HIPAA fax audit trail requirements

Three Security Rule provisions govern a fax service's audit trail: audit controls (45 CFR 164.312(b)), regular review of activity records (164.308(a)(1)(ii)(D)), and six years of retained documentation (164.316(b)(2)). The rule lists no log fields, so ask a vendor to show five facts for any fax: who sent it, to which number, when, how many pages, and who opened it.

A fax service that stores faxes for a covered entity is bound by all three. A paper-to-paper fax machine sits outside the Security Rule, and an online fax inbox sits inside it.

What does the Security Rule require of a fax service?

A covered entity includes a provider that bills a health plan electronically (45 CFR 160.103). A fax service that keeps a covered entity's faxes maintains electronic protected health information (ePHI) for it, which makes the service a business associate. HHS limits the conduit exception to transmission-only services, with storage that is temporary and incident to the transmission, and says a service that maintains ePHI to store it is a business associate (cloud computing guidance, question 3). Each provision below binds a "covered entity or business associate", so the service answers to the Security Rule directly, and its business associate agreement (BAA) must provide that it will comply (45 CFR 164.314(a)(2)(i)).

The rule leaves the design to each regulated entity, which weighs its size, technical infrastructure, costs and risks (45 CFR 164.306(b)). HHS says the Security Rule does not identify the data audit controls must gather or how often the reports are reviewed (the January 2017 cybersecurity newsletter on audit controls from HHS's Office for Civil Rights, OCR). The interval in the text is one word: "regularly".

Does a paper fax machine need audit controls?

Not for a paper-to-paper fax. The definition of electronic media in 45 CFR 160.103 leaves out certain transmissions, including of paper via facsimile, when the information "did not exist in electronic form immediately before the transmission." HHS applied the exclusion to paper-to-paper faxes when it adopted the rule, said they are not covered, and said a fax machine with memory is still not a computer (68 Fed. Reg. 8334, 8342). HHS's summary of the Security Rule states the result: the rule does not apply to protected health information (PHI) kept on paper or spoken aloud.

The page is still PHI. The Privacy Rule requires a covered entity to have appropriate safeguards for it (45 CFR 164.530(c)), and HHS's examples for a fax machine are confirming the number before sending and keeping the machine in a secure location (HHS's FAQ on faxing patient information). The audit-control standard also still applies to any other system that holds ePHI, an EHR for one.

An online fax works the other way. A fax sent from a browser starts as a file, so the exclusion does not apply to it. A fax that lands in an online inbox is stored by the service, and ePHI includes PHI "maintained in electronic media" (45 CFR 160.103).

Is a fax confirmation page an audit log?

No. A confirmation page is a transmission record: the number, the time, the page count and whether the fax went through. It covers one event. An audit trail covers the activity around it.

OCR's newsletter, citing NIST, defines an audit log as a record of events and an audit trail as the audit logs of applications, users and systems together. Its examples include the log-on ID, the date and time of each log-on, and the creating, reading, editing and deleting of records that hold ePHI. A confirmation page shows the transmission and nothing about who touched the fax afterward.

The newsletter says why that matters. Audit logs help with reviewing inappropriate access, tracking unauthorized disclosures of ePHI and providing evidence when a security incident or breach is investigated.

What should a fax vendor show for each fax?

The rule lists no fields, so these five are a buyer's checklist. The first, third and fifth follow HHS's audit-trail examples for any ePHI system: who acted and when, and which record they opened. The number and the page count are what a fax adds. HHS also says the HIPAA Rules do not expressly require a cloud service to let customers audit its security practices, and that customers may require added assurances through the BAA or other documents (cloud computing guidance, question 10).

1. Who sent it. The individual user, by name or user ID, with the account they belong to. The Security Rule requires a unique name or number for tracking each user (45 CFR 164.312(a)(2)(i)).
2. To which number. The destination fax number.
3. When. The date and time of the send.
4. How many pages. The page count.
5. Who opened it. Each person who viewed or downloaded the fax after it arrived, and when.

Pick any fax and ask for all five.

How long are audit records kept?

Six years is the rule's number, and it attaches to documentation. Section 164.316(b)(1) covers the written policies and procedures and a written record of any action, activity or assessment the Security Rule requires to be documented. Section 164.316(b)(2)(i) keeps that documentation for six years from the date it was created or last was in effect, whichever is later, and HHS calls that the minimum retention period for required documentation (HIPAA Security Series #5).

For activity review, OCR's audit protocol asks for the review procedures, how often a review runs, and documentation of the records that were reviewed and who reviewed them. Section 164.316 sets no separate period for the raw logs. How long a vendor keeps them is a term in the vendor's own paperwork, so read that line before you sign.

What does every Fax Pigeon plan include?

Every plan includes a signed BAA, executed at signup, and a delivery certificate for every delivered fax. The shared inbox has roles and assignment, and unlimited people use it at no extra cost. How the inbox works is in Shared fax inbox for a small office. Basic is $4.99 a month billed annually for 200 pages, and every plan has every feature. All six plans are on the pricing page.

* Fax Pigeon prices and plan terms as of October 12, 2026.