Fax Compliance Rules
The Fax Compliance Rules carries 7 published figures read from 2 sources' own pages; the 6 published figures given without a breakdown run from 30 to 60 day, read 2 November 2026.
3 of the 14 named sources read in full publish a figure; 11 publish none, read 2 November 2026.
By rule
| Breakdown | Median | Range | Sources |
|---|---|---|---|
| rulejunk-fax opt-out request honored within 30 days (47 CFR 64.1200(a)(4)(vi)) | 30day | 30 to 30day | 1 |
| ruleretention 164.530(j) | 6year | 6 to 6year | 1 |
Every figure, with its source
One row per published figure: the figure as the source's own page publishes it, the page, and the day it was read. A figure that is not on a page we read is not on this one.
| Source | Figure | Breakdown | Read |
|---|---|---|---|
| HHS: the Breach Notification Rule | 60day | 2026-10-31 | |
| HHS: the Breach Notification Rule | 60day | 2026-10-31 | |
| HHS: the Breach Notification Rule | 60day | 2026-10-31 | |
| HHS: the Breach Notification Rule | 60day | 2026-10-31 | |
| eCFR 47 CFR 64.1200 junk fax rules | 30day | 2026-10-31 | |
| eCFR 47 CFR 64.1200 junk fax rules | 30day | 2026-10-31 | |
| eCFR 47 CFR 64.1200 junk fax rules | 30day | junk-fax opt-out request honored within 30 days (47 CFR 64.1200(a)(4)(vi)) | 2026-10-31 |
| eCFR 45 CFR 164.530 administrative requirements | 6year | retention 164.530(j) | 2026-11-02 |
The sentence each figure was read from (8)
- HHS: the Breach Notification Rule, read 2026-10-31:
Like individual notice, this media notification must be provided without unreasonable delay and in no case later than 60 days following the discovery of a breach and must include the same information required for the individual notice.
- HHS: the Breach Notification Rule, read 2026-10-31:
If a breach affects 500 or more individuals, covered entities must notify the Secretary without unreasonable delay and in no case later than 60 days following a breach.
- HHS: the Breach Notification Rule, read 2026-10-31:
Reports of breaches affecting fewer than 500 individuals are due to the Secretary no later than 60 days after the end of the calendar year in which the breaches are discovered.
- HHS: the Breach Notification Rule, read 2026-10-31:
A business associate must provide notice to the covered entity without unreasonable delay and no later than 60 days from the discovery of the breach.
- eCFR 47 CFR 64.1200 junk fax rules, read 2026-10-31:
(B) The notice states that the recipient may make a request to the sender of the advertisement not to send any future advertisements to a telephone facsimile machine or machines and that failure to comply, within 30 days, with such a request meeting the requirements under paragraph (a)(4)(v) of this section is unlawful;
- eCFR 47 CFR 64.1200 junk fax rules, read 2026-10-31:
(3) When notified by the Commission through its Enforcement Bureau that a Final Determination Order has been issued finding that an upstream provider has failed to comply with paragraph (n)(2) of this section, block and cease accepting all traffic received directly from the upstream provider beginning 30 days after the release date of the Final Determination Order.
- eCFR 47 CFR 64.1200 junk fax rules, read 2026-10-31:
that complies with paragraph (a)(4)(v) of this section must honor that request within the shortest reasonable time from the date of such request, not to exceed 30 days, and is prohibited from sending unsolicited advertisements to the recipient unless the recipient subsequently provides prior express invitation or permission t
- eCFR 45 CFR 164.530 administrative requirements, read 2026-11-02:
A covered entity must retain the documentation required by paragraph (j)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later.
Read in full, publishes no figure
11 named sources were read in full on the dates shown and print no usable figure. They are counted, never filled in.
- HHS: the HIPAA Security Rule, read 2026-09-11: read in full and no accepted figure on the page
- HHS: Security Rule guidance material, read 2026-10-03: every candidate on the page was refused
- HHS: business associates, read 2026-09-12: read in full and no accepted figure on the page
- HHS: sample business associate agreement provisions, read 2026-09-12: read in full and no accepted figure on the page
- HHS: the minimum necessary requirement, read 2026-09-12: read in full and no accepted figure on the page
- eCFR 45 CFR 164.312 technical safeguards, read 2026-10-31: read in full and no accepted figure on the page
- eCFR 45 CFR 164.502 uses and disclosures, read 2026-11-02: every candidate on the page was refused
- eCFR 45 CFR 164.504 organizational requirements, read 2026-10-31: read in full and no accepted figure on the page
- eCFR 45 CFR 164.402 breach defined, read 2026-10-24: read in full and no accepted figure on the page
- NIST SP 800-66r2 implementing the HIPAA Security Rule, read 2026-09-12: read in full and no accepted figure on the page
- NHS England: removal of fax machines from general practice, read 2026-09-19: read in full and no accepted figure on the page
Methodology
Every row is a verbatim sentence read from the named source's own page through our fetch service on the date shown, hash-pinned to the stored read (the sha of the page's visible text; the raw page is mirrored to R2).
