How to get a HIPAA-compliant fax number for a private practice

A HIPAA-compliant fax number is a number on a fax service that signs a BAA with the practice, since HHS certifies no product as HIPAA compliant; the practice takes a new number or ports the one it has, and at Fax Pigeon the BAA is signed at sign-up, porting is free and plans start at $4.99 a month billed annually.

Getting the number takes five steps:

1. Choose a fax service that signs a BAA on the plan the practice will use.
2. Read the BAA before paying; Fax Pigeon's is public at faxpigeon.com/baa.
3. Take a new number, or start a port of the number the practice already has.
4. Keep the old line and account open until the number moves.
5. If the number changed, update payers, directories and the NPI record.

What makes a fax number HIPAA compliant?

A fax number is HIPAA compliant when the service behind it signs a BAA with the practice and safeguards the faxes it keeps, because HHS certifies no product as compliant and treats a cloud service that stores ePHI as a business associate.

HHS's guidance on misleading marketing claims says HHS and OCR "do not certify any persons or products as 'HIPAA compliant.'" HHS's cloud computing guidance adds that lacking the encryption key does not exempt a cloud service from business associate status, that the conduit exception is limited to transmission-only services, and that maintaining ePHI with a cloud provider without a BAA violates the HIPAA Rules. Under 45 CFR 164.502(e), the practice documents the provider's assurances in a written contract that meets 45 CFR 164.504(e).

The Security Rule sets what the service does with the faxes. Its audit controls standard requires mechanisms that record and examine activity in systems that hold ePHI, and its transmission security standard lists encryption as an addressable specification, under 45 CFR 164.312. Fax Pigeon is HIPAA-compliant online fax for practices of any size, from a solo office to a team of 100 or more, with the practice's own number on every paid plan and unlimited people on every plan.

Should you take a new number or port the one you have?

A practice ports the number it has when payers, referring offices and directories already list it, and takes a new number when it has none, because every listing of a changed number has to be updated.

The NPI application and update form, CMS-10114 (Rev. 07/2026), has a Business Fax Number field, and its signer agrees to notify the NPI Enumerator of any change within 30 days of the change taking effect. An e-prescribing enrollment can ask for a fax number, as covered in whether a practice needs a fax number for e-prescribing. The same choice comes up for a new practice with no number, a practice moving a number off a fax machine or phone company, one leaving another online fax service and a telehealth practice with no office.

A new number has terms of its own. Fax.Plus says a number assigned from its number pool cannot be ported out or purchased, and eFax's Customer Agreement prohibits moving the number eFax assigned to another provider, and its port-out conditions are written for numbers the customer ported in. WestFax charges its $20 one-time fee per number whether the number is ported or new.

What does it cost to port a fax number, provider by provider?

Porting a fax number in is free at Fax Pigeon on every paid plan and free at Fax.Plus, while WestFax charges $20 per number, SRFax $25.00 for a local number and eFax $40 per number.

The table shows what each provider charges to bring a number in and what its page says about timing or plan.

The Fax.Plus row needs both conditions read together. Its pricing page requires Premium or higher to port a US or Canadian number, and the same page says "HIPAA compliance with BAA is available on the Enterprise plan only," so a ported number on Premium or Business has no BAA behind it.

How long does a port take?

A port takes 5 to 15 business days for most transfers at Fax Pigeon and usually 2 to 4 weeks at Fax.Plus, even though FCC rules require carriers to complete a simple port within one business day.

Under 47 CFR 52.35, a simple port must be completed within one business day and a non-simple port within four business days, unless the new provider or the customer asks for longer. A simple port, the FCC's 2009 porting-interval order explains, covers a single line with no complex switch translations and no reseller. Business days run Monday through Friday, and a simple port can activate at midnight the same day only if an accurate and complete Local Service Request reaches the current provider between 8 a.m. and 1 p.m. local time.

The difference is the work before that clock starts. The FCC's one business day runs from an accurate and complete request, while the providers' ranges also cover preparing it, matching the account details and any rejection along the way. Fax.Plus says the details on the Letter of Authorization must match exactly what the current provider has on file and that mismatches are the most common reason ports are rejected; SRFax says a port can finish sooner with no rejections or requests for more information. What the authorization letter needs is in what a letter of authorization for porting is.

What must the BAA behind the number cover?

The BAA behind the number must contain the terms 45 CFR 164.504(e) requires, from the permitted uses of PHI to its return or destruction when the contract ends.

The table shows what seven of the required terms look like in a fax BAA.

HHS publishes sample business associate agreement provisions and says they are sample language only, not required for compliance. Fax Pigeon's BAA is signed at sign-up on every plan and can be read in full before paying.

What do you do with the old provider and the old number?

The old provider stays in place until the number has moved, and then the practice closes the account, asks for the PHI back or destroyed, and files the old BAA.

1. Keep the old account open until the port completes; the FCC advises against ending service before the new service starts.
2. Download the faxes the practice needs before canceling.
3. Cancel, then ask the provider in writing to confirm it returned or destroyed the PHI it still holds, which a BAA must provide for at termination, if feasible.
4. File the old BAA with the compliance records for 6 years from the date it was created or last in effect, whichever is later, under 45 CFR 164.316.
5. If the number changed, update payers and directories, and report the change to the NPI record within 30 days.

Leaving carries its own terms at some providers. eFax requires written notice no later than 30 days after the account ends to port out a number the customer ported in, plus an administrative fee of $40 per number. SRFax warns that a ported number stops working for any fax machine, DSL service, point-of-sale terminal or security system on the old landline. Every step, in order, is in the checklist for porting a fax number before canceling the old service.

* Fax Pigeon prices and plan terms as of October 19, 2026. Outside sources were read on October 19, 2026.