Does HIPAA require SOC 2 for a fax service?

No. HIPAA names no SOC 2 requirement for a fax vendor, and the Security Rule (45 CFR 164.302 to 164.318) never uses the word certification. What the rules require from a fax service that keeps a practice's patient faxes is a written business associate agreement under 45 CFR 164.502(e). Every Fax Pigeon plan includes a signed BAA.

Is HITRUST required for HIPAA compliance?

No. HHS says it 'does not endorse or otherwise recognize' private organizations' Security Rule certifications, and such certifications do not absolve a covered entity of its obligations. HITRUST's e1 certification covers 43 foundational controls and lasts one year, and its description of e1 never mentions HIPAA. The document the rules require is the signed BAA.

Is there a HIPAA certification for fax services?

No. HHS and OCR say they do not certify any persons or products as 'HIPAA compliant,' so a HIPAA seal on a fax service's page comes from the vendor or a private firm. The Security Rule asks each covered entity and business associate for a periodic evaluation of its own security (45 CFR 164.308(a)(8)), done in-house or by an outside firm.

What does HIPAA require a fax vendor to sign?

A written business associate agreement, when the service keeps a practice's patient faxes. 45 CFR 164.502(e) conditions sharing patient information with a vendor on a written contract or agreement, and 164.504(e)(2) lists its terms, including the practice's right to end the contract if the vendor violates a material term. Every Fax Pigeon plan includes a signed BAA.

Is SOC 2 the same as HITRUST?

No. SOC 2 is a CPA firm's assurance report on a service organization's controls, measured against the AICPA's Trust Services Criteria. HITRUST e1 is a validated certification under HITRUST's own framework that lasts one year, and r2 lasts two. HIPAA requires neither one, and neither replaces the signed BAA.

Which HIPAA fax services advertise SOC 2, ISO 27001 or HITRUST?

iFax, Documo, WestFax, eFax, Fax.Plus and RingCentral each print at least one of the three on their own pages, and FaxRx says it advertises none. Fax.Plus ticks ISO 27001 and SOC 2 Type II on all five of its plans and ticks the BAA on its Enterprise plan only.

October 14, 2026

Does a HIPAA fax service need SOC 2 or HITRUST?

No. HIPAA requires 0 SOC 2, ISO 27001 or HITRUST credentials from a fax vendor and 1 written BAA. Every Fax Pigeon plan includes the signed BAA, from $4.99 a month billed annually.

A padlock and a stethoscope resting on a keyboard against a teal background

No. HIPAA requires 0 SOC 2, ISO 27001 or HITRUST credentials from a fax vendor that keeps your patients' faxes, and 1 written business associate agreement (BAA) with it. The Security Rule never uses the word certification, and HHS says it "does not endorse or otherwise recognize" private organizations' Security Rule certifications. A signed BAA comes with every Fax Pigeon plan, from $4.99 a month billed annually.

Does HIPAA certify a fax service?

No. HHS's FAQ on certifying compliance says no Security Rule standard requires a covered entity to "certify" compliance, and that HHS "does not endorse or otherwise recognize" private organizations' certifications. Those certifications do not absolve a practice of its obligations, and an outside firm's certification does not stop HHS from finding a violation later. The Office for Civil Rights (OCR) page on misleading marketing claims says HHS and OCR "do not certify any persons or products as 'HIPAA compliant.'" A HIPAA seal on a fax service's page comes from the vendor or a private firm.

What does the Security Rule ask for instead?

A periodic evaluation. 45 CFR 164.308(a)(8) requires a covered entity or business associate to evaluate its security policies and procedures, and to repeat the evaluation when operations or the environment change in ways that affect electronic protected health information. HHS's FAQ says a covered entity can run that evaluation itself or hire an outside firm. A business associate must follow the Security Rule directly (164.302). Across the rule's nine sections, 45 CFR 164.302 to 164.318, the word certification never appears and no section names SOC 2, ISO 27001 or HITRUST.

What must a fax vendor sign?

A written agreement. 45 CFR 164.502(e) conditions a practice's disclosures to a vendor on a written contract or agreement that records the vendor's assurances, and 164.504(e)(2) lists what that contract must say. Do you need a BAA with your online fax service? covers when a fax service counts as a business associate.

What do SOC 2, ISO 27001 and HITRUST cover?

SOC 2 is a report. A CPA firm issues it under the AICPA's SOC program, and the AICPA's Trust Services Criteria set five categories of control criteria: security, availability, processing integrity, confidentiality and privacy.

ISO/IEC 27001:2022 is a standard. It lays out what an information security management system must contain, and ISO says it issues no certificates: external certification bodies do.

HITRUST e1 is a certification. HITRUST's e1 page describes validated assurance on 43 foundational controls that lasts one year, and its description of e1 never mentions HIPAA. The r2 level lasts two years with an interim assessment after the first, and HITRUST lists HIPAA there as one of 60-plus sources its controls map to.

Which fax services print these claims?

Six of the eight services below print a SOC 2, ISO 27001 or HITRUST claim, and two print none.

