HIPAA compliant fax service with an electronic BAA
Send protected health information through HIPAA Secure, with an organization BAA before upload, encrypted document storage and a protected dashboard. One-time sending starts at $6.50 for 1–10 document pages or $10 for 11–100.
Destination adjustments and payment terms appear before sending. Product details checked 8 October 2026. HHS does not certify vendors; compliance also depends on your organization meeting its obligations.
Sending your own records as an individual? You do not need a BAA. Standard sending remains available, and Enhanced Privacy is an optional upgrade with restricted document access and shorter media retention. Standard sending already uses encrypted upload and storage; neither option guarantees end-to-end encryption across the telephone network or the recipient’s systems.
Compare BAA and pricing options, or prepare a HIPAA routing cover for your packet.
What makes a fax service HIPAA compliant?
Look at the actual agreement, safeguards and workflow. HIPAA compliance is shared: the service handles documents under its BAA, while your organization controls who can send, what information is appropriate and which recipient is authorized. A “HIPAA” label, secure-looking app or confidentiality footer is not a government certification.
HHS explains business associate relationships and agreements. Review the BAA scope, subcontractors, incident process, access controls and retention before adopting a service. The table maps those questions to SingleFax’s documented controls and the customer’s role.
| Control | SingleFax HIPAA Secure | Your organization |
|---|---|---|
| Business Associate Agreement | Electronic organization BAA before PHI upload; downloadable executed agreement. | An authorized signer binds the correct covered entity or business associate. |
| Encryption | TLS for the web connection and provider encryption at rest for stored document media. | Use suitable devices and follow your organization’s access and security policies. |
| Access controls | Signed-in access, organization membership, an active BAA gate and a protected dashboard. | Assign access appropriately and keep credentials and devices protected. |
| Audit records | BAA acceptance records, fax status, timestamps and media-deletion evidence. | Keep the records needed for your workflow and review the actual transmission result. |
| Retention and deletion | Short operational media retention and automated deletion; BAA and required compliance records retained separately. | Keep your own clinical record copy and understand the retention terms. |
| Data handling | Separate PHI storage, securely stored carrier transmission receipts and payment metadata without document contents. | Use the HIPAA web route and minimize unnecessary identifiers in covers and files. |
The web BAA gate is part of the workflow. Use the explicit HIPAA Secure route rather than uploading PHI to a standard sender first and assuming a later agreement changes the earlier handling. Your signer must have authority to bind the named entity; a patient sending their own records cannot accept an organization’s agreement on its behalf.
Is faxing PHI a HIPAA violation?
Faxing PHI is not automatically a violation. HHS permits treatment communications by fax with reasonable safeguards, including checking unfamiliar fax numbers. Apply the rules for the purpose and recipient of your disclosure, and use the appropriate service relationship when a provider handles PHI for your organization.
Verify the direct destination against current instructions or the recipient’s own contact information. A voice switchboard or extension is not necessarily a fax endpoint. Check every attachment and remove unrelated patient pages. Include only the identifiers needed for routing on the cover.
A successful transmission to the wrong number is still a problem. Confirmation records the endpoint and transmission result; it does not validate authorization or make an incorrect disclosure appropriate. If you identify a misdirected packet, follow your organization’s incident procedures.
For healthcare submission context, see faxing a doctor or clinic and HIPAA fax myths and facts. The compliance overview describes SingleFax’s safeguards, BAA and shared duties.
HIPAA fax for occasional senders vs clinics
Choose the product for your actual sending and receiving needs. One-time HIPAA Secure lets an organization send a packet without a monthly plan. Company plans add an ongoing number and pooled pages; the HIPAA add-on must be selected for the protected workflow.
| Option | Price | Included scope |
|---|---|---|
| One-time, short packet | $6.50 | 1–10 document pages; organization BAA required |
| One-time, longer packet | $10 | 11–100 document pages; organization BAA required |
| Standard + HIPAA | $10.80/month or $108/year | 300 pooled sending/receiving pages per month and an ongoing number |
| Business + HIPAA | $26.80/month or $268/year | 1,000 pooled sending/receiving pages per month and an ongoing number |
Standard is $7.90/month plus the $2.90/month HIPAA add-on, totaling $10.80/month. Annual billing is $79 plus $29, totaling $108/year. The page pool still renews monthly under an annual plan. Extra pooled pages cost $0.02 each; included usage covers US and Canada, and international destinations can consume additional pool pages.
