HIPAA compliant online fax for medical and dental offices

Who this page is for

• Referrals, prior authorizations, lab results and pharmacy requests still reach you by fax.
• Your fax machine sits on a copper phone line, and the phone company or your IT person has suggested moving it.
• Incoming faxes pile up in a tray anyone at the front desk can read.
• You’re comparing online fax services and every one says “HIPAA compliant.”

The problem at the front desk

A two-provider practice gets 30 to 40 faxes a day on an old machine. Pages land face up in a tray next to the check-in window. The machine is also on its own phone line, billed monthly, and nobody knows which line it is.

Moving to online fax solves the tray and the line. It also moves PHI into a vendor’s cloud, which is where the BAA question starts.

What HIPAA requires for fax

There is no HIPAA rule written for fax. Two sets of rules apply.

The Privacy Rule. HHS’s FAQ on sharing PHI for treatment says providers may share PHI for treatment by fax without patient authorization, with reasonable safeguards. For a number “that is not regularly used,” a safeguard may be confirming the number with the recipient first. HHS also says you “may pre-program frequently used numbers directly into the fax machine.”

The Security Rule. Online fax turns pages into files: PDFs in a portal, attachments in email, documents in your EHR. Those files are ePHI. Access control, audit controls and transmission security under 45 CFR 164.312 apply to them.

The BAA question

HHS’s cloud computing guidance says a cloud provider that stores ePHI is a business associate, even if it only stores encrypted data and has no key. The conduit exception, which covers services like the postal service, is “limited to transmission-only services for PHI.”

HHS’s business associate guidance describes conduits as services that only transmit PHI, with at most brief temporary storage.

An online fax service that keeps faxes in a portal or delivers them by email is storing your PHI. That makes it a business associate, and you need a BAA under 45 CFR 164.502(e).

Options compared

Provider	Best for	How it works	Pricing info (as of October 2026)	Pros	Cons
Documo (I work with them)	Small to mid-size practices that want a web portal and email delivery	Cloud fax with users, numbers and page allowances by plan; EHR and practice management integration offered as an add-on	Solo $25 per month billed annually (300 pages, 1 user); Business $100 monthly or $80 per month annually (1,500 pages, 10 users); Enterprise $300 monthly or $240 per month annually (6,000 pages, 50 users) (Documo)	Documo says HIPAA compliance “comes standard with every plan” and that it signs a BAA for healthcare customers	Its FAQ lists Enterprise at $250 per month, which doesn’t match the table [VERIFICAR]
Cloudli (I work with them)	Practices with fax servers, many multifunction printers, or that also want cloud phones	T.38 IP fax trunks, a T.38 fax adapter for existing machines, and a Virtual Fax service with portal and fax-to-email	Not published; custom quote (Cloudli)	Cloudli cites AES encryption in transit on its healthcare page; keeps existing machines working	BAA position needs confirming (see the box above)
eFax Corporate (I don’t work with them)	Larger practices and groups that want an enterprise cloud fax vendor	Cloud fax priced per active number and per transaction	Not published on the page I opened (eFax Corporate)	Says it is “HIPAA Compliant and HITRUST CSF® Certified”	No prices and no BAA mention on that page [VERIFICAR]
SRFax (I don’t work with them)	Low-volume offices that want the lowest published entry price	Email-to-fax and fax-to-email with healthcare plans	Healthcare Lite $12.60 per month (200 pages) or $128.40 per year; Healthcare Basic $16.05 per month (500 pages) (SRFax)	Offers to sign a BAA; extra pages $0.05	No named EHR integrations, only a general API
iFax (I don’t work with them)	Solo practitioners who fax from a phone or laptop	App-based online fax	Plus $24.99 per month (500 pages, 1 number), the first plan listed as HIPAA compliant (iFax)	Mobile and desktop apps	BAA not mentioned on its pricing page [VERIFICAR]; Basic plan isn’t listed as HIPAA compliant
Sfax (I don’t work with them)	Practices already using it that want to compare	Cloud fax	Not published on the pages I reviewed [VERIFICAR]	Features not reviewed yet [VERIFICAR]	Confirm BAA, prices and integrations directly [VERIFICAR]

What it costs

Published prices as of October 2026:

• SRFax Healthcare Lite: $12.60 per month for 200 pages, or $128.40 per year.
• Documo Solo: $25 per month billed annually, 300 pages, 1 user.
• iFax Plus: $24.99 per month for 500 pages and 1 number.
• Documo Business: $80 per month billed annually, or $100 month to month, 1,500 pages and 10 users.

