HHS has never told healthcare to stop faxing. Its guidance says the Privacy Rule permits physicians to disclose PHI to another provider by fax for treatment, as long as reasonable and appropriate safeguards are in place.
Take two identical referral forms sent the same morning. One moves through an encrypted, logged channel covered by a signed business associate agreement (BAA), and OCR software indexes it into the chart. The other sits in an output tray in a shared hallway. Same document, same law, two very different compliance positions.
HIPAA regulates the safeguards around a fax
Does a fax need to be HIPAA compliant? For a covered entity or business associate sending protected health information, yes. But a fax machine, an app or a cloud service can’t be compliant on an organization’s behalf. The rule asks whether the organization has reasonable safeguards around each disclosure.
Covered entities, HHS says, “must have in place reasonable and appropriate administrative, technical, and physical safeguards” for PHI sent by fax, such as confirming the recipient’s number and choosing to pre-program frequently used numbers. Once a faxed page becomes a digital file, the Security Rule’s safeguard standards apply as well.
“Most people start by asking whether a fax service is HIPAA compliant, and that’s the wrong place to start,” says Adam Korbl, Founder and CEO of iFax. “HIPAA doesn’t certify a fax machine or an app. I’d rather people ask who can open the document, whether anything done to it is logged, and whether the BAA covers the software reading the page, not just the line carrying it.”
Korbl’s questions all concern the workflow. A fax that arrives intact but sits in a shared queue, or gets filed to the wrong chart, can still expose a patient’s information, and the industry’s breach numbers are already high: The HIPAA Journal counted 772 large healthcare data breaches on the OCR portal for 2025 as of early January 2026, a record.
What a compliant fax workflow covers now
OCR engines, extraction models and routing rules all handle the page now, and each of those steps carries the same obligations as the transmission.
Encryption is the obvious place to begin. Under the current Security Rule it’s an “addressable” specification, a label The HIPAA Journal notes has led some covered entities to treat it as optional when it never was, and for cloud fax it should reach the OCR text as well as the stored images, at rest and in transit. Every send, receipt, view and routing decision should also leave an entry that someone can pull up later.
The BAA holds the arrangement together legally. HHS’s sample BAA provisions outline what the contract must require of a vendor, including Security Rule safeguards, breach reporting and matching terms for subcontractors. Under HHS cloud guidance, a cloud provider storing ePHI is a business associate even without the key, and the conduit exception “is limited to transmission-only services.” By that logic, a phone carrier moving the fax signal counts as a conduit, while a cloud fax platform storing copies generally counts as a business associate. If OCR or data extraction runs at a separate company, that company needs coverage too, usually under a subcontractor BAA with the vendor.
HHS’s advice on misdialed fax numbers applies to routing rules as well. If a rule misfires and files a referral under the wrong patient, the result is no different from a misdialed number. Staff should look over uncertain matches before anything gets filed.
Here a vendor can do a lot of the work. iFax says its healthcare platform pairs AES-256 encryption in transit and at rest with signed BAAs, role-based access and audit logs, and runs OCR inside the same controlled infrastructure. That handles the technical side. Policies, staff training and the risk analysis are still the covered entities to manage.
Access control rounds out the list, and skipping it has a documented cost. The 2024 Change Healthcare attack began with compromised credentials on a system where MFA wasn’t turned on, and it ultimately affected approximately 193 million individuals.
The security rule is catching up with software that reads
HHS has started writing AI into the rules, though the biggest changes are still proposals. The Security Rule overhaul published on January 6, 2025 would make encryption of ePHI mandatory with limited exceptions, require multi-factor authentication and call for an annual technology asset inventory and network map. It also names AI directly: a risk analysis “must include consideration of, among other things, the type and amount of ePHI accessed by the AI tool, to whom the data is disclosed, and to whom the output is provided.”
Timing is uncertain: after nearly 5,000 comments, final action is now targeted for July 2027. OCR’s own estimate put first-year compliance costs at $9 billion, and the proposal would give organizations 240 days after the final rule to comply. None of that is likely to change who does what, though: vendors provide the tools, and practices still run the program.
“We can give a practice the encryption, the audit trail and a controlled place for OCR to run. The policies, the staff training, the risk analysis, that’s for the practice’s to own, not ours.” Korbl says.
That division gets blurry when staff bring in AI tools on their own. In an Imprivata-commissioned survey of 250 health security and AI leaders, 72% said AI tools or agents are being deployed without formal IT approval, Axios reported. Tools that IT never approved are unlikely to appear in an asset inventory, let alone be checked against a BAA, and an inventory requirement like the one HHS proposed is meant to surface them. The survey also found that 28% of organizations have agentic AI in production already, while 44% are piloting or testing it.
Buy the stack, run the program
A practice can buy a compliant document stack. Compliance isn’t sold that way. It has to be run from inside the practice, with written policies that get updated and staff who are trained on them. A fax vendor that can’t produce encryption, access controls, audit logs and a signed BAA shouldn’t make the shortlist. For the AI layer, buyers should push further and find out where the reading actually happens, whether the BAA extends that far, whether automated actions are logged and who checks the matches the software isn’t sure about.