3 of the 14 named sources that could be read published a usable figure; 11 published none and are recorded as not published, never filled in; 0 could not be read (blocked, dead or unreachable) and count nowhere.
The headline figures (median, minimum, maximum, quartiles) are over ONE figure per source for each breakdown it prices, in day (a source's median where its page yielded several accepted sentences for one breakdown), so a page that gives figures for several breakdowns gives one for each and N counts 3 figures, never sentences; 35 candidate sentence(s) were refused by a reviewer with the reason recorded.
The fuller derivation this dataset is chartered to grow into (not yet what the figures above are; they are each source's own published figure as read): one row per rule per regime, quoted verbatim from the authority with its citation and effective date (the Security Rule's transmission-security standard, the BAA provisions at 45 CFR 164.504(e), the six-year retention at 164.530(j), the breach test at 164.402, the opt-out notice at 47 CFR 64.1200), joined to a column that records, per vendor in the price index, whether the vendor's own page says it signs a BAA and at which plan - so the page answers 'is this service HIPAA compliant' with the rule and the vendor's own claim side by side, never with a badge
35 candidate sentences on these pages were refused by a reviewer; each refusal and its reason is recorded in the review ledger.
Sources (14)
- HHS: the HIPAA Security Rule(the publisher's own terms; quoted for reporting and comment)
- HHS: Security Rule guidance material(the publisher's own terms; quoted for reporting and comment)
- HHS: business associates(the publisher's own terms; quoted for reporting and comment)
- HHS: sample business associate agreement provisions(the publisher's own terms; quoted for reporting and comment)
- HHS: the minimum necessary requirement(the publisher's own terms; quoted for reporting and comment)
- HHS: the Breach Notification Rule(the publisher's own terms; quoted for reporting and comment)
- eCFR 45 CFR 164.312 technical safeguards(the publisher's own terms; quoted for reporting and comment)
- eCFR 45 CFR 164.502 uses and disclosures(the publisher's own terms; quoted for reporting and comment)
- eCFR 45 CFR 164.504 organizational requirements(the publisher's own terms; quoted for reporting and comment)
- eCFR 45 CFR 164.530 administrative requirements(the publisher's own terms; quoted for reporting and comment)
- eCFR 45 CFR 164.402 breach defined(the publisher's own terms; quoted for reporting and comment)
- eCFR 47 CFR 64.1200 junk fax rules(the publisher's own terms; quoted for reporting and comment)
- NIST SP 800-66r2 implementing the HIPAA Security Rule(the publisher's own terms; quoted for reporting and comment)
- NHS England: removal of fax machines from general practice(the publisher's own terms; quoted for reporting and comment)
Cite or embed this figure
Cite or embed this figure
The Fax Compliance Rules carries 7 published figures read from 2 sources' own pages; the 6 published figures given without a breakdown run from 30 to 60 day, read 2 November 2026.
3 of the 14 named sources read in full publish a figure; 11 publish none, read 2 November 2026.
Fax Compliance Rules, rule junk-fax opt-out request honored within 30 days (47 CFR 64.1200(a)(4)(vi)): median 30 day across 1 source, read 2 November 2026.
Fax Compliance Rules, rule retention 164.530(j): median 6 year across 1 source, read 2 November 2026.
Cite as: "Fax Line Index Fax Compliance Rules", updated 2026-11-06, https://faxlineindex.com/datasets/fax-compliance-rules/.
Download the CSV (8 rows, computed 2026-11-06)
Questions this data answers
What does the law require of a fax - the HIPAA safeguards and the business associate agreement, the retention period, and the junk-fax opt-out - and which service will sign a BAA?
The Fax Compliance Rules carries 7 published figures read from 2 sources' own pages; the 6 published figures given without a breakdown run from 30 to 60 day, read 2 November 2026.
Where do the figures in the Fax Compliance Rules come from?
Every figure is quoted from its source's own page and dated (last read 2 Nov 2026). 14 named sources were read and 3 publish a figure; the 11 that publish none are recorded as not published, never estimated.