HIPAA-compliant online fax: how to choose a service (and where Chanty fits)

You can use an online fax service with protected health information (PHI) when the vendor signs a Business Associate Agreement (BAA) on the plan you actually buy, and when the service gives you encryption, per-user access, audit logs and retention controls that your practice configures and follows. Chanty does not offer fax today. We plan to build a fax tool, so this guide is written to help you choose any fax service, not to sell ours. Chanty appears only where it is real: coordinating the internal staff work that a fax creates.

Short answer: what makes online fax HIPAA compliant

No fax service, fax app or fax machine is "HIPAA certified." HHS does not certify products for HIPAA. HIPAA applies to how your organization handles PHI. A vendor can support your compliance with safeguards and a signed BAA, but using a tool does not make your practice compliant.

At minimum, look for:

• A signed BAA that covers the fax service you use.
• Encryption of faxes in transit and at rest.
• Access controls per user, so each staff member has their own login and you can remove access.
• Audit logs that record who sent, received, viewed or downloaded each fax.
• Retention and deletion controls, so faxes are not kept longer than your policy allows.

Several of these items reflect the technical safeguards in the HIPAA Security Rule, such as access control, audit controls and transmission security.

Who signs the BAA, and on which plan, matters. Many fax vendors offer a BAA only on specific tiers. A lower-priced plan from a vendor that signs BAAs may not include one. Check the plan you will pay for, not the vendor's general HIPAA page.

Chanty fax status: Fax is planned and is not available in Chanty today. This page is a guide until it ships.

Checklist: questions to ask any HIPAA fax service

Send these questions to each vendor in writing and keep the answers with your vendor file.

1. Will you sign a BAA, on which plan, and at what price? Get the signed BAA before anyone sends or receives PHI through the service. A BAA that arrives after go-live leaves a gap.
2. How are faxes encrypted in transit and in storage? Ask about every path a fax takes. Web portal, mobile app, email-to-fax and fax-to-email can each be handled differently. With fax-to-email, PHI attachments can end up sitting in standard inboxes or being forwarded unencrypted.
3. Can we set per-user access, require 2FA or SSO, and remove users at offboarding? A shared login for the front desk means you cannot tell who opened a lab result or a records request. When a staff member leaves, you should be able to remove their access the same day.
4. Are audit logs available, and how long are they kept? The log should show who sent, received, viewed or downloaded each fax and when. Ask whether you can export logs for a privacy review.
5. Where are faxes stored, for how long, and can we set retention and deletion rules? Confirm whether deleted faxes are removed from backups and what happens to your stored faxes if you cancel.
6. What happens on a misdial or a failed send? The vendor controls the transmission. Your team controls the procedure. For cover sheet wording, number verification and what to do when a fax goes to the wrong recipient, see our guide to HIPAA fax requirements and disclaimers.

Vendor check: eFax, iFax, HumbleFax and Doximity fax

These are the vendors practice staff ask about most. Use the questions and table below to record what each vendor states about HIPAA and BAAs, with the source and the date you checked it. This is not a ranking. Vendor policies and plans change, so confirm the current terms directly with the vendor before you sign.

eFax and eFax Corporate. eFax is sold in consumer and business versions, and eFax Corporate is aimed at organizations. Whether a BAA is available, and on which version, is the main question. Also ask whether encryption and audit trails are documented for that plan, and whether the mobile app is covered under the BAA.

iFax. Ask whether iFax offers a BAA, which plan includes it, and which HIPAA features (encryption, audit logs, user management) apply to that plan.

HumbleFax. For "Is HumbleFax HIPAA compliant?", use the vendor's own wording rather than a summary. Ask the vendor for its current HIPAA and BAA statement in writing, along with the plan that includes a BAA.

Doximity fax. Doximity is a network for clinicians, and its fax feature is offered to its members. Eligibility affects whether it suits a front desk or admin team. Confirm who can sign up, what it costs and what the vendor states about HIPAA and BAA terms before relying on it.