Service	What its pages print	Where
iFax	"HIPAA, SOC 2 & ISO 27001 compliant"; the Pro plan's feature list opens with the same three names	Home, HIPAA and pricing pages
Documo	HIPAA, SOC 2 and PIPEDA under "Full certification suite", and a HITRUST e1 Certified badge in the footer	mFax page
WestFax	A HITRUST seal marked "R2 Certified" and a SOC 2 seal marked "Type II Audited"; its plan table ticks HITRUST and SOC 2 on Solo, Team and Enterprise	Home, pricing and security pages
eFax	"HITRUST CSF Certified" and SOC 1 and SOC 2 for eFax Corporate, and HITRUST on its eSignatures	Compliance, pricing and home pages
Fax.Plus	ISO 27001 and SOC 2 Type II ticked on all five plans, Free to Enterprise, and HIPAA and the BAA ticked on Enterprise only	Pricing page
RingCentral	SOC 2, SOC 3, HIPAA and "HITRUST CSF Certified" badges in one row, and trust-center documents for ISO 27001, SOC 2+ and HITRUST listed by product	Fax page and trust center
FaxRx	Says it advertises no SOC 2, HITRUST, ISO 27001 or similar outside certification, and signs a BAA on every plan	llms.txt and HIPAA page
SRFax	No SOC 2, ISO 27001 or HITRUST text, and a BAA on request	Home, plans, FAQ and security pages

On Fax.Plus the ISO 27001 and SOC 2 ticks cover all five plans and the BAA tick covers one. FaxRx advertises no seal and signs a BAA on every plan. WestFax's own FAQ files HITRUST r2 and SOC 2 Type II under certifications validated by independent third parties, and HIPAA under laws its platform is built to meet.

What should a buyer check on a seal?

Check four things on any seal. The scope: eFax's compliance page ties its claims to eFax Corporate, and RingCentral's trust-center documents name RingEX, RingCX, Office and Engage and never mention fax. The categories: WestFax's SOC 2 attests to security, availability and confidentiality, three of the five. The dates: HITRUST e1 lasts one year and r2 two. The report: WestFax's security page says its SOC 2 report is available through your account team, and Alohi, the company behind Fax.Plus, tells customers to request its auditor's report from the Compliance Dashboard inside an account.

Then ask for the signed BAA on the plan you are buying.

Who should switch?

A practice whose current plan carries seals but no signed BAA should switch. Fax Pigeon's BAA is signed at signup on every plan. The pricing page lists all six plans, and Basic is $4.99 a month on annual billing for 200 pages.

* Vendor claims last verified October 11, 2026, at each provider's own site. Regulation text current at ecfr.gov through October 7, 2026. Fax Pigeon prices and plan terms as of October 14, 2026. Fax Pigeon is not affiliated with iFax, Documo, WestFax, eFax, Fax.Plus, Alohi, RingCentral, FaxRx or SRFax.

Frequently asked questions

Does HIPAA require SOC 2 for a fax service?: No. HIPAA names no SOC 2 requirement for a fax vendor, and the Security Rule (45 CFR 164.302 to 164.318) never uses the word certification. What the rules require from a fax service that keeps a practice's patient faxes is a written business associate agreement under 45 CFR 164.502(e). Every Fax Pigeon plan includes a signed BAA.
Is HITRUST required for HIPAA compliance?: No. HHS says it 'does not endorse or otherwise recognize' private organizations' Security Rule certifications, and such certifications do not absolve a covered entity of its obligations. HITRUST's e1 certification covers 43 foundational controls and lasts one year, and its description of e1 never mentions HIPAA. The document the rules require is the signed BAA.
Is there a HIPAA certification for fax services?: No. HHS and OCR say they do not certify any persons or products as 'HIPAA compliant,' so a HIPAA seal on a fax service's page comes from the vendor or a private firm. The Security Rule asks each covered entity and business associate for a periodic evaluation of its own security (45 CFR 164.308(a)(8)), done in-house or by an outside firm.
What does HIPAA require a fax vendor to sign?: A written business associate agreement, when the service keeps a practice's patient faxes. 45 CFR 164.502(e) conditions sharing patient information with a vendor on a written contract or agreement, and 164.504(e)(2) lists its terms, including the practice's right to end the contract if the vendor violates a material term. Every Fax Pigeon plan includes a signed BAA.
Is SOC 2 the same as HITRUST?: No. SOC 2 is a CPA firm's assurance report on a service organization's controls, measured against the AICPA's Trust Services Criteria. HITRUST e1 is a validated certification under HITRUST's own framework that lasts one year, and r2 lasts two. HIPAA requires neither one, and neither replaces the signed BAA.
Which HIPAA fax services advertise SOC 2, ISO 27001 or HITRUST?: iFax, Documo, WestFax, eFax, Fax.Plus and RingCentral each print at least one of the three on their own pages, and FaxRx says it advertises none. Fax.Plus ticks ISO 27001 and SOC 2 Type II on all five of its plans and ticks the BAA on its Enterprise plan only.

Fax Pigeon

HIPAA-compliant fax with a signed BAA on every plan

Plans start at $4.99 a month, billed annually, for 200 pages, with your own number and unlimited people. Your first fax is free.

Free porting of your local number
Fax from your email
AI summary of every inbound fax
E-signatures
Contact management
Delivery proof

Plans and pricing

Know a practice that still faxes? Refer it through the referral program and earn 20% of its plan, every month it stays.