Fax.Plus offers a BAA on its Enterprise plan only, for the Fax.Plus online fax service. A clinic sending referrals, lab results or prior authorization forms on the Free, Basic, Premium or Business plan has no BAA behind those faxes.
Is Fax.Plus HIPAA compliant? Verdict
Conditional A BAA is available on the Enterprise plan only; the Free, Basic, Premium and Business plans are excluded (last verified 2026-10-20).
Short answer
Fax.Plus makes a BAA available on the Enterprise plan for the Fax.Plus online fax service. The BAA is requested and signed with Alohi SA after Advanced Security Controls are activated on an Enterprise account. Without that signed agreement, an account is not set up to handle PHI. On any other plan, PHI would be sent with no BAA in place.
For other tools in the same position, see all vendor HIPAA checks.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Free | No | Not applicable | Not applicable |
| Basic | No | Not applicable | Not applicable |
| Premium | No | Not applicable | Not applicable |
| Business | No | Not applicable | Not applicable |
| Enterprise | Yes | Request and sign with Alohi after activating Advanced Security Controls | Not published by the vendor |
Enterprise is priced from $79.99/month, or $959.99/year on annual billing. Minimum seats: not published by the vendor.
An office manager who started on Business and later needs to fax PHI must move to Enterprise and complete the BAA steps first. Upgrading alone does not create a BAA; it has to be requested and signed.
What the BAA covers and what it excludes
Covered:
- Fax.Plus online fax
Excluded: the vendor lists no excluded features. The BAA applies to the online fax service only, and only on the Enterprise plan. Read the BAA text itself to confirm scope before sending PHI, particularly if your workflow touches anything beyond sending and receiving faxes.
Security controls the vendor publishes
These are statements Fax.Plus publishes, not the result of an audit or test by this site.
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
The vendor's stated detail is AES-256 encryption at rest and SSL/TLS with AES-128 or stronger in transit. The scope and reporting dates of the SOC 2 and ISO 27001 attestations are not given here, so ask the vendor for the reports if your vendor review requires them.
How to use Fax.Plus with PHI
A BAA is only one part of a compliant setup. The HIPAA glossary defines the term in full. Responsibility is shared between the vendor and your organization:
- Confirm the account is on the Enterprise plan.
- Activate Advanced Security Controls.
- Sign the BAA with Alohi before the first fax containing PHI is sent.
- Configure access controls and set up users so only staff who handle referrals or records can send and receive.
- Review the audit log on a schedule your privacy officer sets.
- Train staff and write fax-handling policies, such as verifying recipient numbers before sending and what to do after a misdirected fax.
- Remove access when staff leave or change roles.
Compliance depends on the signed BAA, your configuration and your policies, not on the vendor name.
Alternatives with a BAA
These fax services also have BAA availability that depends on plan. Each page has the plan detail and sources.
- eFax: conditional, BAA from eFax Business
- iFax: conditional, BAA from Plus
- RingCentral: conditional, BAA on all paid RingEX tiers
- Sfax: conditional, BAA from Plus
- SRFax: conditional, BAA from Healthcare Lite
For a side-by-side view, see HIPAA-compliant fax services.
Sources
- HIPAA Compliant Fax | Fax.Plus — Trust center, checked 2026-10-20. "Enterprise only. Fax.Plus signs BAAs with Enterprise customers"
- Fax.Plus Pricing — Pricing page, checked 2026-10-20. "HIPAA compliance with BAA is available on the Enterprise plan only."
- HIPAA Compliant Fax | Fax.Plus — security features — Trust center, checked 2026-10-20. "We encrypt data at rest using AES-256. Data in transit is protected using SSL/TLS with AES-128+."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Is Fax.Plus HIPAA compliant?
The status is conditional. A BAA is available on the Enterprise plan for the Fax.Plus online fax service. Free, Basic, Premium and Business are excluded. Whether your use is compliant also depends on the signed BAA, your configuration and your policies.
Does Fax.Plus sign a BAA, and on which plan?
Yes, on the Enterprise plan only. The BAA is signed with Alohi SA. Enterprise is priced from $79.99/month, or $959.99/year on annual billing. Any extra cost for the BAA is not published by the vendor.
Can I send PHI on the Fax.Plus Free, Basic, Premium or Business plan?
No BAA is available on those plans, so they should not be used for faxes containing PHI. Move to Enterprise and sign the BAA first.
How do I get a BAA from Fax.Plus?
Activate Advanced Security Controls on an Enterprise account, then request and sign the BAA with Alohi SA. Send PHI only after the signed BAA is in place.