Service	BAA available (Y/N, plan)	Encryption claim	Audit logs	Free tier	Date verified
eFax	Confirm with vendor	Confirm with vendor	Confirm with vendor	Confirm with vendor	Record when checked
eFax Corporate	Confirm with vendor	Confirm with vendor	Confirm with vendor	Confirm with vendor	Record when checked
iFax	Confirm with vendor	Confirm with vendor	Confirm with vendor	Confirm with vendor	Record when checked
HumbleFax	Confirm with vendor	Confirm with vendor	Confirm with vendor	Confirm with vendor	Record when checked
Doximity fax	Confirm with vendor	Confirm with vendor	Confirm with vendor	Confirm with vendor	Record when checked

Vendor terms change. Confirm BAA availability and plan details with the vendor in writing before sending PHI.

For other tools your staff may already use, see more popular tools checked for HIPAA.

Free and cheap HIPAA fax: what to watch for

Free tiers often exclude a BAA. If there is no signed BAA, do not send or receive PHI through the service. That includes referrals, lab results, records requests and insurance forms with patient identifiers. If a vendor offers a free tier, ask directly whether it includes a BAA.

Compare the cheapest plan that includes a BAA, not the headline price. A low entry price can apply to a plan without a BAA. Ask each vendor for the current price of its lowest plan that includes a BAA.

Look for hidden costs:

• Per-page overages. A clinic that receives daily referral packets and records requests can exceed a page allowance quickly. Check last month's page count before you choose a tier.
• Number porting. Keeping your existing fax number avoids reprinting letterhead and updating every referring office, but porting may carry a fee or a delay.
• Extra users. If the BAA plan prices per user, giving each front desk and billing staff member their own login (which audit logs depend on) adds cost.
• Extra numbers per location. Multi-location groups often need a number for each site.

HIPAA-compliant fax machines and fax servers

A physical fax machine is not HIPAA compliant on its own. The risk comes from how it is set up and used:

• Placement. A machine in a hallway or next to the patient check-in window lets anyone pick up an incoming referral. Put it in a staff-only area.
• The output tray. Assign someone to clear incoming faxes on a schedule so pages do not sit overnight.
• Stored memory. Many machines and multifunction copiers keep images of sent and received pages in internal memory or on a hard drive.
• Disposal. Clear or remove the memory before a machine is returned at lease end, sold or recycled.
• Confirmed numbers. Program frequently used numbers, such as the hospital records department or a specialist's office, and verify them periodically.
• Cover sheets. Use a confidentiality statement on every fax that carries PHI. Our confidential fax cover sheet template is free to download and edit.

On-premise fax servers move faxes into your network and often into email or a shared folder. That brings the server, the storage location and everyone with access to it inside your security program. Whether any outside party involved is a business associate or only a conduit depends on what that party does with the data. A carrier that only transmits a fax differs from a service that stores it. Ask your privacy officer or counsel to confirm how this applies to your setup.

HIPAA-compliant fax and email: keeping the two together

Most online fax services connect to email in two directions:

• Email-to-fax. Staff send a fax by emailing a PDF to an address the vendor converts into a fax.
• Fax-to-email. Incoming faxes arrive in a staff inbox as attachments.

Both workflows are convenient, and both add an email leg that needs the same safeguards as the fax itself. A faxed referral that lands as an attachment in a standard inbox can be read on an unmanaged phone, forwarded outside the practice or kept long after your retention period.

Ask two questions:

1. Does the fax vendor's BAA cover the email delivery path, or only the fax transmission and portal? Ask for the relevant BAA language in writing.
2. Does your email provider have its own BAA with you, and is email encryption configured for messages that contain PHI?

Keep patient names and other identifiers out of subject lines, and do not forward fax attachments to personal accounts. The HIPAA fax rules guide covers these procedures in more detail. Some forms that practices fax today, such as signed authorizations, can move to electronic signature instead. See our HIPAA-compliant e-signature guide for what to check. Intake and other patient forms can also be collected with a HIPAA-compliant form builder instead of by fax.

