Short answer: HIPAA does not require fax, and it does not make fax safe — the machine is the risk: pages sitting in open trays, misdials with no way to recall them, and no record of who saw what. The pragmatic replacement is cloud fax delivered into a BAA-covered platform: keep your fax number, keep the workflow your referral partners expect, lose the paper. Portals and Direct secure messaging beat fax outright wherever both ends support them.
The fax machine has outlived the pager, the Rolodex, and three generations of the computers beside it — still humming in a hallway, printing patient records into a tray anyone can read. Nobody defends it. Everybody feeds it. This post is about how to stop, without breaking the referral network that keeps you on it.
(This is the fax chapter of our complete HIPAA-compliant communications guide, which walks every channel — texting, calls, voicemail, video, and after-hours coverage. For the channel most practices fix first, start with the HIPAA-compliant texting guide; for what goes on a machine when nobody answers, see HIPAA voicemail rules.)
Why healthcare still faxes
Fax survives in healthcare for one structural reason and one bad reason, and it is worth separating them because only one of them deserves respect.
The structural reason is the referral network. A fax number is the one address every practice, hospital, imaging center, pharmacy, and payer in your orbit already has on file, printed on referral pads and baked into intake software. You cannot unilaterally quit fax any more than you can unilaterally quit having a phone number — the other end of every referral decides how documents arrive. Any replacement plan that starts with "tell four hundred referring providers to use something new" is not a plan.
The bad reason is the “fax is HIPAA-safe” myth. It has a real origin: HIPAA treats fax as a permissible way to disclose patient information, and a traditional paper-to-paper fax is not electronic PHI, so the Security Rule’s technical requirements — encryption, access controls, audit logs — never formally attached to the machine. Somewhere along the way, “the Security Rule doesn’t apply” got remembered as “fax is compliant by default.” It is not. The Privacy Rule applies to every page, and it is exactly the machine’s physical handling — where pages land, who can read them, where they end up — that produces the incidents.
The machine is the liability
Walk to your fax machine right now and look at the tray. That tray is the compliance posture of traditional fax, and it has three problems no policy binder fixes.
- ▸The open tray. Inbound records print into a physical tray in whatever room the machine lives in, and they sit there — readable by staff who have no role in that patient's care, by the delivery driver, by another patient walking past — until someone happens to collect them. That is an access-control problem running continuously, all day, by design.
- ▸The misdial. One transposed digit sends a patient's chart to a stranger's machine, and there is no unsend. Misdirected faxes are one of the most routine impermissible disclosures practices ever have to deal with, and the traditional workflow's entire defense is a cover sheet politely asking the stranger to destroy what they were never supposed to receive.
- ▸No audit trail. When something goes wrong, the machine has no answers. Who sent it, who picked it up, whether it was re-faxed onward, how many copies were made — none of it is recorded. A transmission log of phone numbers is not an access log of people.
Add the operational tax — busy signals, jammed feeds, pages re-sent three times and then scanned into the EHR by hand — and this becomes the rare compliance problem staff are eager to fix, because the compliant replacement is also simply less miserable.
The alternatives ladder
There are three rungs, and they are not competitors — most practices should run two of them at once, for different document flows.
Rung one: cloud fax into a BAA-covered platform — the pragmatic default
Cloud fax keeps the fax number and the fax protocol — the part your referral network depends on — and replaces everything physical about it. Inbound faxes arrive as documents in your platform instead of paper in a tray: routed to the right person, visible only to staff whose role grants access, logged on every open and forward, and searchable when you need last March's referral in under a minute. Outbound, staff send from a screen with a delivery receipt instead of standing at a machine listening to it dial.
To the other end, nothing changed: your referring providers dial the same number and their machine shakes hands with what they believe is yours. That is the whole trick — you modernize your half of the transaction without asking anyone else to change theirs. One requirement is non-negotiable: the moment fax goes digital, those documents are electronic PHI, so the cloud fax service must sign a business associate agreement before the first page moves. No BAA, no PHI — the same rule as every other channel.
Rung two: secure messaging and portals for patient documents
Half of what practices fax should never have been faxed at all, because one end of the exchange is a patient, not a machine. Intake packets, consent forms, insurance cards, records requests — asking a patient to find a fax machine in 2026 is asking them to drive to a public library. Those flows belong in secure messaging and the portal: a text with a secure link, a form completed on a phone, a photo of the insurance card uploaded in ten seconds. The document arrives structured instead of skewed at nine degrees, and content stays behind authentication instead of traveling as loose paper. The consent capture and content rules for that channel are in the texting guide.
Rung three: Direct secure messaging where both ends support it
Direct secure messaging — the encrypted, addressed exchange built into most EHRs for exactly this purpose — is the technically correct answer for provider-to-provider records: encrypted in transit, delivered into the receiving EHR as structured data, no paper stage at all. Its limit is the same network problem fax solved decades ago: it only works when both ends have it set up and someone actually watches the inbox. Use it with the partners who are ready — hospital systems and larger groups increasingly are — and let cloud fax carry everyone else. The ladder is a migration, not a cutover.
