HIPAA-compliant fax services: vendors with a BAA compared

Of the eight online fax services below, six make a BAA available on a named plan or contract (SRFax, iFax, Sfax, Fax.Plus, eFax and RingCentral). Two, HumbleFax and MyFax, are "unknown" because neither vendor publishes BAA terms. No fax service is "HIPAA compliant" as a product property. What you can verify is whether a BAA is available, on which plan, and how you get it signed.

Quick answer: which online fax services sign a BAA, and from which plan

Every verdict rests on the vendor's own BAA, legal, security or HIPAA pages; the sources and the verification date are listed at the end. In this table, conditional means the BAA is tied to a plan and to a request or signing step. It is not automatic, and it does not cover plans below the stated one. Unknown means we found no vendor source either way.

BAA by plan:

• SRFax: from the Healthcare Lite plan.
• iFax: from the Plus plan.
• Sfax: from the Plus plan.
• Fax.Plus: on Enterprise, after activating Advanced Security Controls.
• eFax: from eFax Business (also eFax Protect and eFax Unite). eFax Corporate signs under its enterprise contract.
• RingCentral: on paid RingEX plans (all tiers).
• HumbleFax and MyFax: unknown.

This directory is published by Chanty, Inc. Chanty does not offer a fax product and is not listed in this table. For other tool types, see HIPAA-compliant software by category.

Comparison table: BAA plan, how to get it, starting price

Order rule: verdict first (conditional before unknown), then by lowest published annual entry price among vendors that publish one, then vendors with no published price. Vendors that publish no price are not ranked by any other factor, and no placement is paid. Entry plans differ in page allowances, so the prices are not like-for-like.

Vendor	Verdict	BAA from plan	How to obtain	Pricing from	Encryption at rest	Audit log	SOC 2	Last verified
SRFax	Conditional	Healthcare Lite	Request via the contact form linked from the Healthcare Solutions page	$12.60/month (Healthcare Lite, 200 pages)	Not published by the vendor	Not published by the vendor	Not published by the vendor	2026-10-20
iFax	Conditional	Plus	Request from iFax support; provided as a signed BAA for healthcare clients	$24.99/month (Plus, 500 pages)	Yes	Yes	Yes	2026-10-20
Sfax	Conditional	Plus	Signed with the customer on request; a BAA form is listed under the vendor's protected HIPAA resources	$682/year (Plus, 700 pages/month, paid annually)	Yes	Yes	Not published by the vendor	2026-10-20
Fax.Plus	Conditional	Enterprise	Request and sign a BAA with Alohi after activating Advanced Security Controls on an Enterprise account	$79.99/month (Enterprise; annual billing $959.99/year)	Yes	Yes	Yes	2026-10-20
eFax	Conditional	eFax Business	Standard "eFax Business, eFax Protect and eFax Unite BAA" is part of the eFax Customer Agreement (legal page); eFax Corporate signs a BAA under its enterprise contract	Not published by the vendor	Yes	Yes	Not published by the vendor	2026-10-20
RingCentral	Conditional	Paid RingEX plans (all tiers)	BAA made available to paying Covered Entity customers; request through your RingCentral sales or account team (privacy contact: [email protected])	Not published by the vendor	Yes	Yes	Yes	2026-10-20
HumbleFax	Unknown	No vendor source found	No vendor source found	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor	2026-10-20
MyFax	Unknown	No vendor source found	No vendor source found	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor	2026-10-20

Notes on reading the table:

• "Not published by the vendor" means the vendor's pages do not state it. It does not mean the control is absent. Ask the vendor.
• SSO and data residency were not published by any of the eight vendors, so they are left out of the table.
• A "Yes" for SOC 2 means the vendor states it. Ask for the report itself instead of relying on a badge or a logo.

What counts as HIPAA-compliant fax

For PHI, an online fax service counts only if the fax vendor signs a BAA covering the sending, receiving and storage of fax pages, on the plan you actually buy.

The typical exclusions are free and consumer plans and mobile-only apps. Some vendors sign only on annual or business plans. Among the vendors above, SRFax starts at Healthcare Lite, iFax and Sfax at Plus, and Fax.Plus at Enterprise. A cheaper tier of the same brand is not covered by default.

Free HIPAA-compliant fax. None of the eight researched vendors has a free tier that we can confirm carries a BAA. Treat free fax as "unknown, assume no" until a vendor document says otherwise.

A BAA is necessary but not sufficient. It sets the vendor's obligations. It does not configure your user access, decide who may read an inbox, or train your front desk. For the agreement itself, read what a business associate agreement covers. For how this directory uses the word "compliant," read what 'HIPAA compliant' means for a tool.

Vendor-by-vendor notes

Source dates are 2026-10-20 for every entry.

SRFax: conditional. BAA from Healthcare Lite, at $12.60/month for 200 pages. Request it through the contact form linked from the Healthcare Solutions page. Encryption at rest, audit log and SOC 2 are not published by the vendor.

iFax: conditional. BAA from Plus, at $24.99/month for 500 pages. Request it from iFax support, which provides a signed BAA for healthcare clients. The vendor states encryption at rest, an audit log and SOC 2.

Sfax: conditional. BAA from Plus, at $682/year for 700 pages/month, paid annually. The BAA is signed with the customer on request, and a BAA form is listed under the vendor's protected HIPAA resources. The vendor states encryption at rest and an audit log. SOC 2 is not published by the vendor.

