Is Updox HIPAA compliant?

Updox calls its eFax HIPAA compliant, and its Master Service Agreement carries a business associate agreement (BAA) as Exhibit A. The Fax Services Addendum in the same agreement has the customer agree not to store protected health information in the fax service, and it limits liability to $50. Updox prints no price on its pricing page, where each plan card ends in a Schedule Demo button. Fax Pigeon sells HIPAA fax with a BAA signed at signup on every plan, so treat this page as a seller's reading of Updox's contract.

Where is Updox's BAA, and how does a customer accept it?

Updox's Master Service Agreement, last modified September 28, 2026, carries the BAA as Exhibit A. The BAA amends the agreement and becomes part of it, and its two parties are the customer and Updox LLC. A customer accepts the agreement by executing a service order that references it or by using Updox's services. Exhibit A has no signature block and names no plan.

The BAA applies to the extent Updox is the customer's business associate under the agreement. Section 12 of the BAA says Updox is not liable for a violation of HIPAA, the BAA or the agreement, or for a use or disclosure of protected health information (PHI) in violation of them, caused by anyone other than Updox, including third-party vendors the customer selects for services related to the agreement. Updox's pricing page and security statement do not mention a BAA. Its privacy policy, which section 25 lists among the documents that make up the entire agreement, says PHI that Updox receives or creates as a business associate is governed by HIPAA and the applicable BAA.

The agreement's opening paragraph lets Updox update its terms. A customer has 30 days to reject an update in writing, and continued use after that counts as acceptance.

What does Updox's fax addendum say about PHI?

The addendum applies when a customer orders fax services. Section 2.7 of the agreement refers to a Faxing Services Addendum attached as Exhibit D and says the faxing services may come from a third-party service provider. The addendum on the page is headed Exhibit B. Four of its clauses bear on PHI:

• Section 2, item 7: the customer agrees "not to use the Fax Service to store any 'protected health information'" as HIPAA uses that term.
• Section 2: the addendum calls the fax service a passive conduit for information the customer chooses to send and receive, and it makes the customer solely responsible for the contents of its transmissions.
• Section 4: the service provider takes no responsibility if a fax or email message is deleted or never stored.
• Section 5: the liability of Updox and the service provider to the customer or any third party is limited to $50, and indirect, incidental, punitive, special and consequential damages are excluded.

The agreement adds three terms of its own. Section 11 caps Updox's maximum liability at the fees the customer paid it in the 3 months before the event. Section 3.1 says the service does not replace the customer's own backups, and section 8.3 has customer content kept for 30 days after the agreement ends and then destroyed.

What does HHS say about the conduit exception?

Updox's addendum describes the fax service as a passive conduit, and HHS recognizes a conduit exception to the business associate definition. That definition in 45 CFR 160.103 includes a person that provides data transmission services for PHI to a covered entity and requires routine access to it. HHS's 2013 final rule calls the conduit exception narrow, meant for mere courier services and their electronic equivalents, and says the line between a conduit and a business associate depends on the facts of the service. The exception covers transmission and any temporary storage incident to it. An entity that maintains PHI for a covered entity is a business associate even if it never views the information (78 Fed. Reg. 5566, at 5571 to 5572).

A covered entity needs satisfactory assurances, documented in a written contract or other arrangement, before a business associate handles electronic PHI (45 CFR 164.308(b)). Do you need a BAA with your online fax service covers when a fax service needs one.

What does Updox's eFax page say?

The eFax page says Updox eFax is HIPAA compliant. Two of its FAQ answers mention a BAA, both about HIPAA-compliant fax service in general, and neither says Updox signs one. The page describes eFax as digital document transmission and storage and mentions one inbox for faxes in both directions.

How does Updox compare with Fax Pigeon?

Updox's plan cards bundle fax pages with telehealth sessions, appointment reminders and messages, and none prints a period for its allowance. The pricing FAQ's bundle example is a plan of 1,000 electronic faxes, sent and received, and section 7.1 of the agreement sets fees in each service order. The table lines the plans up by fax page count.

On every Fax Pigeon plan the BAA is signed at signup.

What could change the answer?

Section 1 puts fees and any additional terms in each service order. Section 25 ranks a service order first, the BAA second and the agreement third, and section 13 of the BAA says its terms override any conflicting term of the Service Agreement. A service order with other terms, or an updated addendum, would change what this page reports.

Who should switch from Updox?

A practice that sends PHI by fax and wants a BAA signed at signup on every plan, with each plan's price printed on the plans page, should switch. Fax Pigeon's plans start at $4.99 a month billed annually for 200 pages. The list of online fax services that sign a BAA compares the rest.

* Prices last verified October 11, 2026, at each provider's own site. Fax Pigeon is not affiliated with Updox.