HIPAA-Compliant Online Fax in 2026: What It Takes, and Why Faxify Isn't

A quick honest disclosure before we start: this post is written by the team at Const Agility, LLC that builds Faxify, an online fax service for the United States and Canada. What follows is the buyer's-side diligence we'd want if we were the practice manager being told to "find a HIPAA-compliant fax service" — a clear-eyed look at what HIPAA-compliant faxing takes in 2026, and why Faxify is not HIPAA compliant.

If you're short on time, jump to where your documents go or skip straight to the where Faxify stands section.

TL;DR

• A fax vendor can be HIPAA-eligible; only your workflow can be HIPAA-compliant, and only with a vendor that signs a BAA with you.
• Faxify sends faxes over SignalWire's carrier network and stores documents on Google Cloud. Faxify's carrier and document-storage providers hold their own BAAs with Faxify; that covers their relationship with us and extends no HIPAA coverage to you. Product analytics (Amplitude) sees usage events only, never document contents.
• Faxify is not HIPAA compliant and does not sign Business Associate Agreements. Do not send PHI through Faxify. This applies to every plan, free and paid, and to the MCP server.
• Competitor BAA availability varies. eFax Corporate signs BAAs at enterprise pricing (quote-only). RingCentral healthcare signs at the healthcare-plan tier. Fax.Plus Enterprise signs at $79.99/month annually. Faxify: does not sign BAAs at any tier, and is therefore not an option for PHI.
• A timestamped carrier-confirmed "Delivered" receipt is a record of transmission, not of compliance. "Sent" — which most competitors report when the file finishes uploading to their server — is not the same thing and is not a delivery record.

⚠️ Compliance disclaimer: Faxify is not HIPAA compliant and does not sign Business Associate Agreements. Do not send PHI through Faxify. This post explains how HIPAA works in fax transmission generally, and is written by a vendor that is honest about being outside that scope. It is not legal advice. If you handle PHI, use a vendor that will sign a BAA with you.

---

What "HIPAA-compliant fax" actually means

If you've been told to "find a HIPAA-compliant fax service," the first thing worth knowing is that the phrase itself is doing a lot of work. The short answer: vendors are HIPAA-eligible, workflows are HIPAA-compliant — and most of the work the phrase is doing is being done in the wrong place.

HIPAA's Privacy Rule and Security Rule apply to two categories of entity:

• Covered entities — health plans, healthcare clearinghouses, and most healthcare providers who transmit health information electronically. The clinic, hospital, lab, insurance plan, or billing service the PHI belongs to.
• Business associates — vendors that create, receive, maintain, or transmit PHI on behalf of a covered entity. The EHR, the email host, the cloud storage, the fax service, the billing platform.

A fax service handling PHI on your behalf is a business associate. That relationship is governed by a Business Associate Agreement (BAA) — a written contract spelling out what the business associate can do with the PHI, how it must protect it, how it handles breaches, and what happens at termination. No BAA, no PHI. That part is non-negotiable under HIPAA, regardless of how much the vendor's marketing page mentions "HIPAA-compliant" or "256-bit encryption."

So when a buyer asks "is this fax service HIPAA-compliant?", the honest answer in most cases is: the service is HIPAA-eligible, and the workflow built on top of it can be HIPAA-compliant once your end of the requirements is in place: policies, training, BAAs with every business associate in the chain, breach-notification plan, the lot.

That distinction matters because of how vendors market. Almost every fax service in the category will tell you they're "HIPAA-compliant." Some use the phrase as shorthand for "we're HIPAA-eligible and we'll sign a BAA." Others use it loosely without an actual BAA process. The way to tell the difference: ask one question — "Can I see your BAA?" A vendor with a real compliance posture sends one under NDA in a day or two. A vendor without one either invents terms on the fly or quietly fails to respond. This isn't a Faxify-specific point; it applies to every name on every comparison page in the category.

