How to securely fax medical records from your phone (HIPAA, no app)

To fax medical records securely from a phone, open a fax service that signs a BAA in the phone's browser, add the record as a PDF or a photo of each page, confirm the number, send and keep the delivery proof; Fax Pigeon needs no app and starts at $4.99 a month billed annually.

How do you securely fax medical records from a phone?

Securely faxing medical records from a phone takes a fax service that signs a BAA, opened in the phone's browser, and a phone that locks, encrypts and can be wiped.

The rules differ by who is sending. A provider's office faxes under its BAA with the service and the safeguards HHS names, while a patient sending records from a personal phone is generally outside the HIPAA Rules on that phone. The same steps serve telehealth clinicians, home health and home-visit staff, and anyone faxing from a tablet; the tablet version is in how to fax from an iPad.

Is faxing records from a phone HIPAA compliant?

Faxing records from a phone is HIPAA compliant for a provider when two conditions from HHS's cloud computing guidance hold: safeguards protect the ePHI on the phone and in the cloud, and BAAs are in place with the third-party services involved.

HHS says covered providers may share protected health information for treatment by phone, fax or email without the patient's authorization, as long as they use reasonable safeguards. Its examples for fax are to confirm a number that is not regularly used with the intended recipient first and to pre-program frequently used numbers to avoid misdirecting the information.

The BAA is the condition an app or a website can fail. HHS's audio-only telehealth guidance says a provider must enter into a BAA with a smartphone app's developer before using the app with patients when the app is more than a mere conduit for PHI. A cloud service that stores only encrypted ePHI and lacks the key is still a business associate, and using one to maintain ePHI without a BAA violates 45 CFR 164.308(b)(1) and 164.502(e). HHS and OCR certify no product as "HIPAA compliant," so the signed BAA is what a provider keeps.

What changes when a patient faxes their own records?

When a patient faxes their own records from a personal phone, HHS tells individuals that the HIPAA Rules generally do not protect health information accessed through or stored on their personal phones or tablets.

HHS's Health App Use Scenarios guidance says a consumer's use of an app to send data to a covered entity does not by itself make the app developer a business associate. The FTC adds that HIPAA likely would not apply to health information kept in an app that is not offered by a covered entity or its business associate. The FTC's Mobile Health App Interactive Tool helps app developers learn which federal laws apply to them, and the FTC's consumer page for a patient's own phone is How To Protect Your Phone From Hackers.

The provider's side has rules of its own. HHS says individuals generally have a right to copies of their PHI by mail or e-mail, including unencrypted e-mail when they ask for it, after a brief warning from the provider; that FAQ does not name fax. A patient can also ask a provider to send records to someone else, and HHS says the provider may accept a faxed or mailed copy of the signed request, a PDF or scanned image, or an electronically signed one. HHS also says providers are not responsible for the information once it is delivered to the individual, and it applies that statement and the one on signed requests only as far as a federal court's order allows. Under 45 CFR 164.524(b)(2), the provider must act on an access request within 30 days.

What are the ways to fax from a phone?

The ways to fax from a phone are a browser fax service with a BAA, a consumer fax app without one, email to fax through the browser service, and a photo printed and sent from a fax machine, and the browser service and its email route are the two with a signed BAA and delivery proof.

The table shows what each way needs and whether it suits medical records.

How do you send a fax from your phone, step by step?

Sending a fax from a phone takes seven steps in the phone's browser, ending with the photos deleted from the phone.

1. Open the fax service in the phone's browser and sign in; Fax Pigeon needs no app.
2. Add the record as a PDF if it already exists as one, such as an EHR export.
3. Photograph paper only when no PDF exists, one photo for each page, flat and in good light.
4. Add a cover sheet if the recipient wants one; at Fax Pigeon it is optional.
5. Enter the fax number and read it back against the number the recipient gave.
6. Send, then keep the delivery proof with the record.
7. Delete the photos from the phone, then clear them from Recently Deleted or the trash.

Before any plan, a confirmed email lets Fax Pigeon send one fax of up to 10 pages from its shared number under the same signed BAA, no credit card needed; receiving takes a paid plan with the practice's own number.

What should the phone itself do?

The phone itself should lock with a passcode of at least 6 digits, keep its encryption on and have remote wipe turned on, the settings the FTC and HHS's Office for Civil Rights name.

OCR's October 2017 newsletter on mobile devices warns that a lost or stolen phone holding unsecured ePHI can lead to a breach that could trigger notification, and tells covered entities to install or enable encryption, anti-virus or anti-malware software and remote wipe. Under 45 CFR 164.402, a disclosure the Privacy Rule does not permit is presumed a breach unless a risk assessment shows a low probability of compromise. HHS's breach guidance treats encryption of data at rest as valid when it is consistent with NIST Special Publication 800-111.

A photo of a record is a copy of the record, and deleting it is not final. An iPhone or iPad keeps a deleted photo in Recently Deleted for 30 days, Google Photos keeps it in the trash for 30 days, and with iCloud Photos a delete on one device deletes it on the others. HHS advises patients to remove health information, photos included, from a phone once it is no longer needed.

How do you prove a fax from your phone arrived?

Proof that a fax from a phone arrived is the delivery proof the fax service records, and at Fax Pigeon every delivered fax gets one.

The Indian Health Service's manual for its own staff tells them to confirm a transmission by calling the intended recipient or by checking the fax machine's Fax Activity Confirmation report. The same manual has its staff fill out a cover sheet before sending any PHI, showing at least the facility, the date of transmission and the number of pages including the cover sheet. How to tell if a fax went through explains what a delivery record shows, and what to do after a misdial is in what HIPAA requires when a fax goes to the wrong number.

* Fax Pigeon prices and plan terms as of October 19, 2026. Outside sources were read on October 19, 2026.