,” “HIPAA-friendly,” badges on the pricing page — is marketing. No BAA, no deal. And note the phrase covering your account: some providers sign BAAs only on specific tiers, so a provider can be simultaneously compliant for its Business customers and non-compliant for you.
There is no such thing as “HIPAA certified”
HHS certifies no products and no vendors. Any service advertising HIPAA certification is describing a thing that does not exist, which tells you something useful about its marketing department. What legitimate vendors offer is a BAA plus security controls that support your compliance posture.
Who signs a BAA, and at what price
The market splits into three camps:
Compliance as a standard feature. Documo includes a BAA on every plan, starting with its $25 Solo tier — plus the OCR and EHR integrations clinics actually use. SRFax’s healthcare plans bundle a BAA, PGP-encrypted storage, and audit logging from $13.65/month at annual billing (500 pages) — the cheapest credible package we track.
BAA from the mid tier. iFax includes its BAA from the Plus plan ($24.99/month annual, 500 pages), wrapped in the best mobile and desktop apps in the category. Note that its cheap Basic tier is send-only and not intended for PHI.
Compliance as a premium. eFax includes a BAA with its Business plan at $39.99/month, alongside a sales-quoted Corporate program. Fax.Plus reserves its BAA for the Enterprise plan from $79.99/month. Both are legitimate; both charge several times SRFax’s price for the same legal instrument.
The full ranked list with your volume priced in is on our HIPAA fax pricing page.
The compliance features that matter past the BAA
For a solo practice, the BAA plus sensible password hygiene honestly covers it. As headcount grows, four features earn their price:
- Per-user logins. A shared login is an audit finding waiting to happen — you can’t attribute access to a person.
- Audit trails. Who viewed which fax, when. This is the question an OCR investigator actually asks.
- Access scoping. Front desk sees the front-desk inbox, not the therapy notes line.
- Retention controls. Your state’s medical-records retention rules applied automatically, instead of “keep everything forever” (its own liability).
The setup mistakes that undo compliance
The provider is rarely the weak link; configuration is.
- Faxes forwarded to personal email. The BAA covers the fax service, not your Gmail. Keep PHI inside the platform, or forward only to your HIPAA-covered email system.
- The wrong-number misdirect. Most reported fax incidents are misdials. Use the address book, not manual entry; enable the confirmation screen; test new referral numbers with a cover page before sending records.
- Auto-print to a shared tray. Recreating the hallway fax machine in software. Route inbound faxes to a scoped digital inbox instead.
- Nobody signed the BAA. It isn’t automatic — you typically have to request and countersign it during onboarding. “The vendor offers a BAA” and “we have an executed BAA on file” are different sentences, and only one helps you in an audit.
The five-minute action plan
- Count your monthly fax pages (your current usage report has this).
- Shortlist providers that sign a BAA at your budget — start with the HIPAA comparison with your volume dialed in.
- Trial the winner for a month, execute the BAA during onboarding, and confirm delivery works with your top referral partners.
- Configure per-user logins and turn off any personal-email forwarding.
- File the executed BAA where you file vendor agreements. Done.
Compliant faxing at a small practice is a $14–25/month problem with a one-afternoon setup. Anyone quoting you a “compliance program” for it is selling fog.