Which online fax services sign a BAA? The 2026 list, plan by plan

Fax Pigeon and WestFax include a signed BAA on every plan. eFax includes it from Business, iFax on Plus and Pro and Fax.Plus on Enterprise only. SRFax provides one on request, and Sfax prints "BAA Available" from Plus up. Their cheapest BAA plans run from $4.99 a month billed annually at Fax Pigeon to $79.99 a month at Fax.Plus.

HHS treats an online fax service that stores a practice's faxes as a business associate, so the signed BAA has to be in place before the first fax.

Which online fax services sign a BAA?

Seven leading online fax services sign a BAA: Fax Pigeon and WestFax on every plan, eFax on Business and up, iFax on Plus and Pro, Fax.Plus on Enterprise only, Sfax where its plan cards print "BAA Available" and SRFax on request.

For each of the seven leading providers, the table gives the plans that carry the BAA, how it is signed and the people each plan includes.

Fax Pigeon has no team plans: every plan includes unlimited people.

Do you need a BAA with an online fax service?

A practice needs a BAA with its online fax service, because HHS says a cloud service provider that creates, receives, maintains or transmits electronic PHI on a covered entity's behalf is a business associate under HIPAA. HHS's cloud computing guidance adds that this "is true even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data," and that a covered entity that has a cloud provider maintain ePHI without a BAA "is in violation of the HIPAA Rules."

The conduit exception is too narrow to cover an online fax service that keeps faxes. HHS limits it to "entities that only provide transmission services for PHI," including any temporary storage, and the 2013 Omnibus Rule preamble (78 FR 5566, 5571-72) calls it "a narrow one" meant for mere courier services such as the U.S. Postal Service or United Parcel Service and their electronic equivalents. HHS FAQ 2077 adds that a provider that both transmits ePHI and stores it is still a business associate for the transmission.

The BAA is signed with the fax service. HHS says a covered entity needs no BAA to disclose PHI to a health care provider for treatment, and HHS FAQ 356 says that disclosure "can be done by fax or by other means." The rule text behind each point is in Do you need a BAA with your fax service?

Which services include the BAA on every plan, and which reserve it for higher plans?

Fax Pigeon and WestFax include the BAA on every plan, while eFax reserves it for Business and up, iFax for Plus and Pro and Fax.Plus for Enterprise, and Sfax prints "BAA Available" from its Plus card up. The plans below those carry none: eFax Personal, iFax Basic, and Fax.Plus Basic, Premium and Business.

The table prices the cheapest plan that carries a BAA at each of the seven leading providers, for one person at 500 pages a month.

Billed annually, the cheapest plan with a BAA at 500 pages costs $43.92 a year more at SRFax than at Fax Pigeon, $180.00 more at iFax, $280.08 more at eFax and $562.08 more at Sfax. WestFax bills month to month only, and Solo runs $36.00 a year more than Fax Pigeon Standard billed the same way.

Prices at 200 pages, with the fees a price card leaves off, are compared in HIPAA fax prices with a BAA at 200 pages.

How does each leading provider sign its BAA?

The seven leading providers sign the BAA in six ways: at sign-up (Fax Pigeon), with every account (WestFax), as an addendum to its Customer Agreement (eFax), through a sales form (iFax), in the account on Enterprise (Fax.Plus) and on request by button, email or phone (SRFax, Sfax).

Fax Pigeon signs the BAA at sign-up on every plan, including the free first fax, which goes out from a shared number under the same signed BAA. The full agreement is public at faxpigeon.com/baa, so it can be read before paying, and every paid plan sends and receives from the practice's own number.

SRFax provides its BAA on request. Its Healthcare Solutions plans page asks "Need us to sign a Business Associate Agreement?" and answers with a Request a BAA button, and SRFax publishes no BAA price. Every Healthcare plan includes multiple user accounts and counts pages sent and received together.

eFax includes the signed BAA on its Business plan, and the agreement itself is section 24 of the eFax Customer Agreement. The eFax pricing page prints "our Business Plan includes the signed BAA," and the eFax HIPAA compliance page names eFax Business, eFax Corporate and eFax Unite as covered.

iFax gives a free BAA only to Plus and Pro subscribers, according to its plan trial page, through a contact-sales form.

