People search for a HIPAA compliant fax machine because a compliance officer told them the old one was a problem. The honest answer is that no machine is compliant or non-compliant on its own: a fax machine in a locked room whose pages are collected promptly and shredded on schedule satisfies the rules, and the same machine in a hallway does not. A HIPAA compliant fax app moves the stored pages to a vendor that has accepted the obligations in writing, which is why practices switch. This page sets the two side by side and says what the rules actually ask of each.
Is fax HIPAA compliant? The machine case
A traditional fax is a point-to-point phone call between two machines, with no copy held by anyone in between, and that is why regulators tolerated it for decades. What the rules require of a practice using one is physical: the machine sits where only staff can reach it, inbound pages are not left in the tray, the cover sheet identifies the recipient and carries a confidentiality notice, the number is dialled carefully and confirmed, and the transmission report is kept. Misdials are the recurring breach. A machine cannot be bought into compliance; the office procedures around it are the compliance, and the auditor will ask to see them written down.
The app case: the burden moves to the vendor
A HIPAA compliant fax app receives the practice's faxes into an account on the vendor's servers and shows them on a phone or a browser. The stored copy makes the vendor a business associate, so the practice needs a signed BAA for the plan it buys, and the app needs per-user logins, an access log and retention the practice controls. In return the hallway problem disappears: nothing prints, nothing sits in a tray, and a misdirected inbound fax lands in an account rather than on paper. WestFax prints a signed BAA on every plan, including Solo at $14.99 a month with 500 pages; eFax's Business plan card prints HIPAA compliance with a Business Associate Agreement. Those statements are the reason an app can be called compliant where a machine cannot.
What HIPAA compliance fax rules ask of both
Whichever path the practice takes, three things are required and neither a machine nor an app supplies them by itself. A written policy naming who may send protected health information by fax and how numbers are verified. A cover sheet that carries a confidentiality statement and instructions for a wrong recipient. A record of what was sent, to whom, and when, kept for the retention period the practice's policy sets. A machine leaves that record on a paper transmission report; an app keeps it as a log the practice can export. The app wins on the third point and on removing paper from the office; the machine wins only where the phone line is already paid for and the volume is tiny. The index prices the app side so the comparison is a number.
Questions people ask about hipaa compliant fax machine
Do I have to replace the fax machine to be compliant?
No. You have to control where it sits, who collects from it and how misdials are prevented and recorded. Many practices replace it because the app makes those controls automatic.
Is a fax app on a personal phone allowed?
Only under the practice's device policy, with a per-user login, a screen lock and the ability to revoke access. The vendor's BAA covers the vendor, not the phone.
Does a compliant app cost more than a machine?
The app plans in the index start at $6.99 a month at Fax.Plus and reach $25 a month at Documo. A machine costs a phone line, toner and the staff time that the app removes.