Where Chanty fits today: the internal work a fax creates

A received fax usually creates work for staff. A referral needs to be scheduled. A records request needs to be fulfilled. A prior-authorization form needs to be completed and returned. Chanty coordinates that internal follow-up between staff. It does not send, receive or store faxes, and it does not replace your EHR or your fax service.

Here is how a front desk team might use it:

• Turn a message into a task. The person who clears the fax inbox posts "New referral from [practice], needs scheduling" in the front desk channel, turns it into a task, assigns it to a scheduler and sets a due date.
• Track it on the Kanban board. Open requests, in-progress forms and completed items are visible to the clinic manager, so a records request does not sit unanswered for a week.
• Share files and procedures. Keep your fax procedure, misdial steps and cover sheet in the workspace so new staff can find them.
• Control who sees what. On Business and Enterprise, roles and permissions (120+ settings) control who can access which conversations. You can keep billing follow-up separate from front desk chatter.

PHI rules in Chanty: Messages, files and voice notes can contain PHI on the Business or Enterprise plan only after a BAA is signed. The Free plan has no BAA and must not be used for PHI. Chanty encrypts data in transit with TLS 1.2+ and encrypts file storage. Your practice remains responsible for configuring permissions, managing user access and offboarding, device security, and staff training. Third-party integrations, such as file storage or automation tools, sit outside Chanty's BAA scope. Evaluate any connected tool and its own BAA separately.

Learn more about HIPAA-compliant chat for staff and review Chanty security, HIPAA and BAA.

Chanty fax: planned, and what we will publish when it ships

Fax is on our roadmap and is not available today. This page includes no dates, prices or feature commitments. When a fax tool ships, we will publish what it does, which plans include it and what the BAA covers, using the same checklist we gave you above.

Until then, use our free HIPAA tools and templates, including the cover sheet template and the HIPAA fax rules guide, alongside the fax service you choose.

To coordinate the follow-up work your faxes create, try Chanty for staff chat and tasks. A BAA is available from the Business plan.

FAQ

Is there such a thing as a HIPAA-certified fax service?

No. HHS does not certify products for HIPAA, so any "HIPAA certified" label is marketing, not a government certification. Look for a signed BAA and the safeguards in the checklist above.

Is eFax HIPAA compliant, and does it sign a BAA?

eFax is sold in consumer and business versions, including eFax Corporate, and the answer depends on the version and plan you buy. Confirm which version and plan includes the BAA before sending PHI.

Is HumbleFax HIPAA compliant?

Ask HumbleFax for its current HIPAA and BAA statement in writing, and check which plan includes a BAA. Whatever the vendor states, your practice still needs a signed BAA and its own procedures.

Does iFax offer a BAA?

Ask iFax directly whether it signs a BAA and which plan includes it, and get the signed BAA before sending PHI. Vendor terms change, so check the current plan rather than an older review.

Is Doximity fax HIPAA compliant, and who can use it?

Doximity's fax feature is offered to members of its clinician network. Confirm current eligibility, pricing and the vendor's HIPAA and BAA terms directly. Check eligibility first, because it determines whether non-clinician staff can use it.

Is there a free HIPAA-compliant fax service?

Free tiers often exclude a BAA. Without a signed BAA, do not use a service for PHI. If a vendor offers a free tier, ask whether it includes a BAA.

Are traditional fax machines HIPAA compliant?

Not on their own. Placement in a staff-only area, verified numbers, cover sheets, prompt clearing of the tray and wiping memory at disposal determine the risk.

Is fax-to-email HIPAA compliant?

It can be used with PHI only if the email leg is covered and safeguarded. Ask whether the fax vendor's BAA covers email delivery, and confirm your email provider's BAA and encryption settings.

Does Chanty offer online fax?

No. Fax is planned and is not available today. Chanty is used for staff chat, calls, files and tasks alongside the fax service you choose.

Can staff discuss a received fax containing PHI in Chanty?

Yes, on the Business or Enterprise plan after a BAA is signed, and within your practice's policies and permission settings. Do not use the Free plan for PHI. Integrations connected to Chanty are outside its BAA scope.