Conditional A business associate agreement (BAA) is available on eFax Business, Protect, Unite and Corporate for the cloud fax service; the main exclusions are the Personal plan (Plus/Pro) and any service outside the "Secured Service". eFax is owned by Consensus Cloud Solutions, Inc. Last verified: 2026-10-20. This is one entry in the Is it HIPAA compliant? All vendors directory. Chanty, Inc. publishes this directory and has no relationship with eFax or Consensus.
Short answer
A BAA is available on eFax Business, Protect and Unite as a standard addendum within the eFax Customer Agreement, and on eFax Corporate under the enterprise contract. It applies to the cloud fax service.
The Personal plan (Plus/Pro) is marketed as HIPAA compliant but has no BAA. Without a signed BAA, a clinic should not send PHI through it, whatever the marketing page says.
Which plans include a BAA
The table lists where a business associate agreement is available, based on the vendor's own pages.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| eFax Business | Yes | Standard BAA is part of the eFax Customer Agreement (legal page) | Not published by the vendor |
| eFax Protect | Yes | Standard BAA is part of the eFax Customer Agreement (legal page) | Not published by the vendor |
| eFax Unite | Yes | Standard BAA is part of the eFax Customer Agreement (legal page) | Not published by the vendor |
| eFax Corporate | Yes | BAA under the enterprise contract | Not published by the vendor |
| eFax Personal (Plus/Pro) | No | None | Not published by the vendor |
The pricing page says all plans feature HIPAA-compliant encryption, but only the Business plan includes the signed BAA. Encryption on a plan without a BAA does not make that plan usable for PHI.
What the BAA covers and what it excludes
Covered:
- eFax Business cloud fax
- eFax Protect
- eFax Unite
- eFax Corporate
Excluded:
- Other Consensus Cloud Solutions services, unless a separate BAA covers them. The BAA applies only to the "Secured Service".
- The Personal plan (Plus/Pro), which has no BAA.
The legal page defines the Secured Service in section 24:.
For a practice, this means a fax sent through a covered plan is within the agreement. A fax sent through a different Consensus product, or a scan stored in a tool outside the Secured Service, is not covered by this BAA.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Yes |
| ISO 27001 | Not published by the vendor |
"Yes" means the vendor states the control exists. No algorithm, key-management or scope details are published in the sources below.
How to use eFax with PHI
Compliance depends on the signed BAA, configuration and internal policies, not on the product alone. Use this checklist before faxing PHI:
- Confirm the account is on Business, Protect, Unite or Corporate.
- Sign or confirm the BAA before the first PHI fax. Keep a copy with the vendor file.
- Do not use Personal (Plus/Pro) for PHI.
- Keep PHI within the Secured Service. Do not forward faxes into tools without their own BAA. For a comparison of how another file-handling vendor is checked, see Is Dropbox HIPAA compliant?.
- Manage user access and offboarding. When a front-desk employee leaves, remove their account the same day.
- Set internal policies and train staff, for example on verifying a recipient's number before sending referrals or lab results.
- Record eFax in the vendor inventory with the plan, the BAA date and the review date.
The wider checklists are in the HIPAA guides. A fax tooling guide is available at chanty.health/tools/fax/.
Alternatives with a BAA
The fax services below have a BAA on at least one plan. The order is alphabetical, not a ranking. Each is a conditional verdict, so check the plan before sending PHI.
- Fax.Plus: conditional; BAA from the Enterprise plan.
- iFax: conditional; BAA from the Plus plan.
- RingCentral: conditional; BAA on paid RingEX plans, all tiers.
- Sfax: conditional; BAA from the Plus plan.
- SRFax: conditional; BAA from the Healthcare Lite plan.
Other categories are in HIPAA-compliant software by category.
Sources
- Plans & Pricing — Pricing page, checked 2026-10-20. "While all plans feature HIPAA-compliant encryption, our Business Plan includes the signed BAA required for healthcare providers to remain fully compliant."
- Legal Notices & Patents – eFax — 24. eFax Business, eFax Protect and eFax Unite BAA — Terms, checked 2026-10-20. "“Secured Service” means the eFax Business, eFax Protect or eFax Unite service provided by Consensus US pursuant to the Agreement."
- HIPAA Compliant Healthcare Fax & Data Solutions | eFax — Trust center, checked 2026-10-20. "Products with BAA coverage: eFax® Business, eFax® Corporate, and eFax® Unite."
- Secure Fax for Business – Send & Receive Secure Faxes Online — Vendor page, checked 2026-10-20. "We sign Business Associate Agreements (BAA)."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes and FAQ
No changes recorded since first verification on 2026-10-20. Later updates appear under Recent changes in vendor HIPAA status.
Does eFax sign a BAA?
Yes, on specific plans. For Business, Protect and Unite, the standard BAA is part of the eFax Customer Agreement. For Corporate, it is part of the enterprise contract.
Does the eFax Personal (Plus/Pro) plan include a BAA?
No. The Personal plan is marketed as HIPAA compliant but has no BAA, so it should not be used for PHI.
Does the eFax BAA cover every Consensus service?
No. The BAA applies only to the "Secured Service". Other Consensus Cloud Solutions services are not covered unless a separate BAA applies.
Which eFax plans are covered by a BAA?
Business, Protect, Unite and Corporate. The pricing page names only Business as including the signed BAA, and the trust page lists Business, Corporate and Unite. Confirm the BAA in writing for the plan you buy.