Unknown HumbleFax's terms refer to a "HIPAA BAA document" that may be signed, but no plan is published as BAA-eligible and no BAA availability is stated. Verdict date: 2026-10-20.
If you found the $10/month plan and want to know whether it can carry PHI, the answer is that nothing public says it can. Treat the service as off-limits for PHI until a signed BAA is in your hands.
Short answer
HumbleFax makes no public statement that it offers a BAA. The site has no HIPAA page, no compliance page and no BAA page. Its homepage lists a single plan, Unlimited Faxing at $10/month.
Without a signed BAA, do not send PHI through the service. "Unknown" is not a "yes". For the same check on other tools, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Unlimited Faxing ($10/month) | Not published by the vendor | Not published by the vendor | Not published by the vendor |
The $10/month price comes from the HumbleFax homepage. No plan is named as BAA-eligible, and no add-on or upgrade for a BAA is described.
What the BAA covers and what it excludes
Covered services: none published.
Excluded features: none published.
HumbleFax publishes no BAA terms on the pages reviewed, so the scope of any agreement cannot be stated. That means no list of covered services, no exclusions and no conditions.
The one relevant passage is in the terms. In substance, it says the company takes on no obligations regarding protected health information unless a "HIPAA BAA document" is signed. Only the phrase in quotation marks is reproduced verbatim. The clause tells you a signed document is the dividing line, but it does not say HumbleFax will sign one, for whom, or on what terms.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Absence of publication is not evidence of absence. If you want to evaluate HumbleFax, ask the vendor in writing for each of these items and for its BAA terms.
How to use HumbleFax with PHI
Fax is a common route for referrals, lab results and prior-authorization paperwork, so an unapproved service tends to get used quietly by front-desk staff. Before anyone sends a referral through it, work through this list. Terms such as BAA and PHI are defined in the HIPAA glossary, and the HIPAA guides cover the surrounding process.
- Get a signed BAA from HumbleFax in writing before any PHI is sent or received.
- Confirm which plan and which services the BAA covers, and whether the $10/month plan is included.
- Keep PHI out of the service until the signed document is on file. That includes test faxes using real patient information.
- Set user access and offboarding: who can send and receive, and how access is removed when someone leaves.
- Write fax-number and cover-sheet policies, such as verifying recipient numbers and using a standard confidentiality notice.
- Train staff on what may and may not be faxed and what to do after a misdirected fax.
- Record the decision, the BAA date and the reviewer in your vendor inventory.
Compliance depends on the signed BAA, your configuration and your policies, not on the tool alone.
Alternatives with a BAA
These fax and fax-adjacent vendors publish a BAA path. Each card has its own source and date. Order is alphabetical and does not reflect payment or preference.
- eFax: conditional, BAA from eFax Business.
- Fax.Plus: conditional, Enterprise.
- iFax: conditional, Plus.
- RingCentral: conditional, paid RingEX plans, all tiers.
- Sfax: conditional, Plus.
"Conditional" means a BAA is available only on the named plan and for the services in that vendor's terms. To compare more tools, browse HIPAA-compliant software by category and open the fax category.
This directory is published by Chanty, Inc., which has no relationship with HumbleFax or the vendors above.
Sources
- Terms and Conditions — Terms, checked 2026-10-20. "Unless a HIPAA BAA document is signed, you agree not to impose any independent obligations upon the company when using the Services to store any "protected health information""
- HumbleFax — Pricing page, checked 2026-10-20. "Premium Features (no additional cost)"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Does HumbleFax offer a BAA?
There is no public statement that it does. The terms mention a "HIPAA BAA document" that may be signed, but no BAA offer, plan or process is published on the pages reviewed. The directory does not say HumbleFax refuses a BAA, only that none is published.
Can I send PHI with HumbleFax's Unlimited Faxing plan?
Not without a signed BAA, and none is published for the plan. The $10/month plan is not described as BAA-eligible, and "Premium Features (no additional cost)" on the homepage does not mention a BAA.
What does HumbleFax's terms of service say about protected health information?
In substance, the terms say the company has no obligations regarding PHI unless a "HIPAA BAA document" is signed. They do not say who can obtain that document, on which plan, or what it covers.
Does HumbleFax publish encryption, SOC 2 or audit-log details?
Not on the pages reviewed. No encryption, audit-log, access-control, SSO, data-residency, SOC 2, HITRUST or ISO 27001 information is published. Request it from the vendor in writing before making a decision.