HIPAA and online faxing
What HIPAA actually requires from a fax vendor, what OnlyFaxes provides, and when a free fax tool is the right choice.
The short version
OnlyFaxes is not a HIPAA-covered entity. We do not sign Business Associate Agreements and do not claim HIPAA compliance. If your healthcare organization requires a BAA or certified HIPAA-compliant faxing, you should use a service that provides one.
That said, many people searching for “HIPAA fax” are individuals faxing their own medical records, not covered entities. If that describes you, read on.
What HIPAA actually requires
HIPAA applies to covered entities (healthcare providers, health plans, and healthcare clearinghouses) and their business associates (vendors that create, receive, maintain, or transmit protected health information on their behalf). A covered entity that faxes PHI through a third-party service needs a signed BAA with that service.
A BAA defines safeguards the vendor must implement, how breaches are reported, permitted uses of PHI, and audit obligations. Without a BAA, a covered entity risks HIPAA violations regardless of how secure the underlying tool is.
When you do not need a BAA
HIPAA does not regulate individuals acting on their own behalf. If you are a patient faxing your own intake forms to a clinic, sending your prescription refill request to a pharmacy, or forwarding your medical records to a new provider, you are not a covered entity and the fax service you choose is not your business associate. You can use any tool you are comfortable with, including OnlyFaxes.
This also applies to individuals faxing insurance claims, disability paperwork, or records requests on their own behalf.
What OnlyFaxes provides
- Encryption:AES-256 at rest, TLS in transit between your browser and our servers.
- Auto-deletion:Documents are automatically deleted after the retention period.
- No data selling:We do not sell, share, or use your documents for advertising, training, or analytics.
- No ads:Your fax arrives clean with no third-party branding or ads.
These measures provide a reasonable level of protection for everyday document faxing. They do not constitute HIPAA compliance and are not a substitute for a BAA.
When you should use something else
If any of these apply to you, use a service that signs BAAs:
- Your organization is a healthcare provider, health plan, or clearinghouse.
- You are a business associate handling PHI on behalf of a covered entity.
- Your compliance officer or legal team requires a signed BAA from every vendor in your workflow.
- You need audit trails, access controls, or breach-notification contractual obligations.
eFax offers HIPAA-eligible plans with BAA signing for enterprise customers. See our OnlyFaxes vs eFax comparison for a full breakdown of features and pricing.
Frequently asked questions
Is OnlyFaxes HIPAA compliant?
- No. OnlyFaxes is not a HIPAA-covered entity, does not sign Business Associate Agreements (BAAs), and does not provide HIPAA compliance certifications. If your organization requires a BAA, use a service that offers one.
Can I use OnlyFaxes to fax my own medical records?
- Yes. HIPAA regulates covered entities (healthcare providers, insurers, clearinghouses) and their business associates. If you are an individual faxing your own records to a doctor, insurer, or pharmacy, HIPAA does not regulate you or the fax tool you choose.
What security does OnlyFaxes provide?
- Every document is encrypted at rest with AES-256 and in transit over TLS. Uploaded files are automatically deleted after the retention period. We do not display ads, do not sell data, and do not use documents for training or analytics.
What is a Business Associate Agreement (BAA)?
- A BAA is a contract required by HIPAA between a covered entity and any vendor that handles protected health information (PHI) on its behalf. It defines safeguards, breach notification obligations, and permitted uses of PHI. OnlyFaxes does not sign BAAs.
Which online fax services offer HIPAA-eligible plans?
- eFax offers HIPAA-eligible plans with BAA signing for enterprise customers. Other services like RingCentral Fax and Biscom also offer HIPAA-compliant faxing. See our eFax comparison for more detail on what eFax provides.