Is Faxing HIPAA Compliant in 2027?
Yes. HIPAA allows a medical practice to fax patient information for treatment without the patient's written permission, as long as the practice uses reasonable safeguards, such as confirming a new fax number before sending and saving numbers it uses often. If you use an online fax service, it stores and transmits that information for you, so you need a signed business associate agreement (BAA) with the vendor. The right fax software is the one that signs a BAA and gets each inbound fax to the right patient chart and the right person quickly.
This guide covers why fax is still part of everyday practice in 2027, what HHS actually says about it, which online fax tools publish their HIPAA terms and prices, and how small practices keep the fax inbox from becoming the most stressful pile in the office. It is general information, not legal advice. Your own HIPAA policies and counsel have the final word.
Why Do Doctors Still Fax?
Doctors still fax because much of the health system on the other end of the line still does. A direct primary care or small independent practice can turn on every network its EHR offers and still receive consult notes, imaging reports, records requests and payer forms by fax, because the sender's system was set up that way years ago and still works.
The numbers back this up. The ONC (now ASTP) quickstat on how hospitals exchange information, built from the American Hospital Association IT Supplement, tracks how often hospitals send summary of care records to outside organizations by each method.
In 2025, 40 percent of hospitals said they often sent those records by mail or fax and another 34 percent said they sometimes did. On the receiving side, 35 percent often and 46 percent sometimes received summary of care records by mail or fax.
Network exchange has grown at the same time, which is good news. The same quickstat shows national networks rising from 20 percent of hospitals often sending through them in 2018 to 60 percent in 2025. Fax has not gone away, though. It has become the route for whatever the networks miss, which is exactly the work a small team has to chase by hand. Our guide on how DPC practices get outside records in 2027 walks through using TEFCA, Carequality and state HIEs first, with fax as the fallback.
What Does HIPAA Actually Say About Faxing PHI?
HHS answers this directly. In FAQ 482, it says the Privacy Rule lets covered providers share protected health information for treatment "orally or in writing, by phone, fax, e-mail, or otherwise," without patient authorization, as long as they use reasonable safeguards.
The FAQ gives everyday examples that will sound familiar. A lab may fax test results to a physician, a physician may fax a copy of a record to a specialist who will treat the patient, and a hospital may fax care instructions to a nursing home.
HHS also names the kind of safeguards it means. When faxing to a number that is not regularly used, the provider can confirm the number with the recipient first. Practices can pre-program numbers they use often so pages do not go astray. Online fax software makes both of these easier, because saved contacts replace hand-dialed numbers.
Do you need a BAA with your fax vendor?
Yes, if the service stores or transmits faxes for you, which every online fax service does. HHS guidance on cloud computing says that when a covered entity uses a cloud service provider "to create, receive, maintain, or transmit ePHI" on its behalf, the provider is a business associate. A cloud fax inbox holds copies of lab results and records, so it fits that description.
In practice, that means three checks before you port a number or send the first patient fax:
- The vendor offers a BAA on the plan you are buying, not only on an enterprise tier.
- You have the signed BAA on file with your other HIPAA records.
- You know where faxes are stored, for how long, and who on your team can see them.
If the 2027 changes to the HIPAA Security Rule are on your mind, our post on HIPAA Security Rule changes for 2027 covers what is proposed and what is final.
HIPAA-Compliant Fax Software Compared
The list below includes only facts we could confirm on each vendor's own site. Several well-known services, including iFax, Phaxio (Sinch) and RingCentral fax, also market to healthcare, but we could not confirm their current BAA terms and prices on their pages the day we checked, so they are left out rather than guessed at. Ask any vendor for its BAA and current plan sheet on a demo call.
- Spruce. A HIPAA BAA listed on the plans page. Fax sits in the same shared inbox as phone, text, video and team chat. Basic and Communicator plans, priced per user (see below).
- Documo (mFax). "HIPAA compliance comes standard with every plan." Cloud fax with users and numbers per plan, with EHR integrations offered. A Solo Cloud Fax plan for small practices (see below).
- SRFax. Healthcare plans described as HIPAA compliant, with optional PGP encryption. Email-to-fax and mobile sending. Healthcare plans are listed on its site, so confirm the current tier.
- eFax Corporate (Consensus). Audit trails and secure transmission options for HIPAA. A secure fax API that integrates with EHR systems, for high-volume faxing. No price on the page we checked, so it is by quote.
- Akute (EHR-native). An EHR vendor, so confirm the BAA in your contract. Faxing is included in the EHR plan, so faxes stay inside the chart (see below).