The three-layer model

Think of a HIPAA-eligible online fax service as three layers, each with its own compliance posture:

1. The software you interact with (the app, the web dashboard, the API). This is what the vendor builds and markets. It typically isn't itself a HIPAA-covered entity — it becomes a business associate upon BAA execution with the vendor.
2. The carrier layer (a carrier that signs BAAs with its customers, or a legacy ILEC). This is where the actual fax transmission happens over T.38 and the public switched telephone network. The carrier is the layer with carrier-grade HIPAA-eligible infrastructure.
3. The infrastructure layer (cloud storage, database, hosting). This is where your documents and account metadata live at rest. The infrastructure provider (a cloud provider that signs BAAs with its customers) is typically HIPAA-eligible under its BAA.

When you're evaluating a vendor, you're asking three questions across three layers:

1. Does the software vendor have a BAA with me?
2. Does the software vendor have BAAs with the carrier?
3. Does the software vendor have BAAs with their infrastructure providers?

A vendor that handles all three of those layers correctly is HIPAA-eligible. A vendor that handles only the first one — and assumes the rest will "just work" — is signing a contract they can't deliver on. The competitor pages worth reading are the ones that publish the chain. Almost none of them do.

---

Where your documents go: Faxify → SignalWire → GCP / Vercel

Here's every layer a document touches in Faxify, in order. We publish it so you can see exactly where your documents go.

A few things worth calling out about this table.

SignalWire carries the fax. Faxify sends faxes over SignalWire's carrier network. Faxify is not HIPAA compliant and does not sign Business Associate Agreements. Faxify's carrier and document-storage providers hold their own BAAs with Faxify; that covers their relationship with us and extends no HIPAA coverage to you.

Google Cloud is where documents live at rest. Faxify stores fax documents in Google Cloud Storage and account metadata in a PostgreSQL database (Neon, through Vercel). That answers the "where does my data sleep" half of the question. When a user deletes a fax (from the app, web, or via our MCP server), the document is cleared from Google Cloud Storage and from SignalWire's carrier records. Deletion is real. On free accounts, faxes and drafts older than one month are deleted automatically, together with their files and transmission metadata; when a paid subscription ends, the same rule applies after a 30-day grace period. There is no BAA-specific retention option, because Faxify signs no BAA.

Vercel hosts every Faxify web surface — one tier, one footprint. That includes www.faxify.com (this marketing site, which never sees your documents), app.faxify.com (the web app), mcp.faxify.com (our MCP server for AI integration), and our API. Documents are POSTed from the iOS, Android, or web apps to a Vercel-hosted endpoint, briefly handled by serverless functions, and then streamed onward to Google Cloud Storage (where they live at rest) and SignalWire (which transmits to the recipient). Some competitors split this differently (one host for marketing, another for the app); we keep every web surface on one host.

Amplitude sees usage events, never documents. Amplitude is our product analytics. It tells us which features get used, where users drop off in onboarding, and how the apps perform across platforms. The events we track are things like fax_sent, scanner_opened, cover_page_added, subscription_started: no document contents, no recipient fax numbers, no account-level identifiers that could be reverse-linked to a person. If a vendor's analytics stack does see PHI (and not all of them are explicit about whether it does), that's a chain link worth asking about.

---

How competitor HIPAA fax services actually work

Healthcare buyers tend to encounter four kinds of vendor pages when they search for "HIPAA-compliant fax service." Here's an honest read on the three biggest ones plus where Faxify lands. The point of this section isn't to bash competitors; it's to flatten the marketing copy into something a procurement-minded reader can compare apples-to-apples.

eFax Corporate

eFax's healthcare-tier product is eFax Corporate — the option most enterprise procurement teams already know by name.

• BAA available? Yes, on the Corporate tier.
• Pricing visibility? Quote-on-request. The published page leads to a sales-call funnel, not a number. Expect enterprise pricing — per-user seat costs and per-page billing on top.
• Trade-off: brand recognition is the moat. If your hospital has standardized on eFax and you don't have authority to introduce a new vendor, this is the path of least resistance.

