A HIPAA secure fax service is not a technology; it is a vendor that will sign a business associate agreement for the plan you buy and then handles the stored copies the way that agreement says. The transmission itself was never the problem. What decides whether an online fax service is HIPAA compliant is what happens to the pages on the vendor's servers, who can read them, how long they stay, and whether the vendor has accepted the obligations of a business associate in writing. The Fax Line Index records, for every vendor, whether that statement is printed on its own pricing page, beside the entry price and the page allowance, so the test below can be applied from the vendor's own words rather than from a sales call.
The BAA is the test, and it is printed or it is not
A practice that sends protected health information through a service makes that service a business associate under the HIPAA Privacy Rule, and a business associate has to accept its obligations in a written agreement before the first page moves. So the first question for any HIPAA secure fax offer is whether the vendor's own page states a BAA on the plan being bought, not on an enterprise tier three steps up. WestFax prints a signed BAA on every plan, including Solo at $14.99 a month with 500 pages and a 3¢ overage per extra page. eFax's Business plan card prints HIPAA compliance with a Business Associate Agreement, with the offer starting at $14.99 and 500 pages included. Where a vendor's page is silent, the index records the silence rather than assuming.
What a compliant service does with the stored copy
An online fax is received into an account, stored, and usually forwarded to an email inbox. Each of those steps is a place where a copy of a patient's page can sit. A HIPAA compliant online fax service encrypts the stored copy, lets the account owner set who can open it, keeps an access log, and lets the practice decide how long inbound faxes are retained. The fax-to-email step matters most: a PDF forwarded to an ordinary mailbox leaves the vendor's controls and lands in whatever the practice's mail provider does with it. Vendors that take compliance seriously offer a secure portal or an encrypted notification instead of the attachment itself, and the practice should choose that option on day one.
Reading the best HIPAA-compliant online fax lists
Every vendor in this category publishes a list in which it is the best online fax service HIPAA compliant buyers should choose. The index takes a narrower view: it ranks by the entry price the vendor prints, records the page allowance and the overage beside it, and notes the BAA statement verbatim with the date it was read. On that basis the HIPAA class currently spans Fax.Plus at $6.99 a month with 200 pages and a $0.10 overage, CocoFax at $9.99 with 60 pages, iFax at $12.49 with 200 pages, WestFax at $14.99 with 500 pages, and Documo at $25 a month billed annually with 300 pages and a $0.15 overage. The right one is the plan whose allowance matches the practice's monthly page count, because overage is where the cheap entry price stops being cheap.
Questions people ask about hipaa secure fax
Is a fax automatically HIPAA compliant?
No. A point-to-point machine fax has no stored copy in the middle, which is why it was tolerated, but an online service stores pages on its servers and is a business associate. It is compliant only with a BAA and the safeguards the agreement describes.
Does the cheapest HIPAA plan cost more later?
Usually through the overage. Fax.Plus prints $0.10 per extra page beyond 200, Documo $0.15 beyond 300, WestFax 3¢ beyond 500. Count the practice's real monthly pages before choosing on the entry price alone.
Can I keep using fax to email?
Yes, if the vendor's email delivery is a secure link or an encrypted message rather than a plain PDF attachment, and if the practice's mailbox is itself covered. Ask the vendor to show the option before signing.