Guide
Are online fax services HIPAA compliant?
This question has a frustrating answer: no software is HIPAA compliant by itself. Compliance describes how your practice operates, and a vendor is one part of that. Here is what actually matters when you fax patient records.
Why 'HIPAA compliant fax' is a misleading phrase
HIPAA places obligations on covered entities — practices, clinics, hospitals, and their business associates. There is no government certification a fax provider can obtain and display. When a provider markets itself as "HIPAA compliant", what they usually mean is that they are willing to sign a Business Associate Agreement and that they maintain certain safeguards.
That distinction matters, because a practice using a well-secured vendor with no signed agreement and no internal procedures is still out of compliance.
The Business Associate Agreement comes first
A BAA is a contract between your practice and any vendor that will handle protected health information on your behalf. It defines the vendor's safeguards, what they may do with the data, and their obligations if there is a breach.
The order matters. Sending patient records through a vendor before a BAA is signed is itself a HIPAA violation, regardless of how secure that vendor is. If you handle protected health information, email sales@nimblefax.com to discuss an agreement before you send anything.
Safeguards HIPAA expects around faxing
Verify the destination. Misdialled faxes are one of the most frequently reported breaches in healthcare. Confirm numbers against a maintained directory rather than a sticky note, and re-confirm before sending a full record.
Control who sees the arriving document. An open print tray in a shared corridor is a classic finding. Receiving faxes into an account that only authorised staff can open removes that exposure.
Limit access by role. Only staff who need patient records for their job should be able to open them.
Keep a transmission record. You should be able to show what was sent, to which number, and when it was confirmed delivered.
Include a confidentiality notice. A cover note telling an unintended recipient to destroy the document and call you is standard practice.
Questions to ask any fax vendor
Will you sign a Business Associate Agreement, and can I see it before I commit?
How long do you retain my documents, and can I delete them myself?
Who inside your company can access stored documents, and under what circumstances?
What is your process and notification timeline if there is a breach?
Can I restrict which of my staff can open received faxes?
Where NimbleFax stands
Technically: documents travel over encrypted connections and are stored in private storage scoped to your account, so no other customer can reach them, and you can delete any fax yourself. Every fax carries a delivery record with the destination number, page count, and confirmation time.
Contractually: reach out to sales@nimblefax.com about a Business Associate Agreement for your practice. We would rather tell you plainly what is required than claim a compliance badge that does not exist.
This guide is general information about how HIPAA treats faxing, not legal advice. Ask your compliance officer or attorney about your specific obligations.
Common questions
Are online fax services HIPAA compliant?
No service is HIPAA compliant on its own. HIPAA compliance is a property of how a covered entity operates, which includes signing a Business Associate Agreement with any vendor that handles protected health information, plus the office's own safeguards and staff training.
What is a Business Associate Agreement?
A BAA is a contract between a healthcare provider and a vendor that handles protected health information on its behalf. It sets out how the vendor safeguards the data and what happens if there is a breach. Without a signed BAA, sending protected health information through a vendor is itself a HIPAA problem.
Does NimbleFax sign a BAA?
Contact sales@nimblefax.com to discuss a Business Associate Agreement for your practice. Do not send protected health information through any service, including this one, before you have a signed BAA in place.
Is faxing still allowed under HIPAA?
Yes. HIPAA does not ban any particular technology. It requires reasonable safeguards, which is why faxing remains common in healthcare — but the safeguards around it, such as confirming the destination number, still apply.
Is a fax machine more HIPAA-friendly than online fax?
Not inherently. A machine printing into an open tray in a shared corridor is a well-known HIPAA risk. What matters is the safeguards around whichever method you use, not the method itself.
What are the most common HIPAA fax mistakes?
Misdialled numbers sending records to a stranger, faxes left sitting in an open print tray, stale number lists in a directory, and no confirmation that a transmission actually reached the intended recipient.
Talk to us about your practice
Email sales@nimblefax.com to discuss a Business Associate Agreement before sending any patient information.
Start free5 free pages, no credit card.
Still have questions? Email support@nimblefax.com.