HIPAA (the Health Insurance Portability and Accountability Act of 1996) is U.S. legislation created to improve healthcare standards. Covered entities (CEs) and their business associates (BAs) must be HIPAA compliant to protect the rights and privacy of patients and their protected health information (PHI). We know the HIPAA industry is vast and that sending important documents securely to other providers or to patients is fundamental to patient care. This is especially true with the recent digital transformation in healthcare and the current need to function more remotely.
Today, we will determine if Fax.Plus is HIPAA compliant or not, and we'll explain why you should consider using HIPAA compliant email instead.
About Fax.PlusFax.Plus is one of several online fax service providers that offer fax numbers for sending and receiving faxes through a web portal, by email, and/or even via mobile apps. The Swiss company offers services through all platforms. Customers sign up for one of five flexible pricing plans from Free to Enterprise depending on their needs. Users can send and receive faxes internationally and keep their current fax number if desired.
Fax.Plus and the business associate agreementA BA is a person or entity that performs certain functions or activities that involves the use or disclosure of PHI on behalf of a CE. In this instance, Fax.Plus is a BA for a healthcare organization if it transmits or stores PHI. RELATED: Is a Name PHI? Generally, the HIPAA Privacy Rule allows CEs to disclose PHI to a BA if they receive assurance that the information is protected through a signed business associate agreement (BAA). Fax.Plus will sign a BAA with users of its Enterprise plan. CEs must first sign up for the highest tier then request a BAA.
Fax.Plus and securityThe company utilizes cybersecurity safeguards to meet HIPAA requirements for securing PHI and electronic PHI (ePHI). Once a CE joins the Enterprise tier and signs a BAA, HIPAA compliant advanced security controls are enabled. Instituted policies and procedures include:
- Access controls
- Encryption for data at rest and in motion
- Audit controls
- User authentication
- No storage option
- Proper data disposal
- Physical safeguards
- Cybersecurity training for personnel