Is eFax HIPAA compliant?

The short answer: it can be. eFax is one of the oldest names in online fax, and it offers HIPAA-oriented service with a Business Associate Agreement on qualifying plans; eFax Corporate serves larger organizations. If you are evaluating it for a practice that handles Protected Health Information, the question is not whether eFax can be HIPAA compliant. It is whether you can verify the agreement before you pay, and what the compliant configuration costs you.

What HIPAA actually requires from a fax vendor

A fax service that transmits PHI on your behalf is your business associate under HIPAA. That means three things must be true before the first page:

1. A signed Business Associate Agreement between your practice and the vendor. Without it, routing PHI through the service is a compliance failure on your side, regardless of how secure the service is.
2. Real safeguards behind the agreement: encryption in transit and at rest, access controls, and audit logging.
3. Your own practices: who in your office can see faxes, how you confirm numbers before sending, how long you keep records.

No vendor is "HIPAA certified." There is no such certification. What you can do is read the BAA, check the safeguards the vendor documents, and keep your own house in order.

The documented catch with eFax

HIPAA Journal, the independent compliance publication, has reported that eFax's BAA could not be reviewed without first committing to a subscription. That matters because the BAA is the whole legal foundation: its terms decide what the vendor may do with your data, what happens after a breach, and what limits apply. An agreement you cannot read before paying is an agreement you are trusting on reputation.

As of September 4, 2026, eFax's pricing page names the signed BAA on eFax Business at $39.99 a month ($33.33 on annual billing); eFax's own copy says the Business plan "includes the signed BAA required for healthcare providers to remain fully compliant." The $18.99 Personal plan is labeled "HIPAA Compliant" on the same page. The former eFax Protect plan no longer appears on the pricing page and its address redirects. If you evaluate eFax: confirm in writing which plans carry the agreement, and read it before you pay. The full comparison is in Fax Pigeon vs eFax.

How to verify any fax vendor in ten minutes

• Search for the vendor's BAA. If you can read the full text without an account, that is a good sign. If it is "available on request," request it and wait for the document before paying.
• Check which plan the BAA covers. Several well-known services sell their cheapest plans without a BAA and gate the agreement to a higher tier.
• Confirm the safeguards page mentions encryption in transit and at rest and audit logging.
• Confirm the exit: what does it cost to port your number out if you leave?

Where Fax Pigeon stands

We built for exactly this verification moment. Our Business Associate Agreement is public at faxpigeon.com/baa: the full text, readable before you create an account, and included on every plan, even the free first send. We run our own fax transmission servers, so documents are never handed to the phone carrier as files to hold, and every plan carries encryption in transit and at rest with an append-only audit log. Plans start at $4.99 per month billed annually for 200 pages. The details are on the HIPAA section and the pricing page.

Fax Pigeon is not affiliated with eFax or HIPAA Journal. eFax plan facts above were read at efax.com on September 2, 2026; verify current terms at the source before relying on them.