Is OpenText HIPAA compliant? BAA by plan, covered services and exclusions

Short answer

OpenText's own data sheet names three services it signs BAAs for: OpenText Fax Cloud Connect, OpenText Fax (formerly RightFax), and OpenText Fax (formerly RightFax) Managed Services. If you are asking about OpenText HIPAA compliant fax, those are the services with a named BAA.

No OpenText page checked names a BAA for Core Content, Content Cloud or Documentum. Treat those as unknown until OpenText publishes a BAA position or confirms one in writing.

Which plans include a BAA

OpenText publishes no plan tiers for these services, and none are excluded by plan. The BAA is tied to the service and obtained by contract, not by upgrading to a tier.

Plan	BAA	How it is obtained	Extra cost
No plan tiers published	Available by contract	Through OpenText sales	Not published by the vendor

The standard BAA text is said to be published on cybersecurity.opentext.com/legal. That page could not be fetched, so this is unverified. For what the agreement means, see the HIPAA glossary: business associate agreement.

What the BAA covers and what it excludes

Covered by a BAA, per OpenText's data sheet:

• OpenText Fax Cloud Connect
• OpenText Fax (formerly RightFax)
• OpenText Fax (formerly RightFax) Managed Services

The data sheet sentence naming these services reads:. Coverage stops at these three named services.

Excluded, or at least not stated:

• OpenText Core Content, Content Cloud and Documentum (document management): no public BAA statement was found on the pages checked.

For a clinic, the practical difference is this. A BAA for the fax service covers the faxes themselves, such as referral packets, lab results or prior-authorization forms in transit through the covered service. It says nothing about an OpenText content repository where those documents might later be stored.

Security controls the vendor publishes

None of the controls below were found on the OpenText pages checked.

Control	Published status
Encryption in transit	Not published by the vendor
Encryption at rest	Not published by the vendor
Audit log	Not published by the vendor
Access controls	Not published by the vendor
SSO	Not published by the vendor
Data residency	Not published by the vendor
SOC 2	Not published by the vendor
HITRUST	Not published by the vendor
ISO 27001	Not published by the vendor

Absence from the pages checked is not a statement that a control does not exist. It means the control could not be sourced here. Ask OpenText for current documentation.

How to use OpenText with PHI

A BAA is one input. Compliance depends on the signed BAA, your configuration and your policies, not on the vendor name. Using a BAA-covered fax service does not by itself make an organization HIPAA compliant.

1. Sign the BAA for the exact service you will use before any PHI is sent. A BAA for Fax Cloud Connect does not extend to a different OpenText product.
2. Confirm in writing whether any document management product (Core Content, Content Cloud, Documentum) is in scope. If it is not, keep PHI out of it.
3. Configure access and user management so only the staff who handle referrals and records can send and receive faxes.
4. Set internal fax and document handling policies, such as who verifies a recipient number and what happens to misdirected faxes.
5. Train staff on those policies, including front-desk and records teams.
6. Review the integrations and downstream systems that receive faxed documents, such as email, shared drives or an EHR inbox. Each one that touches PHI needs its own BAA and controls.

Alternatives with a BAA

These vendors have a BAA available, each with its own conditions. The order is alphabetical and implies no ranking. For more, see HIPAA-compliant software by category.

• Adobe Acrobat: conditional; BAA tied to Acrobat Sign Solutions for enterprise.
• Adobe Acrobat Sign: conditional; same plan as above.
• Box: conditional; Enterprise plan. See Is Box HIPAA compliant?
• DocHub: conditional; Site License.
• Google Docs: conditional; Google Workspace plans and Cloud Identity accounts managed in the Admin console. See Is Google Docs HIPAA compliant?

Sources

Changes

No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.

Changes and FAQ

No changes recorded since first verification on 2026-10-28. See Recent changes in vendor HIPAA status for other vendors.

Does OpenText sign a BAA?

Yes, by contract, for the services named in its data sheet: OpenText Fax Cloud Connect, OpenText Fax (formerly RightFax) and OpenText Fax (formerly RightFax) Managed Services. No page checked names a BAA for other OpenText products.

Is OpenText fax HIPAA compliant?

HIPAA compliance is not a property of the product. A BAA is available for the three named fax services. Whether your use is compliant depends on the signed BAA, your configuration, your policies and staff training.

Does OpenText's BAA cover Core Content, Content Cloud or Documentum?

Not on any source checked. No OpenText page names a BAA for these document management products, so their status is unknown. Get written confirmation from OpenText before storing PHI in them.

How do I get a BAA from OpenText, and does it cost extra?

Request it through OpenText sales. The BAA is obtained by contract. Whether it costs extra is not published by the vendor. The standard BAA text is said to be on cybersecurity.opentext.com/legal, which is unverified.