HIPAA compliance

Shared responsibilities

Our role under HIPAA

For a clinic’s receiving number or intake page, the BAA is with the clinic for the services SingleFax provides on its behalf. A separate outbound service for another covered provider requires its own appropriate BAA. A patient using SingleFax independently for personal records does not need a BAA solely because the records are medical.

When a Covered Entity (CE) or upstream Business Associate (BA) engages SingleFax to transmit documents that include PHI/ePHI, SingleFax acts as a Business Associate (or subcontractor BA) under 45 C.F.R. § 160.103. We create, receive, maintain, or transmit PHI solely to perform the Services described in our Terms and BAA, primarily fax transmission, temporary processing storage, delivery status, receipts, and compliance recordkeeping.

• We do

  Transmit Customer-submitted documents; apply HIPAA-mode technical controls; execute and retain BAA records; purge PHI media per retention policy.

• We do not

  Practice medicine; decide treatment; sell PHI; use PHI for our marketing; or replace your Notice of Privacy Practices or workforce training.

When to use HIPAA Secure

Use HIPAA mode whenever the document contains PHI/ePHI and you are a CE or BA transmitting on behalf of a CE. Standard pay-per-fax is for non-PHI business documents (and for individuals sending their own records). Personal senders may optionally choose Enhanced Privacy at the same secure-send prices without a BAA. The role you are acting in determines the agreement requirement; OCR does not determine it.

Enhanced Privacy uses the secure document retention, privacy-safe notifications, and securely stored transmission receipts without an organization BAA. It is optional for personal use and does not provide end-to-end encrypted fax delivery or control the recipient’s handling of the fax. Standard uploads are encrypted too; a premium label does not imply that standard sending has no safeguards.

OCR may show an advisory health-information reminder. It does not select your sending role, change your price, or establish compliance. Covered providers and business associates must accept the BAA before uploading patient information. Personal senders choose their privacy option without signing a clinic’s BAA.

Business Associate Agreement

Before any upload on behalf of a covered provider or business associate in HIPAA Secure, an authorized signer for your legal entity must electronically accept our Business Associate Agreement. Acceptance is organization-scoped, versioned, and recorded with document digests and attestation checkboxes (authority to bind; minimum necessary).

• Aligned to 45 C.F.R. § 164.504(e) required elements (permitted uses, safeguards, subcontractors, breach reporting, HHS access, return/destruction, termination).
• Executed copy available for download after acceptance (PDF).
• New versions supersede prior acceptances; re-acceptance may be required when terms change.

Security safeguards

For HIPAA-mode ePHI, SingleFax implements safeguards reasonably and appropriately designed to meet the Security Rule (45 C.F.R. Part 164, Subpart C). Representative controls include:

Health information lifecycle

1. 1
   Ingest

   Upload only after BAA acceptance. Document converted as needed for fax transmission.

2. 2
   Process & transmit

   Temporary storage under dedicated controls; transmission via fax carrier APIs; retries as configured.

3. 3
   Status & receipts

   We retain delivery status, timestamps, and compliance metadata needed for receipts and audit, not clinical free-text in payment systems.

4. 4
   Secure deletion

   HIPAA-mode document media is subject to a short operational retention window and automated purge with deletion evidence. BAA acceptances, executed PDFs, and required compliance records are retained for at least six (6) years as contemplated by the HIPAA documentation requirements.

Subcontractors & service providers

SingleFax uses carefully selected subprocessors to deliver the Services (for example: object storage, telecommunications / fax termination, payment processing, email delivery, and infrastructure hosting). Where a subprocessor creates, receives, maintains, or transmits PHI on our behalf, we obtain written assurances consistent with 45 C.F.R. § 164.502(e) and § 164.308(b), typically a BAA or equivalent contractual safeguards, or we architect the flow so that provider does not receive document contents (e.g., Stripe Checkout and invoices use opaque order identifiers plus billing descriptors such as “HIPAA send” and the destination fax number, not filenames or file contents).

A current list of material subprocessors is available on request to Covered Entity customers with an active BAA, subject to reasonable confidentiality.

Breach notification & incidents

Under our BAA, SingleFax will report to Customer, without unreasonable delay and in no case later than sixty (60) calendar days after Discovery (or sooner if Required by Law):

• Uses or disclosures of PHI not permitted by the BAA of which we become aware;
• Security Incidents of which we become aware (successful unauthorized access, use, disclosure, modification, or destruction, or interference with system operations); and
• Breaches of Unsecured PHI, including information required by 45 C.F.R. § 164.410.

Routine unsuccessful probes and scans may be logged and reported in aggregate upon request. Customer remains responsible for any downstream notifications to individuals, HHS, or the media when required of a Covered Entity.

Your responsibilities

HIPAA compliance is shared. By using HIPAA mode and accepting the BAA, you represent and agree that:

• 01You are a Covered Entity or a Business Associate engaging SingleFax as a subcontractor BA, not an individual patient binding a clinic.
• 02The signer has legal authority to bind the named entity.
• 03You will follow the minimum necessary requirements where they apply (45 C.F.R. § 164.502(b)). HIPAA has exceptions, including disclosures for treatment.
• 04You will not request uses or disclosures that would be impermissible if performed by you directly (except as the HIPAA Rules expressly allow for BAs).
• 05You maintain your own policies, workforce training, access controls, and patient rights processes required of a CE or BA.
• 06You use HIPAA mode for PHI and standard send only when appropriate, misclassification does not create a BAA for standard traffic.

Records & access

To the extent SingleFax maintains PHI in a Designated Record Set, we will make PHI available to Customer as needed for access (45 C.F.R. § 164.524), amendment (§ 164.526), and accounting of disclosures (§ 164.528), within a reasonable time through support channels. We will make our internal practices, books, and records relating to PHI available to the Secretary of HHS for determining compliance with the HIPAA Rules (45 C.F.R. § 164.504(e)(2)(ii)(I)).

Operational fax media is typically short-lived; compliance artifacts (BAA, acceptance logs, deletion evidence) are retained longer. Plan your own recordkeeping for clinical content you need beyond our media TTL.

Contact & privacy

For BAA questions, security incidents involving SingleFax, or compliance documentation requests: