Guide to HIPAA Fax Regulations

The Health Insurance Portability and Accountability Act, also known as HIPAA, is a very important piece of legislation that governs the healthcare industry. There are several important parts of HIPAA, like the ability to transfer health coverage for families. When people often refer to HIPAA, however, they are typically referencing patient privacy. For both businesses and patients, HIPAA clearly outlines the measures that must be taken to properly handle sensitive health care information.

If you’re a healthcare provider or operate in the healthcare space, you’re probably already aware of HIPAA privacy requirements, even if you don’t know the intimate details of the act. Essentially, HIPAA is designed to protect the information of patients and lists out penalties for failing to do so. Failing to comply with HIPAA can be incredibly costly in terms of fines alone. It can also result in license revocation, as well as reputational damage. 

But what exactly is HIPAA compliance and what does it have to do with faxing? Does HIPAA compliance even apply to faxed documents? 

Unfortunately, there’s a lot of misinformation regarding the specifics of HIPAA. This article helps to set the record straight so that you know what needs to be done to maintain compliance.

What Constitutes a HIPAA Compliant Fax?

If you own a healthcare business, then you probably send and receive sensitive faxes on a daily basis. Things like referrals to specialists, prescriptions, and transfers of patient data to new practitioners are all covered under HIPAA. Essentially, any fax that contains personal, identifying medical information about a person falls under the scope of HIPAA, which means that specific security measures need to be put into place.

Every fax sent with medical information must be a HIPAA compliant fax. There is no exception to this rule and failing to comply can be bad news for your business. But a HIPAA compliant fax is about more than just being careful with information. In fact, HIPAA requires healthcare businesses to develop clear procedures that help them ensure the confidentiality of patient information. Furthermore, protected health information must be encrypted to prevent hackers from gaining access to someone’s most sensitive data.

With faxed documents, there are plenty of opportunities for data security to be breached. Poor storage and filing of documents can cause a breach, as can failing to immediately sort and action received documents. Using a HIPAA compliant fax service can help reduce the opportunity for sensitive data to be lost, improve your businesses’ operations, and help you deliver the best patient experience possible without sacrificing security.

Who Needs to Know About HIPAA Compliant Fax?

There are three main groups that need to be aware of HIPAA compliance:

  • Your business
  • Your partners outside the business
  • Your patients

Patients have a right to know that their data is being handled with care but, when it comes to fax, HIPAA compliance falls squarely on your business.

When it comes to sending secure faxes that contain patient medical information, there are basically three steps to the process. First is the in-house storage and handling of medical information. The data needs to be handled securely and stored in an encrypted file system. This means that hackers, even if they were to steal data, would be unable to access and read the data.

When you need to send a fax, however, a whole host of new HIPAA compliance issues can arise. With a traditional fax machine, you may opt to print and then fax the document. Printing this document removes the layer of encryption security as it is now a physical document that can be read by anyone who has it in their hands. Failing to immediately shred or securely dispose of the document after faxing could lead to HIPAA compliance issues. This is why many medical businesses use Internet fax services.

With an Internet fax service, the chain of custody from the encrypted file system to the fax system isn’t broken, which results in a more secure environment for sensitive data. With online fax systems, the document is simply uploaded directly to an encrypted fax server and sent out. This eliminates the need to print documents and reduces the risk of someone’s most sensitive data being handled improperly.

The last part of the process of sending a fax is the actual fax transmission itself. While faxes are generally considered to be secure, there are potential security issues that can arise. Traditional fax machines, for example, could be infected with malware that targets the fax machine’s storage to steal sent transmissions. Some Internet fax services may not offer encryption, which means they could be intercepted by a hacker if you’re operating on an open public wi-fi network or a network that has been compromised by a hacker. Using a fax service that ensures encryption from the point of sending to point of delivery is essential.

Why Are HIPAA Compliant Faxes Important?

There are several reasons why sending compliant faxes is so important. First and foremost, your primary goal should always be to protect the information of your patients in the same way you would want your own personal medical information protected. But the concerns for HIPAA non-compliance go much further than simply losing the trust of your patients.

The penalties for violating HIPAA’s privacy rules are steep. They are meant to be a deterrent for reckless businesses, but even harmless accidents can lead to violations that result in hefty fines. A single HIPAA violation can result in penalties ranging from $100 to $50,000, with an annual maximum of $1.5 million. But the penalties don’t just hit your pocketbook.

