HIPAA Fax Requirements for Medical Practices (2026)

Medical practices still use fax for referrals, medical-record requests, laboratory results, claims documentation, and communication with organizations that do not share the same electronic system. HIPAA does not ban these workflows, but it does require practices to protect patient information throughout the process. The main HIPAA fax requirements are to verify recipients, limit access, safeguard electronic records, document activity, train staff, and use appropriate vendor agreements. A fax platform cannot make a practice compliant by itself; the surrounding policies, people, email accounts, devices, and storage practices also matter. This guide provides general operational information and is not legal advice.

Is Faxing HIPAA Compliant?

Yes. A medical practice may fax protected health information when the disclosure is permitted and reasonable safeguards are used. HHS guidance on communicating patient information identifies safeguards such as confirming an unfamiliar fax number with the intended recipient and pre-programming frequently used numbers to reduce errors.

A fax is not automatically secure because it uses a traditional phone line. Likewise, a cloud service is not automatically compliant because it advertises encryption. Whether a workflow qualifies as a HIPAA compliant fax process depends on how information is prepared, transmitted, received, accessed, stored, retained, and deleted.

HIPAA Fax Requirements Checklist

Requirement	What Medical Practices Should Do	Common Risk
Recipient verification	Confirm new or unfamiliar fax numbers before sending PHI	Using an outdated form, directory, or handwritten number
Authorized access	Restrict physical and digital access to approved staff	Shared passwords, inboxes, or unattended fax machines
Vendor review	Determine whether a Business Associate Agreement is required	Relying only on a HIPAA-ready marketing claim
Secure handling	Protect transmitted and stored electronic documents	Copies remain in email, downloads, or shared folders
Auditability	Keep sender, recipient, time, status, and delivery records	No reliable history of who sent or accessed a document
Staff procedures	Use a documented process for sending and receiving faxes	Each employee follows a different method
Incident response	Define what happens after a fax is sent incorrectly	Errors are handled informally or not reported
Retention	Apply an approved storage and deletion schedule	Fax documents are stored indefinitely

These safeguards should reflect the practice's size, technology, risks, and workflow. A solo practice may use a simpler process than a multi-location medical group, but both need clear accountability, access controls, and incident-response procedures.

Does a Cloud-Fax Provider Need a BAA?

A Business Associate Agreement may be required when a fax provider creates, receives, maintains, or transmits PHI on behalf of a covered entity. According to HHS business associate guidance, a covered entity must obtain appropriate written assurances that a business associate will safeguard the information it handles.

For cloud fax, review more than the transmission itself. Confirm that the agreement covers every feature your practice plans to use.

• Email-to-fax and fax-to-email delivery
• Sent and received document storage
• Temporary processing queues
• Backups and cloud archives
• User, access, and delivery logs
• Technical-support access
• Third-party integrations and subcontractors
• Security-incident and breach reporting
• Data return, retention, and deletion

A general privacy policy, security page, or HIPAA-friendly label is not a substitute for an appropriate BAA. Confirm that the agreement applies to the exact plan, features, integrations, and storage options your practice will use.

Traditional Fax vs. HIPAA-Compliant Online Fax

Consideration	Physical Fax Machine	Online or Cloud Fax
Access	Controlled mainly by physical location	Individual users and role permissions may be available
Paper exposure	Documents may remain on an output tray	Documents can remain digital
Audit trail	Usually limited to a transmission confirmation	May include the user, recipient, time, status, and delivery history
Remote access	Usually limited or unavailable	Available through approved accounts and devices
Storage	Paper files or device memory	Email, online portal, or cloud archive
Primary risk	Misdialing, exposed paper, and unsecured disposal	Account, email, device, forwarding, and permission risks
Administration	Hardware, toner, phone line, and filing	User access, mailbox, retention, and security policies

A properly configured HIPAA compliant online fax workflow may make access control, centralized administration, and auditing easier. It does not remove the practice's responsibility for recipient verification, staff training, document handling, and incident response.

Dial Raven's online fax service for business supports email-to-fax, fax-to-email, encrypted transmission, cloud records, and audit trails. Medical practices should confirm the appropriate BAA, product configuration, access settings, and internal safeguards before using any communication platform for PHI.

How to Set Up a Secure Cloud-Fax Workflow

1. Inventory Existing Fax Activity

List every fax number, department, user, document type, provider, connected inbox, and storage location. Identify where patient information is copied, downloaded, printed, forwarded, or retained.

2. Separate Fax Workflows by Purpose

Group faxes into categories such as referrals, records requests, laboratory communication, pharmacy communication, claims attachments, prior authorization, and patient-requested delivery. This distinction is important because the CMS claims-attachment rule does not apply to every healthcare fax.

3. Configure Individual User Access

Avoid shared credentials. Give staff only the access needed for their responsibilities, and remove access promptly when an employee changes roles or leaves the practice.

