iFax says it signs a business associate agreement (BAA) for healthcare clients on request, at no charge, for its online fax service. Whether your plan qualifies is not stated by the vendor, so get the signed BAA before faxing any PHI.
Conditional A BAA is available on request from iFax support for healthcare clients, HIPAA is listed on the pricing page from the Plus plan, and the vendor does not state which plans qualify. Verdict date: 2026-10-20.
Short answer
iFax offers a Business Associate Agreement (BAA) on request from its support team, at no charge, for the iFax online fax service. The pricing page lists HIPAA from the Plus plan upward. It does not say which plans qualify for a BAA.
The condition is simple: a signed BAA must be in place before any PHI goes through the service. Without one, treat iFax as unsuitable for lab results, referral packets, prior-authorization forms or any other PHI.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Plus | Available on request; plan scope not published by the vendor | Request from iFax support; provided as a signed BAA for healthcare clients | None stated by the vendor |
| Pro | Available on request; plan scope not published by the vendor | Request from iFax support; provided as a signed BAA for healthcare clients | None stated by the vendor |
| Enterprise | Available on request; plan scope not published by the vendor | Request from iFax support; provided as a signed BAA for healthcare clients | None stated by the vendor |
The gap matters. The pricing page lists HIPAA from Plus, but the vendor does not publish which plans the BAA applies to. A practice on a lower tier cannot assume coverage. The Plus plan starts at $24.99/month for 500 pages.
What the BAA covers and what it excludes
Covered:
- The iFax online fax service.
Excluded:
- No exclusions are published by the vendor on the pages checked.
The absence of listed exclusions does not confirm that nothing is excluded. The signed BAA text governs. Read it for anything about storage, retention, support access or subcontractors.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
The directory reports these as the vendor's own statements and does not audit them. The vendor publishes no encryption algorithm or key-management details. Request the SOC 2 and ISO 27001 reports if your security review requires them.
How to use iFax with PHI
Signing a BAA covers only part of the work. For background on BAAs and who is responsible for what, see the HIPAA guides. A practical checklist for a clinic or an MSP:
- Sign the BAA before sending PHI. A verbal assurance from a sales rep is not a BAA.
- Confirm in writing which plan the BAA covers. The vendor does not publish plan scope, so ask support and file the reply with the BAA.
- Verify recipient fax numbers. A misdialed number is a disclosure. Keep a verified directory for referral partners, pharmacies and labs.
- Manage user accounts and offboarding. Remove departed staff the same day. Because access controls and SSO are not published, ask support what account-level controls exist.
- Set internal policy on what may be faxed. Define which document types can go out by fax and which need another channel.
- Train staff. Cover cover sheets, number checks and what to do after a misdirected fax.
- Keep the BAA on file in the vendor inventory. Record the plan, signing date and renewal terms.
Compliance depends on the signed BAA, your configuration and your organization's policies, not on the fax service alone.
Alternatives with a BAA
All of these carry a conditional verdict:
- eFax: BAA from eFax Business.
- Fax.Plus: BAA on Enterprise.
- RingCentral: BAA on paid RingEX plans, all tiers.
- Sfax: BAA on Plus.
- SRFax: BAA on Healthcare Lite.
Compare all fax vendors side by side in the fax category table, or browse HIPAA-compliant software by category.
Sources
- Best Secure Fax Services for Healthcare (Updated 2026) — Vendor page, checked 2026-10-20. "Yes. iFax provides a signed Business Associate Agreement (BAA) for healthcare clients."
- Best HIPAA-Compliant Fax Services – iFax — Help article, checked 2026-10-20. "Every fax is encrypted, logged, and covered by a signed BAA."
- iFax Pricing — Pricing page, checked 2026-10-20. "HIPAA compliant"
- HIPAA-Compliant Fax — Trust center, checked 2026-10-20. "HIPAA, SOC 2 & ISO 27001 compliant."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Does iFax sign a BAA?
Yes, for healthcare clients, on request from iFax support, according to the vendor's own page. The BAA covers the iFax online fax service.
Does iFax charge for a BAA?
The vendor states no charge.
Which iFax plans include HIPAA support?
The pricing page lists HIPAA from the Plus plan. The vendor does not state which plans qualify for a BAA, so confirm the plan with iFax support in writing before sending PHI.
Is the iFax app HIPAA compliant?
The covered service the vendor lists is the iFax online fax. App-specific scope is not published by the vendor. Ask support whether the mobile app falls under the BAA before staff fax PHI from phones.