RingCentral (healthcare plan)

RingCentral bundles fax with their voice + video + SMS platform, and offers healthcare-specific plans that include BAA support. The buyer profile is a clinic that wants one vendor for the whole communication stack.

• BAA available? Yes, on the RingCentral healthcare tier with HIPAA-specific controls enabled.
• Pricing visibility? Baseline plans are published; the healthcare tier is typically quoted. Entry-tier plans don't include the HIPAA configuration.
• Trade-off: the value is the bundle. If you already need RingCentral for voice or video, the fax line riding on top is incremental. If you only need fax, you're paying for capabilities you won't use.

Fax.Plus Enterprise

Fax.Plus has cleanly-published pricing tiers for non-HIPAA use, with a separate Enterprise tier that includes BAA support. This is the most transparent of the three on the "you can see the number before you call sales" question.

• BAA available? Yes, on the Enterprise tier specifically.
• Pricing visibility? $79.99/month annually for Enterprise, published. Cheaper tiers (Basic at $6.99/mo, Premium at $13.99/mo, Business at $27.99/mo) do not include a BAA.
• Trade-off: the BAA is on the Enterprise tier only, so any PHI workflow on Fax.Plus needs Enterprise.

Faxify

Where Faxify lands in this comparison is straightforward:

• BAA available? No. Faxify does not sign Business Associate Agreements, on any plan. We would rather say that plainly than let a buyer discover it after a migration. If a signed BAA is a hard requirement for your workflow, one of the three services above is the right choice and we will tell you so. Faxify is the wrong tool for PHI.
• Pricing visibility? Pricing is published, and every plan is non-HIPAA. Free tier (5 pages/month, no card). Paid plans for new sign-ups start at $7.99/month (or $5.83/month effective on the annual plan, which also includes a dedicated fax number for receiving). Professional ($9.99/month) and Elite ($14.99/month) are the higher-volume tiers: Professional ships Fine fax-resolution mode, Elite ships Super Fine, both add email and phone support. Basic and Standard ship Standard fax-resolution mode with email-only support. Faxify signs no BAA at any price.
• What else is in the box? Faxify is the only service in this comparison that also bundles a mobile scanner, PDF tools (merge, split, compress, reorder, convert), and cover-page customization in the same app. For an office running a fax service + Adobe Scan + Smallpdf, that's a three-app stack consolidated into one.
• Trade-off: Faxify operates in the US and Canada only, and is single-user.

For a per-tier pricing breakdown of all the major fax services, see Online Fax Pricing Compared (2026). For broader buyer recommendations across the category, see Best Online Fax Service in 2026.

---

Delivery confirmation is a record, not compliance

If a fax is ever disputed, the question that comes up is: "Can you prove that fax was received?"

There are two answers most vendors offer:

• "Sent." The file finished uploading to our server. This tells you nothing about whether the fax actually reached the recipient's machine. It's the equivalent of an email's "outbox" — the file left your hands, but you don't know if it arrived.
• "Delivered." The recipient's fax machine confirmed it received every page. The carrier negotiated the T.38 (or G.711 fallback) handshake, transmitted the pages, and received an end-of-page acknowledgement for each one.

Faxify reports "Delivered" only when the carrier (SignalWire) confirms end-of-page receipt at the recipient's machine. That's a timestamped delivery record you can pull from the app: fax ID, recipient number, page count, send timestamp, delivered timestamp.

Most competitors mark "Sent" when the upload completes. Some go further and report "Delivered" but only based on a server-side ACK that doesn't actually correspond to the recipient's machine confirming. If you're evaluating a fax service, ask exactly when the service flips the status to "Delivered" — and what the underlying signal is. The honest answer is "when the carrier confirms end-of-page at the recipient." Anything looser, and you don't have a delivery record.

A delivery confirmation is a record of transmission, not of compliance. For how delivery records work in court filings and service of process, see our online fax for law firms guide.

