Do you need a BAA with your online fax service?

Yes, when your practice is a HIPAA covered entity and the service keeps your patients' faxes: 45 CFR 164.502(e) lets you share protected health information with it only under a written business associate agreement (BAA). Every Fax Pigeon plan includes a signed BAA, executed at signup, from $4.99 a month billed annually for 200 pages.

Is an online fax service a business associate?

HHS describes a covered entity as a health plan, a health care clearinghouse, or a health care provider that conducts certain billing and payment transactions electronically (defined at 45 CFR 160.103). Under that same section, a business associate is anyone who, for a covered entity and in a function the rules regulate, creates, receives, maintains or transmits protected health information (PHI). That is four verbs, and an online fax account that holds your sent and received faxes does three of them: it receives, transmits and maintains the pages.

HHS's Guidance on HIPAA & Cloud Computing applies that definition to any cloud service a covered entity engages to store or process electronic PHI (ePHI): the provider is a business associate, and the two must sign a BAA. Encryption does not change that. A provider that stores only encrypted ePHI and holds no decryption key is still a business associate, because it maintains the information for the covered entity (question 2).

When is a fax provider only a conduit?

HHS carves out conduits: the postal service, certain private couriers and their electronic equivalents. A conduit moves information and touches it only on a random or infrequent basis, as the transport requires (HHS FAQ 245). Question 3 of the cloud guidance draws the line at transmission-only services, where any storage is a temporary step in the transmission itself. A provider that maintains ePHI for storage is a business associate because its access is persistent.

A fax service with an inbox, a sent folder or an archive keeps faxes after the transmission ends. That puts it in the first row.

Who answers for a missing BAA?

The practice does. The rule is a condition on the covered entity: it may let a business associate create, receive, maintain or transmit ePHI only after obtaining satisfactory assurances (45 CFR 164.308(b)(1)), documented in a written contract (164.502(e)(2) and 164.308(b)(3)). HHS's cloud guidance answers the question directly (question 5): a practice that has a cloud service maintain its ePHI with no BAA in place is in violation of the HIPAA Rules, and the vendor must still meet the rules that apply to it, signed or not.

HHS has settled with practices over this gap. In April 2017 it announced that Center for Children's Digestive Health had paid $31,000 to settle potential Privacy Rule violations: the practice had been disclosing PHI to FileFax, which stored its records, since 2003, and neither party could produce a signed BAA dated before October 12, 2015. Raleigh Orthopaedic Clinic agreed to pay $750,000 to settle potential violations after it handed the records of about 17,300 patients to a potential business partner without first executing a BAA. In both, the party that paid was the practice.

What must the agreement say?

45 CFR 164.504(e)(2) lists the required terms, and 164.314(a)(2) adds the Security Rule's for ePHI. HHS publishes sample provisions that follow the list, and using them is optional. In plain words, the contract has to:

• limit the vendor to the uses and disclosures the contract permits or the law requires
• require safeguards, including the Security Rule's for ePHI
• require the vendor to report unauthorized uses and disclosures, security incidents and breaches
• bind the vendor's subcontractors to the same restrictions
• support patient requests for access, amendment and an accounting of disclosures
• require the vendor to follow the Privacy Rule for any of the practice's obligations that it carries out
• make the vendor's internal practices and records on PHI available to HHS
• return or destroy the PHI at termination if feasible, and extend its protections if not
• let the practice terminate for a material violation

Breach reports run on their own clock. A business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 calendar days after discovery (164.410(b)), and the contract can set a shorter deadline (cloud guidance, question 6). The rules do not expressly require a vendor to open its security practices to a customer's audit, so a practice that wants documentation or audit rights can ask for them in the BAA or other terms (question 10).

Does a HIPAA label replace the BAA?

No. A label is the vendor's claim, and the agreement is what 45 CFR 164.502(e) requires. HHS's Office for Civil Rights does not endorse, certify or recommend specific technology or products (cloud guidance, question 4), so no HHS seal stands in for it either.

Plan pages show the gap. eFax's pricing page labels its Personal plan, $18.99 a month for 200 pages, HIPAA Compliant and lists a Business Associate Agreement on its Business plan, $39.99 a month for 500 pages. The same page says "our Business Plan includes the signed BAA". Fax Pigeon's 500-page Standard plan is $11.99 month to month, with the BAA signed at signup. The plan-by-plan list for every other online fax service is in Online fax services that sign a BAA.

What should be on file before the first fax?

The file should hold the signed agreement for the plan in use, dated before the first patient fax. The Security Rule requires documentation to be retained for six years from the date it was created or last in effect, whichever is later (45 CFR 164.316(b)(2)(i)).

Every Fax Pigeon plan includes a signed BAA, executed at signup, and the free first fax runs under the same agreement. Plans start at $4.99 a month billed annually, and the pricing page lists all six.

* Prices last verified October 7, 2026, at each provider's own site. Fax Pigeon is not affiliated with eFax.