Is eFax a HIPAA compliant fax service? (2026 update)

eFax is a cloud-based online fax service, owned and operated by Consensus Cloud Solutions, that enables individuals and businesses to send and receive faxes digitally without a traditional fax machine.

With eFax, users can transmit fax documents via email, a mobile app, or a secure web portal, with options tailored to regulated industries that require enhanced security and compliance.

Is eFax HIPAA compliant? Yes, eFax can be HIPAA compliant, but there are limitations.

What changed this year?

As of February 2026, our review did not identify any publicly disclosed changes to eFax HIPAA-related policies or BAA terms.

Will eFax sign a business associate agreement (BAA)?

Yes, eFax will sign a business associate agreement, which can be reviewed here.

What does the eFax BAA cover?

The eFax BAA covers the use and disclosure of protected health information (PHI), stating, "eFax offers solutions with specialized tools that address distinct compliance and operational challenges. Each product secures specific workflows, from document transmission and data extraction to electronic signatures and interoperability. Organizations select the solutions that match their compliance gaps and integration requirements."

Their BAA covers:

• Protection of PHI
• Notifications of security incidents
• Access by HHS requests
• Individual Right of Access requests
• Individual accounting requests
• Return of PHI

What does the eFax BAA exclude?

The standard eFax Plus and eFax Pro plans do not offer a BAA and are not positioned by eFax as HIPAA compliant solutions. Only the eFax Protect plan and the eFax Corporate plan include BAA coverage.

Conclusion

eFax may be HIPAA compliant, but only when used on the eFax Protect or eFax Corporate plans,

Learn more: HIPAA Compliant Email: The Definitive Guide

FAQS.

What is a business associate agreement?

A business associate agreement (BAA) is a legally binding contract establishing a relationship between a covered entity under the Health Insurance Portability and Accountability Act (HIPAA) and its business associates. The purpose of this agreement is to ensure the proper protection of personal health information (PHI) as required by HIPAA regulations.

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) sets national standards for protecting the privacy and security of certain health information, known as protected health information (PHI).

HIPAA is designed to protect the privacy and security of individuals’ health information and to ensure that healthcare providers and insurers can securely exchange electronic health information. Violations of HIPAA can result in significant fines and penalties for covered entities.

Who does HIPAA apply to?

HIPAA applies to covered entities, which include healthcare providers, health plans, and healthcare clearinghouses. It also applies to business associates of these covered entities. These are entities that perform certain functions or activities on behalf of the covered entity.