What changes the price: pages per month (SRFax, for example, counts sent and received pages together), number of users and fax numbers, overage rates, EHR integration add-ons, and annual versus monthly billing. Your old fax line’s monthly bill is the number to compare against.

EHR integration claims

I only list what the vendors say officially.

• Documo says it “integrates with many of the most widely used EHR platforms,” and lists EHR and practice management integration as an add-on. Its pricing page doesn’t name the systems.
• Cloudli says its T.38 IP fax is “compatible with all existing fax interfaces,” including EHRs. That means your EHR’s existing fax connection keeps working; it isn’t a named integration.
• SRFax names no EHR systems and offers a general API.

If your EHR or dental software has its own fax feature, ask the EHR vendor which fax providers it supports before you choose.

Replacing analog fax lines

You have three common paths:

1. Pure online fax. Staff send and receive in a web portal or by email. You cancel the line and port the number. Best when only a few people fax.
2. Keep the machine, drop the copper line. A T.38 fax adapter connects your existing fax machine or multifunction printer to an internet fax service. Cloudli offers one.
3. Fax server or trunks. Larger offices with a fax server, such as RightFax, can move it to IP fax trunks. Cloudli says a migrated fax server keeps working without changing staff workflows.

My recommendation by scenario

• If you’re a 1 to 3 person office with under 300 pages a month, an entry plan from Documo or SRFax is enough. Get the BAA signed before you port your number.
• If you have 5 to 15 staff and several people fax, Documo’s Business plan includes 10 users and 5 numbers, which is sized for that kind of office. Turn off fax-to-email to personal mailboxes and use the portal.
• If you have a fax server, many printers that fax, or you also want new phones, get a Cloudli quote and ask the BAA question in writing.
• If you’re a dental office sending referrals to specialists, see the referral workflow on the dental office page.

How implementation works

1. List every fax number, the line it’s on, and who uses it.
2. Pick a plan by pages per month, counting both sent and received.
3. Sign the BAA, and file it with your HIPAA records.
4. Set up users with their own logins and MFA, and decide whether faxes go to the portal, to a shared mailbox, or into your EHR.
5. Port the number. Keep the old line active until the port completes and test faxes arrive.
6. Add the fax service to your risk analysis and your vendor list.

Porting time depends on your current carrier. Ask the new provider for its estimate before you set a cutover date.

Questions to ask any fax provider

1. Will you sign a BAA for the exact product I’m buying?
2. Where are faxes stored, for how long, and can I set automatic deletion?
3. Do users get individual logins with MFA and an audit log?
4. If faxes go to email, is the email encrypted, and to which addresses?
5. Which EHR or practice management systems do you integrate with today?
6. What do overage pages cost, and do received pages count?

Common mistakes

1. Fax-to-email into a mailbox with no BAA. The fax vendor may be covered while the email account receiving the PDFs isn’t. Check the HIPAA compliant email setup too.
2. One shared login for the fax portal. Unique user identification applies here like anywhere else.
3. Canceling the old line before the port finishes. You can lose the number.
4. Taking “HIPAA compliant” on the website as a BAA. Ask for the agreement itself.
5. Forgetting the multifunction printer. Some multifunction printers keep scanned and faxed pages on an internal drive. Ask how it gets wiped before the device leaves, since disposal and media re-use are required specifications under 45 CFR 164.310(d).

The healthcare cybersecurity guide shows how fax fits into the rest of your safeguards. If you want me to compare fax options for your page volume and EHR, send me your fax volume and current setup.