Is online fax secure? HIPAA, encryption and what to look for

Updated October 25, 2026 · PlusFax team

How online fax security compares with a fax machine, what HIPAA actually requires of a fax service, what a Business Associate Agreement covers, and the questions to ask any provider.

Why fax has a reputation for security

A traditional fax travels as a direct telephone call from one machine to another over the public switched telephone network. There is no server in the middle that stores a copy, no inbox it sits in, and intercepting it means tapping a phone line. That is why health, legal and financial regulators spent decades treating fax as an acceptable way to move sensitive documents, and why so many of their forms still say "fax to".

The weak points of a fax machine were never the line. They were the tray on the receiving end where pages sit in the open, the misdialled number that sends records to a stranger, and the memory of the machine itself, which keeps copies of everything it has sent and received until someone clears it.

What changes with online fax

Online fax keeps the point-to-point phone call for the last leg and replaces the machine on your side with a web service. That adds some steps, and each of them should be protected:

  • The upload. Your document travels from your browser to the service over HTTPS, the same encryption your bank uses. Look for the padlock.
  • Storage before transmission. The service holds the file until the fax is sent. It should sit outside the public web root, on access-controlled servers, and be deleted shortly after delivery unless you choose to keep it.
  • The hand-off to the carrier. The carrier that places the call fetches the document from the service. That link should be single-use and expire within minutes.
  • Your account. If you keep a history, it is only as safe as your password. Two-factor authentication should be available.
  • Received faxes. Incoming pages arrive as PDFs in your dashboard and inbox instead of a tray, so nobody walking past can read them, and you decide when to delete them.

Done well, online fax is more secure than the machine it replaces: encrypted on the way in, a point-to-point call on the way out, no paper in a tray and no forgotten pages in a machine's memory.

What HIPAA actually requires

HIPAA does not certify products, so "HIPAA-compliant fax" is a description, not a badge. The rule requires a covered entity (a clinic, a practice, an insurer) to protect patient information with reasonable administrative, physical and technical safeguards, and to have a Business Associate Agreement (BAA) with any vendor that handles that information on its behalf. For a fax service that means:

  • encryption of data in transit and at rest;
  • access controls, so only the account holder and authorised staff see documents;
  • audit records of who sent, received, viewed and deleted what;
  • retention you control, including the ability to delete;
  • a signed BAA defining the vendor's obligations and breach notification duties.

The telephone leg itself is treated by HIPAA as a conduit, like the postal service: the carrier does not read or store the fax, so it is not a business associate. The online service that stores your PDF before and after the call is, and that is where the BAA applies.

PlusFax provides these safeguards and signs a BAA on request through the contact page. Compliance remains the covered entity's responsibility: use a cover sheet with a confidentiality notice (see the template), double-check numbers, enable two-factor authentication and delete what you no longer need.

Fax versus email for sensitive documents

Ordinary email is stored in plain form on every server it passes through and in both parties' mailboxes indefinitely. It can be forwarded in one click. A fax is a single call to a single number with a delivery record, and an online fax adds encryption on the upload. For a one-off document to a known office, fax remains the simpler way to meet a confidentiality requirement, which is why so many institutions still require it. Encrypted email and secure portals are good alternatives when both sides have them; fax is the one that works with everyone.

Questions to ask any online fax provider

  1. Is the upload encrypted, and are stored documents encrypted at rest?
  2. How long do you keep my documents, and can I delete them myself?
  3. Is the link the carrier uses to fetch my document single-use and time-limited?
  4. Do you offer two-factor authentication?
  5. Will you sign a Business Associate Agreement?
  6. Do you use my documents for anything other than sending my fax?
  7. Where are your servers, and who has access to them?

Our answers: yes; guest documents shortly after delivery and account documents until you delete them; yes; yes; yes; no; access-controlled servers with audit logging. The privacy policy has the details, and how it works describes each step of the pipeline.

Send a fax now, no account needed

$1.99 for up to 5 pages, then $0.25 a page. Upload, enter the number, pay by card, get a delivery receipt by email.

Send a fax

Need your own number? Plans with fax-to-email start at $7.99 a month. See pricing.

Frequently asked questions

A service can support HIPAA compliance when it encrypts data in transit and at rest, limits who can access documents, keeps audit records and signs a Business Associate Agreement. Compliance is the covered entity's responsibility; the provider supplies the safeguards.

A fax over the telephone network is a point-to-point call, which is why regulations have treated it kindly. Email can be read on any server it passes through unless it is end-to-end encrypted. Online fax combines an encrypted upload with the point-to-point delivery of a fax.

Guest documents are deleted shortly after delivery. Account documents stay until you delete them, so you have a copy, and you can remove them with one click.

Yes. Contact us with the name of the covered entity and we will send one.

Related guides

We use only essential cookies: one to keep you signed in and one to protect forms. No advertising or tracking cookies. Cookie Policy