The misdial problem, killed properly
On a physical machine, the safeguard against sending a chart to a stranger is a human reading a keypad correctly on the first try, every try, forever. Everything after a misdial is damage control: a risk assessment, a call to whoever received it, potentially a breach notification — all triggered by one transposed digit at the end of a twelve-hour shift. Digital delivery replaces that hope with structure.
- ▸Directories replace keypads. Staff pick the recipient from a stored, verified contact list — the cardiology group is an entry, not eleven digits typed from memory.
- ▸The number gets verified once, not per-send. Confirm a partner's fax number when you add them to the directory, and every future send inherits that verification.
- ▸Delivery is confirmed, not assumed. A send that fails or goes unconfirmed surfaces as a status you can see, instead of a page you believe arrived because the machine beeped.
- ▸Mistakes have a smaller blast radius. A misrouted digital document shows exactly what was sent, when, and to which number — so the risk assessment starts from a record instead of a reconstruction.
Migrating without breaking your referral partners
The single decision that makes the migration boring — in the best sense — is this: keep the fax number and port it to the cloud fax service. Fax numbers port the same way voice numbers do. The day the port completes, faxes sent to the number you have had for fifteen years start arriving as documents in your platform, and not one referral partner has to be notified, retrained, or even told.
- 1.Inventory the flows. A week of watching the tray tells you who actually faxes you and what: referrals in, records out, payer and pharmacy traffic. Each flow gets a rung on the ladder.
- 2.Stand up cloud fax on a temporary number first. Route it, test both directions with a friendly partner, and train the front desk while the old machine still runs.
- 3.Port the real number. Ports take days to a few weeks, and the old machine works until the flip. After it, the number is the same — only the tray is gone.
- 4.Move patient-facing flows off fax entirely. Intake, consents, and card captures go to secure messaging and the portal — the rung patients feel.
- 5.Offer Direct to the partners who can use it, and let everyone else keep dialing the number they know. Unplug the machine; keep the porting paperwork.
What to ask any vendor
Cloud fax is a mature category and the good vendors answer these quickly. A vendor who stumbles on any of them is telling you something.
- ▸Will you sign a BAA, on which plan? If the answer involves an enterprise tier you were not planning to buy, price that tier — it is the real price of the product.
- ▸Where do documents live, and for how long? You want stated encryption at rest, a retention window you control, and real deletion at the end of it — not "indefinitely, for your convenience."
- ▸What are the access controls? Per-user logins and role-based routing, so a hallway tray does not get recreated as a shared inbox everyone can read.
- ▸Show me the audit log. Who viewed, downloaded, forwarded, and deleted each document, exportable when a compliance question lands. This log is the single clearest upgrade over the machine — ask to see a real one in the demo.
- ▸Can you port my existing fax number, and what is the timeline? The keep-the-number migration only works if porting is routine for them. Ask how many they did last month.
One structural note: a standalone cloud fax subscription works, but fax is one lane of the same road as your calls, texts, and voicemail — and running it inside the same BAA-covered platform means one vendor agreement, one audit surface, and one place documents live. That consolidated setup is how we build it for practices: see healthcare for which plans carry the BAA, and the practice communications compliance guide for how fax slots in beside every other channel.
And the boundary worth restating: this post covers the communications layer. The compliance program around it — risk assessments, EHR security, workstation policy, breach response — is IT territory, and our sister company owns that ground: the HIPAA compliance guide for healthcare IT. Read that for the program; read this before you feed the tray again.
Frequently asked questions
Is faxing HIPAA compliant?
Fax is a permitted way to disclose patient information, so faxing is not a violation by itself. Compliance lives in the handling: reasonable safeguards against misdials, pages that do not sit readable in open trays, and some way to answer who accessed a document. Traditional machines make all three of those hard, which is why the machine, not the protocol, is the risk.
Is cloud fax HIPAA compliant?
It can be, with two conditions: the vendor signs a business associate agreement, and the platform provides access controls and audit logging around the documents. Once faxes arrive digitally they are electronic PHI, so the Security Rule applies to them — which is a feature, not a burden, because encryption, per-user access, and audit trails are exactly what the paper workflow never had.
Do I lose my fax number when I switch to cloud fax?
No — port it. Fax numbers transfer to cloud fax services the same way phone numbers transfer between carriers. Your referral partners keep dialing the number they have always had, their machines connect exactly as before, and the only thing that changes is where the document lands on your end.
What should we do if a fax goes to the wrong number?
Treat it as an impermissible disclosure: document what was sent and where, contact the recipient and ask for destruction, and run a risk assessment to determine whether it is reportable. Then fix the workflow, not the person — directory-based sending with verified numbers and delivery confirmation is what actually prevents the next one.
Can we just email documents instead of faxing?
Ordinary email is not encrypted end to end by default, so it is a poor default for patient records. Encrypted email with a BAA-covered provider can work between organizations, but for patient documents a portal or secure messaging link is the better pattern — the content stays behind authentication instead of resting in an inbox forever — and for provider-to-provider exchange, Direct secure messaging or cloud fax is the cleaner lane.