Is a fax number from an online fax service automatically HIPAA compliant?

No. Compliance depends on the safeguards and the agreement, not the format. A clinic needs a signed business associate agreement with any vendor that stores or transmits PHI, and should confirm encryption, access controls and audit logging before sending a patient document.

Do I need a BAA for a fax service?

If the service creates, receives, maintains or transmits PHI for you, HHS treats it as a business associate and expects a BAA. FrontDeskClinic includes a BAA with every plan.

Can I keep my existing fax number?

Our setup copy covers choosing a new dedicated fax line in any available area code. Ask us about your specific number when you get in touch.

What does FrontDeskClinic do with a fax once it arrives?

It lands in your dashboard. On the Pro plan, AI fax reading and routing reads the fax and routes it to the right person or workflow.

HIPAA-Compliant Fax Service for Clinics

Why clinics still need fax

Fax is not going away in healthcare. Specialists, labs, payers and hospital systems still send referrals and records to a fax number, and a clinic that cannot receive them loses referrals. The risk is not the format. It is where the pages land: a paper tray in a hallway, a shared inbox, or a consumer fax app with no agreement behind it.

Moving to a cloud fax line solves the paper tray, but it creates a new question. The vendor now stores and transmits protected health information (PHI) for you, which makes it a HIPAA business associate.

What HIPAA expects from a fax vendor

HHS defines a business associate as a person or entity that creates, receives, maintains, or transmits PHI on behalf of a covered entity. A cloud fax provider that stores or relays your faxes fits that definition, so a clinic needs a signed business associate agreement (BAA) before using one. HHS is explicit that a covered entity using a cloud service provider to maintain ePHI without a BAA is in violation of the HIPAA Rules, and that this holds even when the provider only handles encrypted data.

The Security Rule then asks for administrative, physical and technical safeguards that protect the confidentiality, integrity and availability of electronic PHI. HHS does not endorse a specific technology, so the practical work is a vendor checklist.

A signed BAA, not just a sentence on a marketing page.
Encryption of faxes in transit and at rest.
Access controls so only the right staff see a given fax.
Audit trails showing who opened, forwarded or sent a document.
A named list of the vendor's own subprocessors.
A plan for a misdirected fax, which counts as a potential breach under the Breach Notification Rule.

Fax mistakes that cause trouble

The common failures are mundane: a wrong number typed from memory, a cover sheet with more detail than needed, and a received fax that sits unread because nobody owns the inbox. HHS's minimum necessary standard does not apply to disclosures to another provider for treatment, but it does cover many other disclosures, such as to payers, so a short cover sheet and only the pages needed is a sound default either way. A dedicated line with a routing rule for who reads incoming faxes removes the last problem, and a stored list of verified recipient numbers reduces the first.

How FrontDeskClinic handles fax

Fax is part of the same account as your phone line and secure texting, not a separate add-on.

A dedicated fax line, included with every plan.
Receive faxes in the dashboard with folders, a preview pane and details for each document.
Send fax documents from the dashboard, with cover sheets.
On the Pro plan, AI fax reading and routing, so a received fax is read and sent to the right staff member or workflow instead of sitting in a pile.
A Business Associate Agreement on every plan at no extra charge, plus end-to-end encryption and audit trails as listed on our FAQ.
Our subprocessor register is public on the Subprocessors page.

Talk to us about your clinic See pricing

Frequently asked questions

Is a fax number from an online fax service automatically HIPAA compliant?: No. Compliance depends on the safeguards and the agreement, not the format. A clinic needs a signed business associate agreement with any vendor that stores or transmits PHI, and should confirm encryption, access controls and audit logging before sending a patient document.
Do I need a BAA for a fax service?: If the service creates, receives, maintains or transmits PHI for you, HHS treats it as a business associate and expects a BAA. FrontDeskClinic includes a BAA with every plan.
Can I keep my existing fax number?: Our setup copy covers choosing a new dedicated fax line in any available area code. Ask us about your specific number when you get in touch.
What does FrontDeskClinic do with a fax once it arrives?: It lands in your dashboard. On the Pro plan, AI fax reading and routing reads the fax and routes it to the right person or workflow.

Sources

This page is general education, not legal advice. HIPAA obligations depend on your organization and circumstances; consult your compliance officer or counsel.

HIPAA-compliant fax service for medical clinics