The easiest HIPAA-compliant online fax to set up for a small practice

The easiest HIPAA fax to set up signs the BAA during sign-up, includes a fax number and needs no machine or phone line: at Fax Pigeon, one sign-up in a browser from $4.99 a month billed annually, while SRFax and iFax route the BAA through a contact page, Sfax through an email or a call, and Fax.Plus only on Enterprise.

What makes a HIPAA fax easy to set up?

A HIPAA fax is easy to set up when five things show on the provider's own pages: the BAA is signed in the sign-up itself, a fax number comes with the plan, nothing has to be installed, every person is added at no cost, and the current number moves without a gap.

Each of the five removes a wait or a charge. A BAA that has to be requested holds the first patient document until the provider answers. A per-user plan charges for each new person: WestFax Solo is capped at a single user license, eFax Business includes 5 user licenses and Documo Solo includes 1 user.

Fax Pigeon includes unlimited people on every plan, starting with Basic at $4.99 a month billed annually, or $5.99 month to month, for 200 pages sent plus received. An extra page costs 10¢ on Basic and 5¢ on Standard.

The same checks apply to a solo therapist, a small medical office, a chiropractic or physical therapy clinic and a billing service. Billing is on HHS's list of business associate work, and a business associate needs a BAA with each subcontractor before it shares PHI, so a billing service that faxes for clients needs one with its fax service.

Which fax services sign the BAA during sign-up, and which make you request it?

Fax Pigeon signs the BAA during sign-up, eFax and Documo build it into the agreement a customer accepts, and WestFax signs one with every account, while SRFax, iFax, Fax.Plus and Sfax have the customer request it.

• SRFax's Healthcare Solutions page puts its Request a BAA button under the question "Need us to sign a Business Associate Agreement?", and the button links to its contact page. The SRFax sign-up page lists four steps, Select Plan, Choose Your Number, Contact Info and Payment Info, and a BAA request is not one of them.
• iFax's free BAA is "exclusive for iFax Plus and iFax Pro subscribers," and the iFax BAA page offers it through a Get a Free BAA button that leads to its contact-sales page.
• Fax.Plus offers the BAA on Enterprise only. Its HIPAA setup guide makes requesting and signing the BAA the last of five numbered steps, after buying Enterprise and turning on Advanced Security Controls, and a representative then provides the document for signature.
• Sfax's help center tells a customer who wants a BAA on file to email Sfax support or call.
• WestFax's HIPAA security page says it signs a BAA with every account, "no upsell, no add-on," and offers a countersigned or tailored copy; its Get your BAA button opens a contact page headed Get a Custom Quote.

eFax publishes its BAA as section 24 of its Customer Agreement, entered into by the customer as an authorized user of the Secured Service. Documo's Retail Subscription Agreement says its BAA applies and is incorporated whenever customer data includes PHI. Fax Pigeon's full BAA is public at faxpigeon.com/baa, so it can be read before sign-up, and it is signed during sign-up on every plan, the free first fax included.

What does each provider need before the first fax?

Before the first fax, each provider needs a signed BAA on a plan that carries one, a fax number and a login for each person, and the eight differ on all three.

The table shows what each provider requires before the first fax, in its own words where it states them.

SRFax Healthcare Lite is $12.60 a month, or $128.40 a year, for 200 pages, with extra pages at $0.05. WestFax Solo is $14.99 a month, billed monthly, for 500 pages, and iFax lists Plus at $24.99 a month billed annually for 500 pages. eFax Business is $39.99 a month, or $33.33 billed annually, for 500 pages, and Documo Solo is $25 a month billed annually for 300 pages.

A side-by-side of the lowest prices with a BAA is in which HIPAA fax with a BAA costs least.

How do you set up HIPAA fax step by step?

Setting up HIPAA fax at Fax Pigeon is six steps in a browser, with the BAA signed in the second and the first fax sent in the last.

1. Sign up at faxpigeon.com in any web browser.
2. Sign the BAA during sign-up; its full text is public at faxpigeon.com/baa beforehand.
3. Choose your own fax number, or start a free port of the number you already have.
4. Add everyone who sends or receives faxes, at no added cost, with roles in the shared inbox.
5. Upload a PDF, a Word, Excel or PowerPoint file, or a phone photo; each goes up as it is.
6. Add a cover sheet if the recipient wants one, then send.

Every delivered fax gets delivery proof, and fax from email works on every plan. Sending can start before any plan is chosen: confirming an email allows one fax of up to 10 pages from a shared number, with no credit card, under the same signed BAA, and receiving starts with a paid plan and the practice's own number.

Can you move your current number while you set up?

A practice can move its current number while it sets up: Fax Pigeon ports a number free on every paid plan, started at sign-up or from Settings, and most transfers finish in 5 to 15 business days while the number keeps working with the current provider.

The table shows what each provider's own page says about bringing a number in.

The FCC's porting guide says not to terminate service with the existing company before starting new service, and FCC rules require simple ports, generally a single line, to be processed in one business day. How to port a fax number before you cancel puts the steps in order.

Why does the BAA have to come before the first fax?

The BAA has to come before the first fax because 45 CFR 164.308(b) lets a covered entity have a business associate create, receive, maintain or transmit ePHI for it only after obtaining satisfactory assurances, documented in a written contract under 45 CFR 164.502(e) and 164.504(e).

HHS's cloud computing guidance says a covered entity breaks the HIPAA Rules when it uses a cloud provider to maintain ePHI without a BAA. Only entities that provide transmission services alone, including temporary storage, fit the conduit exception, and a fax service that stores the practice's faxes does more than that. HHS FAQ 237 adds that a business associate cannot self-certify as HIPAA-compliant in place of the contract.

American Psychological Association guidance tells psychologists the same for any platform used for telehealth, scheduling, billing or records that exchanges PHI: obtain a written contract with the vendor that includes a BAA. The setup also belongs in the risk assessment the Security Rule requires, and HHS's Office for Civil Rights and ONC offer a downloadable Security Risk Assessment Tool aimed at medium and small providers.

* Fax Pigeon prices and plan terms as of October 20, 2026. Outside sources were read on October 19, 2026.