Fax.Plus: conditional. BAA on Enterprise only, at $79.99/month ($959.99/year on annual billing). You request and sign the BAA with Alohi after activating Advanced Security Controls on an Enterprise account, so the BAA depends on a configuration step as well as the plan. The vendor states encryption at rest, an audit log and SOC 2.

eFax: conditional. The standard "eFax Business, eFax Protect and eFax Unite BAA" is part of the eFax Customer Agreement on the vendor's legal page. eFax Corporate signs a BAA under its enterprise contract. Pricing is not published by the vendor. The vendor states encryption at rest and an audit log.

RingCentral: conditional. The BAA is available to paying Covered Entity customers on paid RingEX plans (all tiers). Request it through your sales or account team. Pricing is not published by the vendor. The vendor states encryption at rest, an audit log and SOC 2.

HumbleFax: unknown. HumbleFax publishes no page stating whether a BAA is available. This is not a "no." If you hold a HumbleFax BAA or HIPAA page, send it to the editors. We change the verdict only with a vendor source.

MyFax: unknown. Same position as HumbleFax. No vendor source was found, so no verdict beyond "unknown."

How to choose: questions to ask before sending PHI

Ask these in writing before the first PHI fax goes out. A typical failure is a front desk that signs up on a cheap plan the week before a referral workflow starts.

1. Is the BAA signed and on file, and does it name your plan? A BAA for Plus does not cover an account left on a lower tier. For Fax.Plus, confirm Advanced Security Controls are active before you rely on the agreement.
2. Does the BAA cover storage and fax-to-email? Inbound faxes often land in a mailbox or a PDF archive. Ask whether stored pages and email delivery are inside the agreement's scope, and how long pages are retained.
3. Which controls does the vendor publish? Encryption at rest, an audit log and SOC 2 are in the table above. Where the table says "Not published by the vendor," ask for the document. For SOC 2, request the report and check its scope covers the fax service.
4. Who is responsible on the receiving side? Shared inboxes, forwarding rules to ordinary email, and former employees who still have access sit with you, not the vendor.

Fax versus email, phone systems and document management

Fax stays in use because the other party requires it: a specialist's referral intake, a pharmacy, a payer or a records department. If your side controls the channel, a secure alternative may fit better. For messages, see HIPAA-compliant email. If the fax line is already bundled with your telephony, see HIPAA-compliant phone systems. RingCentral appears in both categories, and its BAA scope for fax is flagged above for confirmation. If faxed records end up in a records system, check HIPAA-compliant document management for the same BAA-by-plan question.

A fax API for developers is a separate topic. This table compares online fax services for staff use and does not compare fax API vendors.

Shared responsibility and what a BAA does not do

A BAA does not make an organization compliant. Your risk analysis, access management, device security, staff policies and training stay with you. For fax, that means deciding who can send and read, removing access at offboarding, and keeping printed or downloaded pages out of unsecured places.

Once a fax is received, it often moves into a shared drive or an internal workflow. That step is a different category with its own BAA question, covered at HIPAA-compliant file sharing. Internal team chat is also a different category and is not a substitute for a fax service.

How we verify and update this table

Each verdict rests on the vendor's own BAA, legal, security or HIPAA page, checked on 2026-10-20. The verdict rules:

• Yes: a vendor source states BAA availability without conditions on plan or step. No fax vendor currently meets this.
• Conditional: a vendor source states a BAA with a plan, request or configuration step.
• No: a vendor source states it will not sign.
• Unknown: no vendor source. We never infer a verdict from reviews or third-party blogs.

Changes are logged under recent changes in vendor HIPAA status.

HIPAA Compliant Wiki is owned and published by Chanty, Inc. Chanty is listed in the directory as one vendor among others, and it does not offer fax. Placement in this table never depends on payment or on Chanty's interest.

FAQ

Is there a free HIPAA compliant fax service?

We cannot confirm one. No researched vendor's free tier is confirmed to carry a BAA, and the paid entry points start at SRFax's Healthcare Lite ($12.60/month for 200 pages). Without a vendor document stating a BAA for a free plan, do not send PHI through it.

Does a fax service need to sign a BAA?

If the service sends, receives or stores PHI for a covered entity, it generally acts as a business associate, and a BAA is expected before PHI is used. The BAA must cover the plan and features you use.

Is eFax HIPAA compliant?

The verdict is conditional, verified 2026-10-20. The standard "eFax Business, eFax Protect and eFax Unite BAA" is part of the eFax Customer Agreement on the vendor's legal page, and eFax Corporate signs a BAA under its enterprise contract. That is a BAA available on named plans, not a property of every eFax account.

Which fax service is cheapest with a BAA?

Among vendors that publish a price, SRFax is lowest: $12.60/month for Healthcare Lite, 200 pages. Next are iFax at $24.99/month (Plus, 500 pages), Sfax at $682/year (Plus, 700 pages/month, annual) and Fax.Plus at $79.99/month (Enterprise, $959.99/year annual). Page allowances differ, and eFax and RingCentral do not publish entry pricing. Compare cost per page you actually send.

Is fax to email HIPAA compliant?

It depends on whether your BAA covers email delivery of faxes and where the email lands. Forwarding a fax to an ordinary mailbox moves PHI outside the fax vendor's scope. None of the vendors here addresses this point in its published terms.

Is a fax API covered by the same rules?

The same BAA principle applies: the vendor must sign a BAA for the API service you use, on your plan. This page does not compare fax API vendors, so no fax API verdicts are given here.