HIPAA-Compliant Fax Services 2026 — Which Are Actually Certified?
By the Attajer Editorial Team · 12 min read · Published August 5, 2026
Quick answer: In 2026, Fax.plus is the best HIPAA-compliant fax service. It offers TLS 1.3 encryption, AES-256 at rest, a signed BAA, SOC 2 Type II certification, and plans from $6.99/month. eFax offers HIPAA only on expensive Corporate plans. FaxZero, Dropbox Fax, and most free fax services are NOT HIPAA compliant.
SOC 2 Type II · TLS 1.3 + AES-256 · Signed BAA · GDPR compliant · From $6.99/mo
What Makes a Fax Service HIPAA Compliant?
HIPAA (Health Insurance Portability and Accountability Act) requires that any service handling Protected Health Information (PHI) meets strict security standards. For fax services, this means:
- Encryption in transit — TLS 1.2 or higher to protect data during transmission
- Encryption at rest — AES-256 to protect stored fax documents
- Business Associate Agreement (BAA) — A legally binding agreement between the healthcare provider and the fax service
- Access controls — Role-based permissions, MFA, and audit logs
- Data retention policies — Automatic deletion of PHI after a set period
- Third-party certification — SOC 2 Type II, ISO 27001, or equivalent
HIPAA Compliance Comparison (2026)
| Service | HIPAA | BAA | Encryption | SOC 2 | Price |
|---|---|---|---|---|---|
| Fax.plus ⭐ | ✓ Enterprise | ✓ Yes | TLS 1.3 + AES-256 | ✓ Type II | From $6.99/mo |
| eFax | ✓ Corporate only | ✓ Corporate | TLS + AES | Not published | Custom quote |
| RingCentral | ✓ Business+ | ✓ Yes | TLS 1.2 + AES-256 | ✓ Type II | From $20/mo |
| Dropbox Fax | ⚠ Not confirmed | ⚠ Unknown | TLS + AES | Not published | $9.99/mo |
| FaxZero | ✗ No | ✗ No | Not published | ✗ No | Free |
| FaxBurner | ✗ No | ✗ No | Not published | ✗ No | Free/Paid |
Who Needs HIPAA-Compliant Faxing?
Any organization that handles PHI is legally required to use HIPAA-compliant tools for faxing. This includes:
- Hospitals and clinics — Patient records, lab results, referrals
- Pharmacies — Prescription orders and refills
- Dental offices — Patient charts, X-rays, insurance claims
- Mental health providers — Therapy notes, assessments
- Health insurance companies — Claims, approvals, denials
- Medical billing companies — Invoices with patient data
- Home health agencies — Care plans, medication lists
HIPAA Violation Penalties
Using a non-compliant fax service to send PHI can result in severe penalties:
| Tier | Violation | Penalty per Violation | Annual Max |
|---|---|---|---|
| 1 | Unaware | $100–$50,000 | $25,000 |
| 2 | Reasonable cause | $1,000–$50,000 | $100,000 |
| 3 | Willful neglect (corrected) | $10,000–$50,000 | $250,000 |
| 4 | Willful neglect (uncorrected) | $50,000+ | $1,500,000 |
How to Set Up HIPAA-Compliant Faxing
- Choose a compliant service: Sign up for Fax.plus Enterprise plan
- Sign the BAA: Request and execute a Business Associate Agreement
- Configure access controls: Set up user roles, MFA, and permissions
- Set retention policies: Configure automatic deletion timelines
- Train your staff: Ensure all users understand HIPAA faxing procedures
- Document compliance: Keep records of your BAA and security measures
Frequently Asked Questions
A HIPAA-compliant fax service must provide: (1) encryption in transit (TLS 1.2+) and at rest (AES-256), (2) a signed Business Associate Agreement (BAA), (3) access controls and audit logs, (4) automatic data retention policies, and (5) SOC 2 Type II or equivalent certification. Fax.plus meets all these requirements.
No. FaxZero is NOT HIPAA compliant. It does not publish encryption standards, does not offer a BAA, has no SOC 2 certification, and should never be used for sending Protected Health Information (PHI). Use a certified service like Fax.plus for healthcare faxing.
eFax offers HIPAA compliance only on its Corporate plan, which requires a custom quote and typically costs significantly more than standard plans. The basic eFax Plus ($18.99/mo) and Pro ($19.99/mo) plans are NOT HIPAA compliant.
Fax.plus offers HIPAA compliance on its Enterprise plan with transparent pricing. Basic plans start at $6.99/month with encryption included. For a formal BAA and full HIPAA compliance package, contact their sales team. eFax Corporate plans with HIPAA require custom quotes starting much higher.
Yes, but only through a HIPAA-compliant fax service with a signed BAA. Fax.plus encrypts all faxes with TLS 1.3 in transit and AES-256 at rest, making it safe for PHI including patient records, prescriptions, lab results, and insurance claims.
Dropbox Fax does not explicitly advertise HIPAA compliance or offer a BAA. Healthcare providers should verify compliance before using Dropbox Fax for PHI. Fax.plus is a safer choice with documented HIPAA compliance and a signed BAA available.