In situations where a business has been negligent or refused to fix security issues, criminal charges can also be filed against the business, its owners, and sometimes even the employees of the business. Often times, this will result in a business having to shut its doors permanently. 

Another important reason to comply with HIPAA is that other medical businesses must also comply with the legislation. Failure to comply on your end could mean that your partners refuse to do business with you out of fear that the information they are sending to you is no longer secure. If your business relies on referrals, for example, this could be incredibly damaging.

How to Fax and Meet HIPAA Compliance Requirements

HIPAA compliant faxing concerns both sending and receiving faxes. There are steps your business must take to ensure compliance in both scenarios.

When sending a fax, you need to use a fax service that delivers the right level of security and encryption. Simply signing up for a fax service is not good enough. You need to verify that the online fax service you’re choosing offers encryption for sent faxes. Even though you may have handled the documents correctly, failing to encrypt them can be considered a HIPAA violation and lead to penalties, regardless of whether the data loss was your fault or not.

Simple things like verifying the recipient’s fax number are also important. Sending a fax to the wrong number is an immediate data breach and violation of HIPAA. There are also other things you can do to protect the information within a faxed document where you’re unable to control security upon delivery. For example, including a cover sheet along with your fax can help to conceal the sensitive information contained within the fax itself. This also assists the recipient with filing and storage. 

Working with your partners is an essential part of HIPAA compliance as well. If you’re sending a fax, you need to be sure that the fax will be handled and stored correctly. Are the people you send faxes to also using an online fax solution to receive and immediately store documents in encrypted cloud storage? Do they have their own protocols for handling sensitive information? Verifying this before choosing to send a fax can help ensure security on both ends of the line.

Receiving faxes is equally important. Your partners have entrusted you with sensitive medical information for their clients and it’s your responsibility to handle that information in a manner that’s compliant with HIPAA. 

When using an online fax service, you should look for providers that offer encrypted cloud storage of incoming faxes. This ensures that a fax can’t sit on a fax machine tray, for example, and potentially be stolen or mishandled. In addition, you can set permissions for users within your business that handle incoming faxes and ensure that only certain individuals have the ability to view and file incoming faxes. 

One of the great things about having cloud storage of incoming faxes is that you can instantly download and store documents in the correct storage locations if needed. There’s no need to scan documents and use potentially unsecure equipment for managing faxes.

There are some online fax companies that specialize in offering HIPAA compliant fax. Choosing one of these providers is a great first step to ensuring data security within your business. Not all Internet fax services are made equal and some may not meet the strict requirements for HIPAA compliance. When in doubt, search for an online fax provider that specifically mentions HIPAA compliance and offers encryption to ensure that your business is compliant with HIPAA regulations.


What Is the Penalty for Non-Compliance of HIPAA?

As mentioned, the penalties for non-compliance can be steep. A single infraction can cost your business up to $50,000 and you or your employees may face criminal charges. Beyond that, your business could face serious reputational damage which leads to fewer clients, damaged relationships with partners, and the inability to continue operating your business.

Is Email HIPAA Compliant?

Many people wonder if they can simply use email to remain compliant with HIPAA. One of the reasons so many healthcare organizations use fax is because of the security it provides. Furthermore, a fax can be considered legally binding, which may help to protect you in court in the event of a dispute. Switching to email instead of fax opens up a whole host of security issues and, in most cases, email is not recommended for businesses sharing sensitive information that is bound by HIPAA regulations. Choosing a HIPAA compliant fax service with proper encryption and storage of faxes is a much better option.

Can I Maintain HIPAA Compliance Using Internet Fax Services from a Laptop or Smartphone?

Many online fax services offer the ability to fax from connected devices anywhere using a laptop or mobile app. But are these options still HIPAA compliant? As long as the Internet fax service’s web portal or mobile app offers the same level of encryption, you should remain HIPAA compliant when sending or receiving faxes on-the-go using mobile devices. Of course, you should always run regular malware scans on your devices to ensure that there is no other security issue that may compromise your ability to remain HIPAA compliant.

Is HIPAA Just for Medical Businesses?

