SRFax will sign a business associate agreement (BAA) on request for its Healthcare fax plans, which cover its healthcare online fax service (email to fax and fax to email). It does not state whether its non-healthcare plans are eligible, and it publishes few security controls.
Conditional A BAA is available on request for the eight Healthcare plans (Healthcare Lite through Healthcare Professional Premium). The main exclusion is that the vendor does not say whether non-healthcare plans can get one. Verdict date: 2026-10-20.
Short answer
SRFax offers a "Request a BAA" form, linked from its Healthcare Solutions page, for its Healthcare fax plans. The agreement covers SRFax healthcare online fax (email to fax / fax to email).
Whether your use of SRFax meets HIPAA depends on the signed BAA, how you configure the account and your own policies. Signing a BAA does not by itself make a practice compliant.
Healthcare plan pricing starts at $12.60/month (Healthcare Lite, 200 pages), as of the check date in the Sources section. For other vendors, see all vendor HIPAA checks.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Healthcare Lite | Available on request | Contact form linked from the Healthcare Solutions page | Not published by the vendor |
| Six further Healthcare plans | Available on request | Same form | Not published by the vendor |
| Healthcare Professional Premium | Available on request | Same form | Not published by the vendor |
- Excluded plans: the vendor lists none.
- Minimum seats or volume: not published by the vendor.
- Non-healthcare plans: the vendor does not state whether they are eligible for a BAA.
What the BAA covers and what it excludes
Covered:
- SRFax healthcare online fax (email to fax / fax to email).
Excluded:
- The vendor publishes no excluded features.
- It also does not state whether non-healthcare plans are eligible, so this page treats that as unknown rather than as covered or excluded.
A BAA covers only the vendor's own service. It does not extend to the mailbox you send from, the phone or workstation where a fax is opened, or a shared inbox that receives fax-to-email deliveries. A clinic that emails a referral to fax from a personal webmail account has a gap the SRFax BAA does not close.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published" does not mean "absent." It means an evaluator cannot confirm the control from the vendor's own pages and should ask for it in writing.
How to use SRFax with PHI
Terms such as BAA and PHI are defined in the glossary. A practical checklist:
- Sign the BAA before any PHI is sent or received.
- Use a Healthcare plan, since those are the plans the vendor ties to the BAA.
- Secure the email accounts and devices used for email-to-fax, with strong passwords and multi-factor authentication where the email provider offers it.
- Limit who has access to the SRFax account, and remove staff who leave.
- Verify fax numbers before sending and train front-desk staff on misdials, for example by confirming a recipient's number by phone before the first fax.
- Ask SRFax in writing about unpublished controls such as encryption at rest and audit logs, and file the answer with your vendor inventory.
Compliance depends on the signed BAA, your configuration and your policies.
Alternatives with a BAA
Other fax services also offer BAAs. The list is in no particular order. For a category view, see HIPAA-compliant fax services.
- Is eFax HIPAA compliant?: conditional, BAA from eFax Business.
- Is Fax.Plus HIPAA compliant?: BAA on the Enterprise plan.
- Is iFax HIPAA compliant?: BAA on the Plus plan.
- Is RingCentral HIPAA compliant?: BAA on paid RingEX plans, all tiers.
- Is Sfax HIPAA compliant?: BAA on the Plus plan.
Sources
- HIPAA Compliant Fax Service — Pricing page, checked 2026-10-20. "Need us to sign a Business Associate Agreement? We are happy to work with organizations in the healthcare sector"
- HIPAA Compliance — Trust center, checked 2026-10-20. "SRFax is the only HIPAA-compliant fax for healthcare that will sign a Business Associate Agreement."
- Security and Privacy — Trust center, checked 2026-10-20. "By default, we include SSL encryption, firewalls, a dedicated cyber-security team"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Does SRFax sign a BAA?
Yes, on request, for its Healthcare plans. The request goes through the "Request a BAA" form linked from the Healthcare Solutions page.
Which SRFax plans can get a BAA?
The eight Healthcare plans, from Healthcare Lite through Healthcare Professional Premium. The vendor does not list excluded plans, and it does not state whether non-healthcare plans are eligible.
Is there an extra cost for the SRFax BAA?
The vendor does not publish a BAA fee or a minimum number of seats. Confirm both in writing when you request the agreement.
Can I send PHI on a non-healthcare SRFax plan?
The vendor does not state it. Until SRFax confirms in writing that a non-healthcare plan is covered by a signed BAA, treat it as unconfirmed and use a Healthcare plan for PHI.