---

What you're still responsible for

No fax service — eFax Corporate, RingCentral, Fax.Plus, anyone — makes your workflow HIPAA-compliant on its own. The vendor's job is to be HIPAA-eligible, sign a BAA with you, and operate within its terms. Your job is everything else:

• Signed BAAs with every business associate in your chain. Not just the fax service — also your EHR, email host, cloud storage, billing platform, and any IT contractor with PHI access. The chain is only as strong as its weakest link.
• Workforce training and access controls. Who can access PHI, how access is provisioned and revoked, how audit logs are reviewed. The fax service ships a tool; the policies on top of it are yours.
• Breach notification plan. What happens if PHI is exposed via misdialed fax, lost device, or vendor incident. HIPAA has specific notification timelines, and the plan needs to exist before you need it.
• Verifying the downstream recipient. A fax service can deliver a document; it can't verify the person on the other end is the right one. Misdialed faxes are a real source of PHI exposure incidents.
• Risk analysis and risk management. HIPAA's Security Rule requires a documented risk analysis covering systems that touch PHI, including the fax workflow.

For broader background on the modernization conversation around fax in healthcare, see our analysis of digital faxing in 2026. For the buyer-side overview of online fax in general, see what online fax is.

---

Where Faxify stands on HIPAA

Here's the cleanest statement of where Faxify stands.

Faxify is a software service, and the honest answer is short: Faxify is not HIPAA compliant and does not sign Business Associate Agreements. Do not send PHI through Faxify.

Faxify's carrier and document-storage providers hold their own BAAs with Faxify; that covers their relationship with us and extends no HIPAA coverage to you.

In practical terms, that means:

• Every tier is non-HIPAA, free and paid alike. The free tier (5 pages/month, no credit card) is for evaluating the app.
• Faxify has no HIPAA path. No plan ships with a BAA and no custom plan adds one. If PHI is in scope, pick a vendor that signs — that is a straight answer, not a negotiating position. If your workflow does not involve PHI, everything else on this page still applies and Faxify is a reasonable choice.
• Pricing (published tiers). For new sign-ups, plans start at Standard ($7.99/month, or $5.83/month effective on the annual plan); Professional is $9.99/month and Elite is $14.99/month — page volumes scale across the tiers. (Basic, $4.99/month, is closed to new sign-ups; existing subscribers keep renewing at the same price.) Every annual plan includes a dedicated fax number for receiving. On monthly billing, Standard, Professional, and Elite include the number; only Basic monthly is send-only. Fax-resolution mode tiers too: Basic and Standard ship Standard mode, Professional ships Fine mode, Elite ships Super Fine. Email and phone support are on Professional and Elite; Basic and Standard get email-only support.
• For non-PHI work, you get the full toolkit. Built-in mobile scanner, PDF tools, cover-page customization with a visual signature for the "From / To / Re:" header, and the carrier-confirmed delivered status on every send. The single-app workflow is, by itself, a real argument against the three-app stack many offices run.

---

When Faxify is not the answer

Any workflow that involves PHI needs a vendor that will sign a BAA with you, and Faxify is not one. Among the vendors that do sign, the right fit depends on the workflow:

• Multi-user clinics with separate per-user logins. If your front desk has five staff each needing their own login on the same fax line, consider RingCentral healthcare or an enterprise eFax deployment.
• International fax destinations. For PHI workflows that need to fax internationally (rare but real — international referrals, foreign labs), eFax Corporate has broader coverage.
• Procurement processes that require a specific vendor name. If your hospital's IT department has already standardized on eFax Corporate or RingCentral, that vendor is usually the path of least resistance.
• Workflows that need integrated EHR connectors. If your workflow expects faxes to land in the patient chart automatically without manual filing, talk to your EHR vendor about their preferred fax integration.
• High-volume practices needing 5,000+ pages/month. At very high volume, an enterprise-tier vendor may have the economies of scale you need.

For broader recommendations on HIPAA-eligible online fax across more buyer profiles, see our hub post on the best online fax service.

---

FAQ

Is Faxify HIPAA-compliant?