One-time prices are starting page tiers, with any destination adjustment shown in the quote. A cover created in the web composer is excluded from billed document pages; a cover uploaded or merged into a PDF counts as part of the document. Each destination is its own transmission and quote.
A sending order does not include a dedicated receiving number. If a clinic must fax you back, use a suitable company plan with HIPAA enabled and an active BAA. Do not put a short-lived standard number on a form and assume it supplies protected receiving.
How to send through HIPAA Secure
Step 1
Sign in and accept the BAA
Select HIPAA Secure on the website. Identify your organization and have an authorized signer accept its electronic BAA before uploading PHI.
Step 2
Upload and check the packet
Upload the signed document, inspect the prepared pages and verify the direct recipient fax number. Add only the routing information the recipient needs.
Step 3
Review the quote and send
Check the document count, destination adjustment and payment terms. Complete the required checkout or authorized plan/credit send.
Step 4
Keep the final result
Review the final transmission result in the protected workflow. Notifications omit document contents; clinical documents and searchable transcripts stay in the Secure dashboard.
Keep the complete signed source packet and inspect its prepared preview. Check page order, signatures, cropped edges and faint text. Scanning a document and uploading it are preparation steps; the sender must still complete the required review and sending authorization.
Use the recipient’s direct fax number and any specific cover instructions. If you need a routing template, the HIPAA cover guide explains what to include and offers free PDF and Word options. Its confidentiality notice does not replace the BAA or other safeguards.
After transmission, review the final result and reported pages. Successful fax delivery does not establish that a referral, claim or authorization has been accepted. Follow the receiving office’s acknowledgement process and avoid duplicate packets while an earlier send is still processing.
Payment terms, busy lines and failed delivery
Card checkout places a temporary authorization hold. Review the payment terms shown in your destination quote and the pricing FAQ before confirming. Your bank may take time to release a pending hold.
Read the terms for the actual destination before confirming. A credit-funded or plan-covered send follows that product’s usage and billing rules; a monthly plan fee is not a per-fax authorization hold. The pricing page and refund policy provide the full terms.
Transmission time depends on the packet and recipient. Busy lines and retries can extend completion; an upload or payment acknowledgement is not the final fax result. Review the existing order before starting another attempt. If some pages arrived, agree with the recipient whether to resend the whole packet or only the missing portion.
Can I get a free HIPAA fax number?
SingleFax’s free 24-hour number is a standard receiving product. It does not include the HIPAA Secure BAA workflow and should not be treated as a protected organization inbox. For that need, select a company plan with the HIPAA add-on and active organization BAA.
When comparing another provider’s free offer, ask whether it includes a signed BAA, protected receiving, the relevant users and destination support. A free app download, a limited free sending tier and a free receiving number are different offers. A trial can also have billing conditions after its initial period.
Our HIPAA provider comparison separates verified BAA paths and billing periods. Compare the minimum plan that actually covers your workflow, rather than a lower consumer tier with no verified agreement.
HIPAA email-to-fax needs its own safeguards
An ordinary email gateway is not automatically a HIPAA workflow. SingleFax’s send@fax.delivery address, WhatsApp gateway, Chrome extension, MCP and public API are separate from its HIPAA Secure web route. Use the web workflow for PHI transmitted on behalf of a covered entity or business associate.
If you compare a provider that offers protected email-to-fax, verify that the agreement covers the channel and that your own mailbox, users and notifications are configured appropriately. Encryption on a web page does not establish the safeguards for every email hop or attachment.
SingleFax’s protected workflow keeps document contents and searchable transcripts in the Secure dashboard. Notifications do not email those clinical contents. Authorized users should access the protected document directly rather than forward it into an ordinary shared mailbox.
Document retention and your records
HIPAA-mode document media, including carrier preview PDFs stored as transmission receipts, follows short operational retention and automated deletion controls. Download any receipt you need to keep before that window expires. Agreement and compliance records are separate from temporary transmission media. The documented BAA retains required agreement records for at least six years and describes return or destruction obligations and exceptions.
Keep your organization’s own clinical record and the exact packet it sent. Do not use a transmission service as the only permanent archive of a medical record. Save the final result needed for your process and understand when temporary document access ends.
Review the compliance overview and BAA for subcontractors, breach reporting, access requests, retention and customer duties. Your team remains responsible for suitable disclosure, authorized recipients, workforce access and its own required records.