Is faxing HIPAA compliant?

Yes, under conditions. HIPAA permits a covered provider to fax patient information for treatment when it uses reasonable safeguards (45 CFR 164.530(c)), and the practice needs a signed business associate agreement with any online fax service that handles protected health information (45 CFR 164.502(e) and 164.308(b)).

What does HIPAA say about faxing patient records?

HIPAA lets a covered provider share protected health information for treatment without patient authorization, as long as the provider uses reasonable safeguards. HHS lists fax, email and phone as channels for that sharing in its answer to FAQ 482. The same answer says the safeguards may vary with the mode of communication, so the test follows the channel a practice uses.

HHS applies the same test to one physician's office that faxes records to another practice. Its answer to FAQ 356 says covered entities must have reasonable and appropriate administrative, technical and physical safeguards when they fax PHI. It adds that the transfer can be done by fax or by other means.

What counts as protected health information on a fax?

A fax carries protected health information when it contains individually identifiable health information (45 CFR 160.103). The category stays the same across forms. A paper page, an electronic file and a fax transmission all carry PHI when a patient can be identified from the content. A fax cover sheet that names a patient is covered the same way as the pages behind it.

For a list of the fax-specific requirements, read the HIPAA fax requirements checklist.

What safeguards must a practice have for faxing?

A practice that faxes patient records must have administrative, technical and physical safeguards in place to protect the privacy of protected health information (45 CFR 164.530). Under 164.530(c)(2)(i), those safeguards must reasonably protect PHI from intentional or unintentional uses or disclosures that violate the rule. An accidental disclosure falls under the same test as a deliberate one.

HIPAA names no specific steps. It states the result a safeguard must reasonably achieve, and the practice chooses the steps that achieve it. The table lists the requirements a small practice meets when it faxes patient records.

No single safeguard satisfies the rule. The rule asks for administrative, technical and physical safeguards together, and each one must reasonably protect the records it covers.

Does an online fax service need a business associate agreement?

An online fax service needs a business associate agreement with the practice when it creates, receives, maintains or transmits protected health information on the practice's behalf (45 CFR 160.103). An outside service falls outside the practice's workforce, so that definition reaches it.

A practice may give PHI to a business associate only after it obtains satisfactory assurance that the business associate will safeguard the information (45 CFR 164.502(e)(1)(i)). That assurance must be documented in a written contract or other written arrangement that meets 164.504(e) (164.502(e)(2)). For electronic PHI, the Security Rule sets the same condition (45 CFR 164.308(b)(1)).

The contract must set the permitted and required uses and disclosures of PHI by the service. It must also require the service to report any use or disclosure the contract does not provide for, including breaches of unsecured PHI (164.504(e)(2)(i) and (e)(2)(ii)(C)).

Fax Pigeon signs the BAA at signup, so the written contract this section describes is in place before the first fax goes out. The Basic plan costs $4.99 a month billed annually ($5.99 month to month), and the BAA comes with it. The Fax Pigeon business associate agreement is the agreement itself.

Is faxing safer than email under HIPAA?

HIPAA ranks neither fax nor email as the safer channel. Fax and email both appear among the channels HHS lists for treatment sharing, and HHS says the safeguards vary by the mode of communication. The rule asks the same question of each channel: do the safeguards reasonably protect the records?

The Security Rule adds a transmission standard for ePHI sent over an electronic communications network (45 CFR 164.312(e)(1)). An online fax and an email both fall under that standard when they carry ePHI. Encryption in transmission is an addressable specification (164.312(e)(2)(ii)), so the practice assesses whether it is reasonable for its own environment.

A separate page answers whether online fax is more secure than email. For either channel the HIPAA test stays the same. The practice needs reasonable safeguards under 164.530(c), and a business associate contract under 164.502(e) for any outside service that handles the records.

What happens when a fax goes to the wrong number?

A fax sent to the wrong number is a disclosure of protected health information to someone the practice had no right to share it with. The breach notification rule governs that disclosure (45 CFR 164.402). Its breach definition presumes a breach unless the practice can show a low probability that the information was compromised.

The practice weighs four factors: how sensitive the information is, who received the page, whether it was actually viewed, and how far the risk has been mitigated (164.402). The practice must then decide whether the misdirected fax is a reportable breach. The discovery clock starts on the first day the error is known, or would have been known with reasonable diligence (45 CFR 164.404(a)(2)). Individual notice is due without unreasonable delay and within the outer limit set in 164.404(b).

For the fax-specific answer, read HIPAA for a fax sent to the wrong number. A misdirected email is governed by the same rule.

* The regulation text was read at law.cornell.edu and HHS guidance at hhs.gov on October 13, 2026.