Here are the published prices from those pages.
Spruce lists Basic at $24 per user per month and Communicator at $49 per user per month, with a 14-day free trial.
Documo's Solo Cloud Fax is $25 per month billed annually, with 300 pages a month, one fax number and one user, plus $3 per additional user, $3 per additional number and $0.15 per additional page. Its Business Cloud Fax plan is $100 per month with 1,500 pages a month.
Akute's plans, as noted in our DPC EHR comparison, run from $300 to $550 a month, with a $100 plan also shown on some visits (checked November 4, 2026). Essentials covers one clinician and 100 patients, and its pricing page lists faxing among the included features.
Which fax setup is best for which practice?
- Best if your team already lives in one inbox. Spruce suits small practices that want fax next to phone and text, so a refill fax and the patient's text about the same refill show up in one place. Our HIPAA-compliant texting guide and Spruce workflow post go deeper.
- Best for a low-cost standalone fax line. Documo's Solo plan is priced and sized for an individual or small practice that sends and receives a modest number of pages.
- Best for keeping faxes in the chart. If your EHR includes faxing, as Akute's plans do, inbound pages land where they will be filed anyway. Check your own EHR's fax features before adding another tool.
- Best for larger groups with integration work planned. eFax Corporate describes a fax API built to connect with EHR systems and handle high volume.
Whatever you choose, check whether the vendor can port your existing fax number. Specialists, labs and pharmacies have your number saved, and changing it creates months of misrouted pages.
Who Should Pick Which
- Pick Documo if you want a standalone cloud fax line with a modest page allowance. Where it wins: a line sized for one small practice.
- Pick SRFax if you want a standalone fax plan built for healthcare, with optional encryption. Where it wins: each transmission compliant with HIPAA, by its own account.
- Pick eFax Corporate if you are a larger group with integration work planned and want a fax API that connects to your EMR. Where it wins: an enterprise fax service built for healthcare providers.
- Pick Spruce if you want texts, calls, faxes and video with patients in one shared inbox. Where it wins: calls, texts and faxes in one place; one per-user plan for the whole team.
- Pick Akute if you want automation inside the EHR and a price set by patient count. Where it wins: automation built into the EHR; e-prescribing, labs and a patient portal on its plans.
- What Tabflows does not do: replace your patient messaging; chart visits or prescribe.
How Does Fax to EHR Actually Work?
"Fax to EHR" usually means one of two setups. In the first, the EHR has its own fax number, and inbound pages arrive in a document queue inside the EHR. In the second, a standalone fax service receives the pages and either pushes them into the EHR through an integration or drops them in a shared inbox, where staff download and upload them by hand.
Both setups solve the paper problem. Neither one decides, on its own, which patient a fax belongs to, what kind of document it is, or who needs to act on it. A 14-page records packet, a critical potassium and a prior authorization denial can all arrive in the same hour, and in most systems they look the same until a person opens them. That is why the fax inbox works best when it is treated as a workflow with owners, not as a mailbox.
How to Route Inbound Faxes to the Right Person and Patient
Most of what arrives by fax in a primary care practice falls into a handful of types. Giving each type a clear owner and a clear next step is what keeps the inbox from becoming a pile.
| Fax type | Who owns it | What "done" looks like |
|---|---|---|
| Lab and imaging results | Clinician on the patient's care team | Filed to the chart, reviewed and signed, patient told the result |
| Outside records and consult notes | Front desk or care coordinator | Filed with a clear document type, linked to the open request |
| Refill requests from pharmacies | Clinician or nurse | Approved or declined in the e-prescribing tool, pharmacy and patient notified |
| Prior authorizations and payer forms | Whoever owns prior auths | Form completed and sent, follow-up date set, outcome recorded |
| Misdirected or unknown faxes | Practice privacy lead | Sender contacted, pages handled per policy, log updated |
A daily routine that holds up
Pick one person to own the fax inbox each day, with a named backup. Check it at set times, such as first thing in the morning, after lunch and before close, so critical results never wait overnight by accident.
For each fax, confirm the patient using two identifiers, label the document type, attach it to the chart, and route it to the person in the table above. If the fax answers something you were waiting on, like a records request or a prior auth, close that loop at the same moment.
Outside records are where this pays off most. If you track records requests in one place, an inbound packet can be matched to the open request and marked complete, rather than sitting in a folder while someone calls the hospital again. Our guide to medical records request tracking shows a simple way to do it.
