Do I need a BAA for online fax?
If you send or receive protected health information through an online fax service, then yes — that provider is handling PHI on your behalf, which generally makes it a business associate, and HHS states that covered entities must have contracts in place with their business associates. If a provider will not sign a BAA, it should not carry your PHI.
What a BAA actually is
A Business Associate Agreement is a contract between a covered entity (your practice) and a vendor that handles PHI on your behalf. It sets out what the vendor may do with the PHI, requires them to safeguard it, and obliges them to report breaches to you. HHS provides sample BAA provisions on its website.
When you need one for fax
The trigger is simple: does the service create, receive, maintain or transmit PHI for you?
- You need a BAA if you fax patient records, referrals, lab results, insurance information tied to a patient, or anything else that identifies a patient and relates to their care or payment.
- You may not need one if the service never touches PHI at all — for example, a fax line used purely for non-patient business correspondence. In practice, in a clinical setting, this is rare.
- Traditional analog fax machine to fax machine over a phone line is treated differently from a cloud service that stores your documents. Once a vendor stores or processes your faxes, the business associate analysis applies.
The pricing trap to watch for
Several providers advertise a low entry price on a plan that does not include a BAA, with HIPAA coverage available only on a higher tier. The advertised price and the price you can lawfully use with PHI are not always the same number. To be fair, some of those higher tiers include real value — eFax Business, for example, includes multiple user licenses along with the signed BAA. The point is not that competitors are hiding something; it is that you should compare the plan that actually covers PHI, not the headline price.
What to check before you sign
A BAA is a legal document. Beyond confirming it exists, these are the practical questions:
- Is it included in this plan, or do I have to upgrade?
- How is it executed — instantly online, or by emailing PDFs back and forth?
- Does the vendor have BAAs with its own subprocessors (fax carrier, hosting provider)?
- What does it say happens to my PHI when the agreement ends?
- Can I download an executed copy for my records?
A BAA is not the finish line
Having a signed BAA is necessary, but it does not by itself make an organization compliant. HHS requires covered entities to conduct their own risk analysis and implement safeguards. The BAA covers the relationship with the vendor; your policies, training, access controls and documentation are still yours to maintain.
Primary sources.
We link to the original rule and guidance so you can verify anything here yourself.
This content is provided for general informational and educational purposes only and does not constitute legal, regulatory, compliance, or professional advice. HIPAA compliance depends on the specific facts, systems, policies, and practices of each organization. Organizations should consult qualified legal or compliance professionals regarding their specific obligations.
Last reviewed: 2026-07-19. Product features, pricing, and compliance offerings may change. Verify current terms directly with each provider before making a compliance or purchasing decision.
Questions worth asking.
If an online fax provider handles that PHI for you, it is generally a business associate, and HHS states covered entities must have contracts in place with business associates. Ask for the BAA before you send the first fax.
Then that provider should not be used for PHI. A refusal to sign is a clear signal, regardless of how the service markets its security features.
It depends on the provider. Several gate HIPAA coverage behind a higher tier, so the advertised entry price may not be the price you can lawfully use with PHI. Compare the plan that includes the BAA.
No. A BAA addresses your relationship with that vendor. Your organization still needs its own risk analysis, policies, workforce training and safeguards under the Security Rule.
Try it before you decide.
14 days free. No credit card. The BAA is signed in-app before you send a single page — and it stays included at every plan, forever.