HIPAA outlines clear regulations for all businesses that handle someone’s personal and private medical information. This could extend to legal offices that deal with medical cases, pharmacies, and any other business that may handle medical information. In addition, while some businesses may not be bound by HIPAA, they may handle sensitive information that they want to keep secure. Just because an online fax service specializes in HIPAA compliance doesn’t mean that other businesses can’t use the services as well to ensure the best level of security for their clients.

Are All Online Fax Services HIPAA Compliant?

Some people incorrectly assume that all online fax services are HIPAA compliant. This is a huge mistake and could lead to fines or criminal penalties under HIPAA. While there are specialized HIPAA compliant online fax services, they are not necessarily the only options available. Other online fax services with adequate encryption security and storage may also be HIPAA compliant. However, there are some fax services that only offer a basic level of security that may not meet the requirements set out by HIPAA. When shopping for an online fax service, it’s important to confirm the security methods used by the fax service and verify that those security methods meet HIPAA standards.

What Are Other Benefits of Online Fax Services?

HIPAA compliance is just one reason why you should consider HIPAA compliant faxing for your business. The benefits can extend well beyond just security, however. For example, shifting away from physical fax machines that require regular maintenance and supplies will save your business money. Online fax services also offer mobility, so you can send and receive faxes from anywhere. Security is the most important aspect of making the switch. but it is far from the only reason to consider online fax services.

Does Online Faxing Help with Auditing?

Audits may be a regular part of running your healthcare business. These can be stressful experiences but an online fax service can help relieve some of that stress. With online faxing, you have a clear paper trail to support your communications. Faxes are kept in secure cloud storage which can be consulted during an audit quickly and efficiently. There’s no need to search paper folders or dig through poorly optimized digital storage just to find the file you need. In addition, important details like the sender’s fax number and the date the document was sent are retained to help support any audit questions that may arise.

What Are the Benefits of Cloud-Based Fax Storage?

Storing documents can consume space and may even require you to replace digital storage devices over time. With cloud-based storage of faxes, there is no need to maintain your own storage devices or servers. Everything is handled by the Internet fax provider so you can focus on your business. Best of all, you know that the storage is HIPAA compliant rather than having your own storage method scrutinized and maintained at an additional cost to your business. Everything you need is rolled into one simple fee.

How Much Does HIPAA Compliant Fax Cost?

The plans for HIPAA compliant fax services can range depending on the unique needs of your business. Depending on the volume of faxing you’re doing both inbound and outbound, as well as your storage needs, the cost for sending HIPAA faxes is as low as $20 per month and increases from there, up to hundreds of dollars per month for high volume businesses. It’s important to keep in mind that an online fax service may solve multiple needs including storage as well as the elimination of traditional fax machines, monthly fees, maintenance costs, and supplies. 

Many cloud fax services offer cost estimates where you can input your specific needs to get an idea of costs before signing up for a service. You may also wish to look for providers that offer a free trial period where you can experiment with the service to see if it meets your needs.

What Are Some HIPAA Compliant Internet Fax Service Providers?

There are a number of online fax services that offer HIPAA compliant services to healthcare businesses. This is not meant to be an exhaustive list but, rather, a quick overview of some of the top names in the industry that you may wish to consider for your business.


SRFax is a very well-known name in online fax services and has been serving medical professionals for decades. They offer tiered pricing plans that can be tailored to meet the needs of businesses of all sizes. Whether you have a small medical office or a large business, SRFax is a good option to consider because of the company’s security features. With SRFax, you can also create multiple user accounts to help limit who has access to sensitive data and ensure that only the right people are viewing and handling faxes. This can limit the potential for employee error that often leads to HIPAA violations.  Best of all, the pricing for SRFax begins at just $7.95 per month for small businesses and can scale from there to meet any volume you may need to handle.


Innoport is another cloud faxing service that offers HIPAA compliant fax for businesses of all sizes. Their pricing is very competitive, starting at just $9.95 per month for basic needs. You can also set up multiple user accounts with 5 different users having access to the service. This is not as good as the unlimited account offering from other providers but certainly meets the needs of smaller healthcare businesses. 


InterFax is specifically dedicated to healthcare businesses, with many HIPAA compliant features that make running your business easier. The audit trails, automatic deletion of faxes, enterprise user management, and secure servers all make InterFax a great option for businesses that may need to scale up as their operations grow. Servers are housed in secure storage facilities to offer peace of mind and their industry-leading encryption ensures the secure delivery of faxes to users without compromising patient data.