Prior auths deserve their own lane. Payer forms often arrive by fax with a short deadline, and the follow-up date is easy to lose. The prior authorization tracking workflow lays out how small teams keep each one moving.
Retention and storage
HIPAA's documentation rule (45 CFR 164.316) requires keeping your HIPAA policies, procedures and the records of actions and assessments it requires for six years. That rule covers compliance documentation, not the medical record itself, whose retention is mostly set by state law and your malpractice carrier. Once a fax is filed to the chart, the chart is the record. Decide how long copies should stay in the fax service's inbox, and whether that inbox should be cleared on a schedule so there is not a second, unmanaged copy of every lab result. Check your state's medical record retention rules, and ask your vendor how deletion and export work before you sign.
What to do when a fax goes to the wrong place
Misdirected faxes happen even in careful offices, usually because of a mistyped or outdated number. When one goes out, contact the recipient, ask them to destroy or return the pages, and write down what was sent, when and to whom. Then run the breach risk assessment in your HIPAA policies, which decides whether notification is required.
When a fax meant for someone else arrives at your practice, let the sender know, handle the pages according to your policy and log it. Saved contacts in your fax software, and confirming any new number before the first send, are the simplest ways to make misdirected faxes rare. None of this is legal advice, and your privacy officer or counsel should guide any real incident.
Keeping the Fax Line From Becoming a Second Job
Most practices that struggle with fax are not doing anything wrong. They are working with tools that each handle one piece, a fax inbox here, an EHR document queue there, a task list somewhere else, with nothing tying the pieces together. The person on fax duty ends up carrying the whole loop in their head.
This is the gap Tabflows fills. Tabflows is a dedicated tech team that connects the tools a clinic already uses, such as the EHR, fax and messaging tools, so the work between them gets done. A fax that lands can become a task for the right person with the patient's context attached, and the follow-up on a records request or prior auth stays visible until it is finished. It does not replace your fax service or your EHR. It makes sure what arrives in them does not get lost.
If you are building or rethinking your stack, our best DPC software for 2027 guide and guide to HIPAA-compliant workflow tools are good next reads, and the 2027 guide to starting a DPC practice covers where fax fits in your first-year setup.
Sources
Checked on November 5, 2026: akutehealth.com, srfax.com/fax-plans/healthcare-solutions and efax.com/corporate. Checked on November 4, 2026: sprucehealth.com/plans, documo.com/pricing and akutehealth.com/pricing. Spot a wrong fact? Email a correction.
FAQs
Is faxing HIPAA compliant?
Yes, faxing is allowed under HIPAA. HHS says covered health care providers may share protected health information for treatment by phone, fax or email without patient authorization, as long as they use reasonable safeguards, such as confirming a fax number that is not regularly used and pre-programming numbers the office sends to often. Compliance depends on how the fax line is set up and run, not on the fax itself.
Do I need a BAA with my online fax service?
In almost every case, yes. HHS guidance says a cloud service provider that creates, receives, maintains or transmits electronic PHI on a practice's behalf is a business associate, even if it never looks at the data. An online fax service stores your faxes in its system, so you should have a signed business associate agreement before any patient information goes through it.
Why do doctors still fax in 2027?
Because the people on the other end still use it. ONC data based on the American Hospital Association IT Supplement shows that in 2025, 40 percent of hospitals often sent summary of care records by mail or fax and another 34 percent sometimes did. Small specialty offices, imaging centers, records departments and many pharmacies and payers still send and expect faxes, so practices keep a fax line for the long tail.
What is the best eFax service for a small medical practice?
It depends on where the fax should land. If your team already works in a shared inbox for phone and text, Spruce includes fax with a BAA in its per-user plans. If you want a standalone cloud fax with a low page allowance, Documo's Solo plan is built for small practices. If your EHR includes faxing, as Akute's plans do, keeping faxes inside the chart can be simplest. Larger groups with an EHR integration project often look at eFax Corporate.
Can an online fax go straight into my EHR?
Often, yes. Some EHRs include fax natively, so an inbound fax lands in a document queue where staff attach it to the patient chart. Standalone fax services may offer EHR integrations or an API. Either way, someone still has to confirm the patient, label the document and send it to the right clinician, which is where most practices lose time.
What should I do if a fax goes to the wrong number?
Treat it as a possible breach. Contact the recipient, ask them to destroy or return the pages, document what was sent and to whom, and run the breach risk assessment your HIPAA policies call for. Then fix the cause, often a mistyped or outdated number, by confirming new numbers before sending and keeping a saved contact list. This is general information, not legal advice.