4. Protect Connected Email Accounts

Email-to-fax and fax-to-email can create additional copies of PHI. Review multi-factor authentication, shared mailbox membership, automatic forwarding, mobile access, attachment downloads, sent-item retention, and account-removal procedures.

5. Test and Monitor the Workflow

Test inbound and outbound delivery before retiring a fax machine or porting an existing number. After launch, review failed transmissions, unusual destinations, account changes, and user activity. Confirm that staff understand how to report errors.

HIPAA Rules for Faxing Medical Records

The HIPAA rules for faxing medical records should be converted into a consistent staff procedure rather than handled from memory. Before sending a medical record, confirm that the disclosure is permitted, verify the recipient and fax number, review the document, remove unrelated pages, use an approved system, and check the delivery result.

• Confirm the purpose of the disclosure and the authorized recipient
• Verify new or unfamiliar fax numbers directly with the recipient
• Check that the document belongs to the correct patient
• Remove pages or information that should not be included
• Use only an approved fax account or physical machine
• Add an appropriate cover sheet when required by policy
• Review the delivery confirmation and investigate failures
• Store or delete copies according to the practice's retention policy

A fax cover sheet may help identify the intended recipient, sender, page count, and instructions for an unintended recipient. It is only one safeguard and does not replace number verification, access controls, secure storage, or incident-response procedures.

What Changes Under the CMS Claims-Attachment Rule?

In March 2026, HHS finalized CMS-0053-F, which adopts standards for electronic healthcare claims attachments and electronic signatures used with those transactions. The rule became effective on May 26, 2026, and covered entities must comply by May 26, 2028 for applicable transactions they conduct electronically.

Claims attachments are supporting documents a health plan may need to process a claim, including clinical notes, operative reports, diagnostic results, and other requested medical documentation. The rule adopts standardized transactions and document formats, including X12 and HL7 C-CDA standards.

Date	CMS Claims-Attachment Milestone
March 24, 2026	Final rule published in the Federal Register
May 26, 2026	The final rule became effective
2026 to 2028	Covered organizations review, test, and implement applicable workflows
May 26, 2028	Compliance required for applicable electronic transactions

Does the CMS 2028 Rule Ban All Medical Faxing?

No. The CMS claims attachment rule 2028 does not create a blanket ban on every healthcare fax. It focuses on standardized attachments exchanged in support of healthcare claims. The CMS claims-attachment FAQs also state that the final rule does not establish attachment standards for prior-authorization transactions.

Medical practices should identify which existing faxes are claims attachments and work with payers, clearinghouses, EHR providers, billing partners, and technology vendors on the transition. Referrals, records exchange, pharmacy communication, patient-requested delivery, and other fax workflows are not automatically eliminated by CMS-0053-F, although they must still meet applicable privacy and security requirements.

What If PHI Is Faxed to the Wrong Number?

A misdirected fax should be handled through the practice's documented privacy and security incident-response process. Staff should not quietly ignore the error or attempt to resolve it without notifying the designated person.

• Notify the designated privacy or security contact
• Preserve the transmission and delivery records
• Contact the unintended recipient when appropriate
• Request return or secure destruction of the document
• Document the information and individuals involved
• Complete the required privacy and breach assessment
• Follow applicable notification procedures
• Correct the process or control that caused the error

Not every incorrect fax has the same legal outcome. The organization should evaluate the specific facts under its approved procedures and applicable requirements.

Questions to Ask a Cloud-Fax Provider

• Will the provider sign an appropriate Business Associate Agreement?
• Which products, plans, and features does the agreement cover?
• Can each staff member have an individual user account?
• Are role-based permissions and multi-factor authentication available?
• What user, access, and delivery events are recorded?
• Where are fax documents stored and for how long?
• Can retention and deletion settings be configured?
• How are email-to-fax and fax-to-email protected?
• Can the practice keep its existing fax number?
• How are security incidents reported?
• What support is available during number porting and migration?

Connect Fax With the Complete Medical Communications Workflow

Fax should not be reviewed in isolation. Patient calls, voicemail, text messages, appointment reminders, recordings, and fax documents may all involve PHI. A complete medical office phone system should define how every communication channel is accessed, monitored, retained, and escalated.

Practices should coordinate fax procedures with their HIPAA-compliant VoIP, secure voicemail, and HIPAA-compliant texting policies so employees follow one consistent approach across every communication channel.

Frequently Asked Questions

HIPAA fax requirements involve more than replacing a physical machine. Medical practices must coordinate vendor agreements, user access, connected email accounts, document handling, audit records, staff procedures, and the CMS transition. Dial Raven combines virtual fax with healthcare calling, voicemail, routing, and business messaging. Request a free healthcare communications review to evaluate your current fax number, workflow, access requirements, and migration options.