The U.S. Department of Health and Human Services has never prohibited healthcare providers from using fax machines. According to HHS guidance, the Privacy Rule allows physicians to send protected health information (PHI) to other providers via fax for treatment purposes, provided that reasonable and appropriate safeguards are in place.

Consider two identical referral forms dispatched on the same morning. One travels through an encrypted, audited channel backed by a signed business associate agreement (BAA), where optical character recognition (OCR) software catalogs it into the patient record. The other lands in an output tray in a common hallway. Though the documents are identical and the law is the same, their compliance standing differs dramatically.

HIPAA regulates the safeguards, not the fax itself

Must a fax meet HIPAA standards? For any organization transmitting PHI—whether a covered entity or business associate—the answer is yes. However, a fax device, software application or cloud service cannot achieve compliance independently on behalf of an organization. The regulation focuses on whether the organization has established reasonable safeguards around each disclosure.

According to HHS, covered entities "must have in place reasonable and appropriate administrative, technical, and physical safeguards" when sending PHI by fax. This includes verifying the recipient's phone number and pre-programming frequently dialed numbers. Once a faxed page becomes a digital file, the Security Rule's safeguard requirements also apply.

Most people start by asking whether a fax service is HIPAA compliant, and that's the wrong place to start. HIPAA doesn't certify a fax machine or an app. I'd rather people ask who can open the document, whether anything done to it is logged, and whether the BAA covers the software reading the page, not just the line carrying it.

Adam Korbl, Founder and CEO of iFax

Korbl's questions center on the entire workflow. A fax that arrives undamaged but waits in a shared queue, or gets routed to the wrong patient chart, can still compromise privacy. The sector's breach statistics are already troubling: The HIPAA Journal documented 772 large healthcare data breaches reported to the OCR portal during 2025 as of early January 2026, marking a record high.

What a compliant fax workflow includes today

OCR engines, data extraction models and routing algorithms now process each page, and each operation carries the same legal obligations as the initial transmission.

Encryption is the natural starting point. Under the current Security Rule, encryption is classified as an "addressable" specification—a designation that The HIPAA Journal notes has caused some covered entities to treat it as discretionary when it has never been optional. For cloud-based fax services, encryption should protect both the OCR-extracted text and stored images, whether at rest or in transit. Every transmission, receipt, view and routing action must also generate a timestamped record that can be retrieved later.

The BAA serves as the legal foundation for the arrangement. HHS's model BAA language specifies what vendors must commit to, including Security Rule compliance, breach notification procedures and matching obligations for any subcontractors. Under HHS cloud guidance, a cloud provider holding electronic PHI (ePHI) qualifies as a business associate even without encryption keys, and the conduit exception "is limited to transmission-only services." By this standard, a telecommunications carrier transmitting the fax signal functions as a conduit, whereas a cloud fax platform retaining copies typically qualifies as a business associate. When OCR or data extraction occurs at a separate vendor, that vendor requires coverage as well, typically through a subcontractor BAA with the primary vendor.

HHS's guidance on misdirected fax numbers extends to automated routing rules. If a rule fails and files a referral under the wrong patient, the outcome mirrors a misdialed number. Staff should review uncertain matches before filing.

Vendors can shoulder much of this responsibility. iFax describes its healthcare platform as combining AES-256 encryption for data in transit and at rest with signed BAAs, role-based access restrictions and comprehensive audit logs, running OCR within the same secure infrastructure. This addresses the technical requirements. Policies, employee training and risk assessments remain the responsibility of covered entities.

Access control completes the picture, and neglecting it carries documented consequences. The 2024 Change Healthcare breach started with stolen credentials on a system where multi-factor authentication (MFA) was disabled, ultimately affecting approximately 193 million individuals.

The Security Rule is evolving to address AI-powered document reading

HHS is beginning to incorporate artificial intelligence into its regulations, though major updates remain in proposal form. The Security Rule overhaul released on January 6, 2025 would mandate encryption of ePHI with narrow exceptions, require multi-factor authentication and demand an annual inventory of technology assets and network topology. The proposal also addresses AI explicitly: a risk analysis "must include consideration of, among other things, the type and amount of ePHI accessed by the AI tool, to whom the data is disclosed, and to whom the output is provided."

The timeline remains unclear: following nearly 5,000 public comments, final adoption is now projected for July 2027. The OCR's own assessment estimated first-year compliance expenses at $9 billion, and the proposal would allow organizations 240 days after finalization to comply. These timelines are unlikely to shift the fundamental division of labor: vendors build the infrastructure, and healthcare organizations operate the compliance program.

We can give a practice the encryption, the audit trail and a controlled place for OCR to run. The policies, the staff training, the risk analysis, that's for the practice's to own, not ours.

Adam Korbl

This distinction becomes murky when staff independently deploy AI tools. An Imprivata-commissioned survey of 250 health security and AI leaders found that 72% reported AI tools or agents being deployed without formal IT approval, according to Axios. Tools that IT has not authorized are unlikely to appear in an asset inventory, much less be evaluated against a BAA, and an inventory requirement like the one HHS proposed is designed to identify them. The same survey revealed that 28% of organizations have agentic AI running in production, while 44% are piloting or testing it.

Buy the components, but run the program yourself

A healthcare practice can purchase a compliant document management stack. Compliance itself cannot be purchased that way. It must be operated from within the practice, supported by documented policies that are regularly refreshed and staff trained to follow them. A fax vendor unable to deliver encryption, access controls, audit logs and a signed BAA should not be considered. For the AI component, procurement teams should dig deeper: determine where the document reading actually takes place, confirm whether the BAA covers that location, verify that automated actions are logged and identify who reviews matches the software cannot confidently resolve.

Source: The Next Web