HIPAA fax requirements checklist

Six HIPAA requirements apply to a fax of patient information: a permitted purpose, reasonable safeguards, the minimum necessary, a business associate agreement (BAA) with the fax service, an assessment of any misdirected fax and six years of documentation. Every Fax Pigeon plan includes a signed BAA, executed at signup, from $4.99 a month billed annually for 200 pages. The table marks each item as law or as practice policy.

What does HIPAA require when a practice faxes patient information?

The duties fall on covered entities, and a health care provider that bills a health plan electronically is one (45 CFR 160.103). Items 1 to 6 are law, with the method in item 2 left to the practice. Items 7 to 10 are separate questions, answered in one line each.

A practice's wider program, starting with a privacy official and staff training, sits behind these items (45 CFR 164.530(a) and (b)).

Which faxes does HIPAA permit?

Without a patient authorization, a covered entity may use or disclose patient information for its own treatment, payment and operations, and may disclose it for another provider's treatment activities and for the payment activities of the entity that receives it (45 CFR 164.506(c)). HHS confirms a treatment disclosure can go by fax (HHS FAQ 356). Any other fax needs another basis, such as the patient's authorization. Psychotherapy notes need an authorization for most disclosures, treatment included (45 CFR 164.508(a)(2)).

What counts as a reasonable safeguard for a fax?

A covered entity must have appropriate administrative, technical and physical safeguards, must reasonably safeguard patient information from disclosures that break the rules, and must limit incidental ones (45 CFR 164.530(c)). No rule names a method for a fax. HHS gives examples, and they are practice policy: first confirming a rarely used fax number with the intended recipient, pre-programming the numbers a practice uses often (HHS FAQ 482), and keeping the machine in a secure location (HHS FAQ 356).

Does the minimum necessary rule apply to every fax?

No. A covered entity must make reasonable efforts to limit patient information to the minimum necessary for the purpose of a use, a disclosure or a request, and the rule exempts disclosures to or requests by a health care provider for treatment (45 CFR 164.502(b)). Faxes sent under an authorization or required by law are exempt too. The limit does its work on a claim, a prior-authorization request or any other fax to a payer.

What must the BAA with a fax service cover?

A business associate is a company that handles protected health information for a covered entity by creating, receiving, maintaining or transmitting it, and an online fax service that keeps a practice's sent and received faxes maintains them. The practice may let it do that only after obtaining satisfactory assurance, documented in a written contract (45 CFR 164.502(e)). HHS's cloud computing guidance says a covered entity that uses a cloud service to maintain electronic protected health information without a BAA is in violation of the HIPAA Rules.

The contract has required terms (45 CFR 164.504(e)(2)). It sets what the service may do with the information, binds it to the Security Rule's safeguards for electronic information and makes it report to the practice any use or disclosure the contract does not provide for. Every Fax Pigeon plan includes a signed BAA, executed at signup. Online fax services that sign a BAA lists the others.

Which duties follow a misdirected fax?

The Breach Notification Rule presumes that a disclosure the Privacy Rule does not permit is a breach, unless the practice shows a low probability that the information was compromised. The showing is a risk assessment of at least four factors: the nature and extent of the information, who received it, whether it was actually acquired or viewed, and how far the risk was mitigated (45 CFR 164.402). A covered entity must also mitigate, to the extent practicable, any harmful effect it knows of from a disclosure that breaks the rules (164.530(f)).

A breach of unsecured protected health information triggers notice to each affected person, without unreasonable delay and in no case later than 60 days after discovery (164.404). HHS is notified alongside the individuals when 500 or more people are involved, and within 60 days after the calendar year ends when fewer are (164.408). The media hear of it only when more than 500 residents of a State or jurisdiction are involved (164.406).

The burden of proof sits with the practice (164.414(b)), and HHS says to keep the risk assessment or the notices as the record. That is item 6. The Privacy Rule, which the breach rules borrow for documentation (164.414(a)), and the Security Rule each hold required documentation for six years from the date it was created or last in effect, whichever is later (164.530(j)(2), 164.316(b)(2)).

What does a fax service with a signed BAA cost?

Basic is $4.99 a month billed annually ($5.99 month to month) for 200 pages, sent and received combined, with extra pages at 10¢ each. Standard is $9.99 billed annually for 500 pages, with extra pages at 5¢. Every plan includes every feature, among them your own dedicated fax number and unlimited people at no extra cost.

The first fax is free: a confirmed email address, no credit card, one fax of up to 10 pages, under the same signed BAA. The pricing page lists all six plans.

* Fax Pigeon prices and plan terms as of October 11, 2026.