HIPAA compliant fax? Online fax services that sign a BAA
Online fax services that sign a BAA — on which plans, how you put the agreement in place, and where incoming faxes land so patient information stays protected.
Online fax at a glance
An online fax service can carry patient information under HIPAA when the vendor signs a BAA for your plan — it stores and processes your faxes, so it is a business associate, unlike the phone company that only carries the signal — and you control where incoming faxes land and who can read them. We compare 6 products in Online fax. 4 sign a Business Associate Agreement (Documo Cloud Fax, eFax Corporate, RingCentral Fax, SRFax). 2 sign one only for certain plans or products (Fax.Plus, iFax). Every value links to the vendor's own documentation and shows when it was checked.
| Sign a BAA | Documo Cloud Fax, eFax Corporate, RingCentral Fax, SRFax |
|---|---|
| Only some plans or products | Fax.Plus, iFax |
| Products compared | 6 |
3 more facts
| Compared on | BAA without a sales process, BAA on entry-level team plans |
|---|---|
| Commissions | None — no vendor pays us |
| Facts checked since | 2026-10-17 |
Comparison
Alphabetical. No vendor pays us for listings, rankings or referrals — methodology.
| Product | Signs a BAA | BAA without a sales process | BAA on entry-level team plans |
|---|---|---|---|
| Documo Cloud Fax | Yes | Not verified | Yes |
| eFax Corporate | Yes | Not verified | Not verified |
| Fax.Plus | Conditional | No | No |
| iFax | Conditional | Not verified | Not verified |
| RingCentral Fax | Yes | Not verified | Not verified |
| SRFax | Yes | No | Not verified |
Found an outdated or wrong fact? Report it
What to check before you choose
- A BAA — a fax service that stores your faxes is not merely a conduit
- A phone company that only carries the signal is a conduit, not a business associate. An online fax service stores your faxes and gives you an inbox, so it is a business associate and needs a BAA on the plan you use (164.502(e)).
- Fax-to-email
- Incoming faxes delivered as email attachments put PHI in your mailbox. Use an email service under a BAA, or switch attachments off and read faxes in the fax service.
- Wrong numbers
- We recommend saved, verified numbers for frequent recipients; confirm a new or unfamiliar number with the intended recipient before sending PHI. Treat a fax containing PHI sent to the wrong number as a suspected privacy incident: contain it, establish what was disclosed and received, and apply the breach-notification assessment where required (164.402).
- Who can open the fax inbox
- One account per person, sign-in you control and an activity log let you meet access and audit requirements (164.312(a), (b)) for faxes as for any other system.
- How long faxes are kept
- Check whether the service keeps copies and for how long, move what belongs in the record into your EHR, and set automatic deletion where the service offers it.
Common mistakes
- Using a free online fax website that signs no BAA.
- Forwarding incoming faxes to a personal email address.
- Sending results to a new or unfamiliar number without confirming it with the recipient first.
How we compare
- BAA without a sales process
- You can put the BAA in place yourself — it is included in standard terms or accepted in account settings — rather than requesting it and waiting for approval.
- BAA on entry-level team plans
- The BAA is available on the vendor's entry-level business or team plan, not only on enterprise tiers.