No. Faxify is not HIPAA compliant and does not sign Business Associate Agreements. Do not send PHI through Faxify. This applies to every plan, free and paid, and to the MCP server. Faxify's carrier and document-storage providers hold their own BAAs with Faxify; that covers their relationship with us and extends no HIPAA coverage to you. If you handle PHI, use a vendor that will sign a BAA with you.

Do I need a BAA to send faxes containing PHI?

Yes. Under HIPAA, any vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity is a business associate and must have a signed Business Associate Agreement in place before that PHI is shared. That applies to your fax service the same way it applies to your EHR, your email host, and your billing platform. No BAA, no PHI — that's the rule, regardless of how "secure" the service markets itself.

What is the difference between "HIPAA-eligible" and "HIPAA-compliant"?

HIPAA-eligible means the service has the security controls and contractual posture (encryption, access controls, audit logs, willingness to sign a BAA) needed to be used in a HIPAA-compliant workflow. HIPAA-compliant is what the workflow is once all the pieces — the covered entity's policies, the BAAs with every business associate, the workforce training, the breach-notification plan — are in place. Vendors are eligible. Workflows are compliant.

How is Faxify different from eFax Corporate or Fax.Plus Enterprise for HIPAA workflows?

Two of the three sign BAAs; Faxify does not. Between the two that do, the differences are price, transparency, and what's bundled. eFax Corporate is enterprise-priced with quote-on-request — most healthcare buyers won't see a number until a sales call. Fax.Plus's HIPAA BAA is gated to the $79.99/month Enterprise tier. Faxify has no BAA at any tier and does not sign one, so it is not a candidate for any HIPAA workflow.

Where does Faxify store fax documents?

Faxify stores fax documents in Google Cloud Storage and account metadata in a PostgreSQL database (Neon, through Vercel). When a user deletes a fax (from the iOS app, Android app, web app, or via the MCP server), the document is cleared from storage and from carrier records at SignalWire. On free accounts, faxes and drafts older than one month are deleted automatically, together with their files and transmission metadata; when a paid subscription ends, the same rule applies after a 30-day grace period. There is no BAA-specific retention option, because Faxify signs no BAA.

What if the recipient I'm faxing isn't HIPAA-compliant?

That depends on the recipient, and it is decided on your side, not by a fax vendor. HIPAA permits PHI transmission to a recipient who is themselves a covered entity, business associate, or otherwise permitted recipient under the Privacy Rule. If the recipient handles PHI on your behalf as a vendor or contractor, you need a BAA with them. If the recipient falls outside that scope, that is a workflow question your compliance officer needs to weigh in on — no fax service can make that determination for you. Faxify is not HIPAA compliant and does not sign Business Associate Agreements. Do not send PHI through Faxify.

What does a fax "Delivered" status prove?

It proves the fax reached the recipient's machine. Faxify reports "Delivered" only when the recipient's fax machine confirms it received every page — carrier-confirmed at the SignalWire layer, not just when the file finished uploading. Most competitors report "Sent" when the file leaves their server, which tells you nothing about whether the fax reached the recipient. A delivery confirmation is a record of transmission, not of compliance.

---

For business volume

If you need higher page volumes or multi-account configurations, email hello@faxify.com or schedule a call with our founder, Jangul Aslam. You'll get a real person on email, phone, or video, never a chatbot dressed up as support.

Ready to send a fax?

Faxify is free for the first 5 pages every month, with no credit card and no trial. Paid plans start at $7.99/month (or $5.83/month effective on the annual plan, which adds a dedicated fax number for incoming faxes).

Download Faxify for iOS · Get Faxify for Android · Use Faxify on the Web

Don't need fax? Try NxtTools

NxtTools is our companion app — the same PDF tools, scanner, and document toolkit as Faxify, minus the fax core. Free, ad-supported, no account required. NxtTools is not HIPAA-eligible and is not the right tool for PHI workflows; it's the consumer-side companion for non-regulated document handling.

NxtTools at nxt.tools

Written by Zoya Aslam at Const Agility, LLC — makers of Faxify.