Fax.Plus includes a BAA on Enterprise only; its pricing page says "HIPAA compliance with BAA is available on the Enterprise plan only." An Enterprise account turns on Advanced Security Control under Settings, Security, HIPAA and chooses Request BAA, and a representative then provides the BAA for signature, according to the Fax.Plus help center. Enterprise includes 4,000 pages.

WestFax signs a BAA with every account at no added cost. Its pricing page states "Every plan is HIPAA compliant with a signed BAA," and a contact form gets a countersigned or tailored copy.

Sfax prints "BAA Available" on its Plus, Contender and Enterprise cards, and the Standard card does not carry the line. The Sfax help center says a customer who wants a BAA on file emails or calls Sfax support.

Which other fax services sign a BAA, and on what terms?

Sixteen more fax services state BAA terms on their own pages: seven include a BAA with every plan or account, two sell it as an add-on, four provide it on request or by form, two sign one per fax and Doximity writes it into its terms of service.

The table gives each one's BAA terms and its cheapest plan with a BAA, as printed.

OneFaxNow includes the BAA only in HIPAA Mode, and TidyFax sends outbound faxes only, with no incoming fax number.

Doximity's DocFax page names four professions; therapists, counselors and social workers are not among them. Section 3.1 of Doximity's BAA lets Doximity use machine learning, large language model and generative AI technologies in connection with PHI, and section 3.2 lets it commercialize de-identified data for any lawful purpose.

Which fax services publish no BAA?

Dropbox Fax, MetroFax, CocoFax and HumbleFax publish no BAA with any plan, and their terms of service restrict protected health information instead.

• The Dropbox Sign Terms of Service govern Dropbox Fax and bar protected health information "unless Customer and Dropbox separately enter into a HIPAA Business Associate Agreement."
• MetroFax's terms say the customer agrees not to use the services to store protected health information.
• CocoFax's terms say that without a written agreement CocoFax is not a "Business Associate" as HIPAA defines it, and its HIPAA page says a customer can enter a BAA but names no plan or price for one.
• HumbleFax's terms say that, unless a HIPAA BAA document is signed, the customer agrees not to impose independent obligations on the company when storing protected health information.

How do you check a BAA before you pay?

A practice can check a BAA before paying wherever the provider publishes the agreement: Fax Pigeon's full BAA is public at faxpigeon.com/baa, eFax's is section 24 of its Customer Agreement, and Documo and RingCentral post theirs as PDFs.

Read it against 45 CFR 164.504(e), the list of what a business associate contract must contain. The contract must establish the permitted and required uses and disclosures of PHI, and it must require the business associate to report any use or disclosure the contract does not allow, breaches of unsecured PHI included. 45 CFR 164.410(b) sets the outer limit for that breach notice at 60 calendar days after discovery.

eFax's published BAA says notice comes "as soon as reasonably practicable" and sets no number of days, and Documo's says it will "immediately report" breaches and improper uses or disclosures. eFax may amend its BAA by posting an updated one, Documo's lets Documo amend it unilaterally, and RingCentral's can be amended only by a document both parties execute.

A BAA signed online counts. HHS says a business associate contract in electronic form can qualify as a written document if it satisfies state contract law, and HHS and OCR certify no product as "HIPAA compliant," so a badge on a pricing page is no substitute for the signed agreement.

Who should switch to a plan with a BAA included?

A practice should switch when its current fax plan has no signed BAA behind it, as on eFax Personal, iFax Basic or Fax.Plus Basic, Premium and Business. The same holds when the signed copy cannot be found, or when each added person raises the bill, as the $10 a month for each eFax Business user past 5 does. Among the seven providers in the price table, the lowest price with a BAA at 500 pages a month is Fax Pigeon Standard, at $9.99 a month billed annually or $11.99 month to month.

* BAA terms and prices last verified October 19, 2026, at each provider's own site, except SingleFax, whose terms and prices were last verified October 7, 2026. Fax Pigeon is not affiliated with any provider named here.