Unknown No MyFax plan is advertised with a BAA, and the main exclusion is that the terms prohibit storing PHI without an executed BAA (terms, section 7). Verdict date: 2026-10-20.
Short answer
MyFax has no public BAA offer. Its terms prohibit storing protected health information unless a business associate agreement has been executed with the company. Its FAQ refers HIPAA customers to a partner product, eFax Corporate. For definitions of BAA and PHI, see the HIPAA glossary.
No plan is advertised with a BAA. A clinic that faxes referrals, lab results or prior-authorization forms should not send PHI through MyFax until a BAA is executed in writing. For other fax and messaging vendors with a documented position, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Home Office User | Not advertised | Not published by the vendor | Not published by the vendor |
| Small Business User | Not advertised | Not published by the vendor | Not published by the vendor |
| Power User | Not advertised | Not published by the vendor | Not published by the vendor |
No plan lists a BAA, and minimum seat counts for any BAA arrangement are not published by the vendor.
What the BAA covers and what it excludes
Covered services: none published by the vendor.
Exclusions:
- Storing protected health information without an executed BAA (terms, section 7).
Because no BAA terms are public, there is no documented scope to compare against your fax workflows: inbound faxes, outbound faxes, stored fax history or email delivery of fax copies. Any such scope would have to come from a signed agreement.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
The pricing page says MyFax offers more privacy and security than traditional fax machines. That is a comparison with paper fax, not a HIPAA statement, and it does not document any control in the table above.
How to use MyFax with PHI
Compliance depends on the signed BAA, your configuration and your policies, not on the product alone. If your organization already uses MyFax, work through this list before any patient document goes through it:
- Obtain an executed BAA in writing before sending PHI.
- Confirm in writing which plan and which services the BAA covers.
- Keep PHI out of the service until the BAA is in place. For example, stop sending referral packets from the front desk account until then.
- Manage user access and offboarding, so a departed front-desk employee's login is removed the same day.
- Set internal policies for fax use and retention, including what happens to received faxes after they are filed in the chart.
- Train staff on what may and may not be faxed and on verifying recipient numbers.
- Record the decision, the BAA date and the covered plan in your vendor inventory.
More on building these steps into your program is in the HIPAA guides.
Alternatives with a BAA
These fax services document a BAA route on a specific plan. Confirm the current terms on each vendor's own page before relying on them.
- eFax: conditional, BAA from eFax Business. See Is eFax HIPAA compliant?
- Sfax: conditional, BAA on the Plus plan. See Is Sfax HIPAA compliant?
- Fax.Plus: conditional, BAA on the Enterprise plan.
- iFax: conditional, BAA on the Plus plan.
- RingCentral: conditional, BAA on paid RingEX plans, all tiers.
For the full comparison, see HIPAA-compliant fax services by category.
Sources
- MyFax FAQ — Help article, checked 2026-10-20. "If you’re looking for a HIPAA-compliant cloud faxing solution, we recommend our partner eFax Corporate."
- Terms & Conditions – MyFax — Terms, checked 2026-10-20. "You further agree not to use the Services to store (1) any “protected health information” … unless and until you have executed a Business Associate Agreement with Company"
- MyFax Pricing — Pricing page, checked 2026-10-20. "MyFax offers more privacy and security than traditional fax machines."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-20.
FAQ
Does MyFax sign a BAA?
There is no public BAA offer. The terms refer to a BAA being executed with the company, but no plan advertises one and no process or price is published.
Can I send or store PHI with MyFax?
The terms prohibit storing PHI unless a BAA has been executed with the company. Without an executed BAA, keep PHI out of the service.
Which MyFax plan includes a BAA?
None is advertised. Home Office User, Small Business User and Power User are all listed as "Not advertised" for BAA availability.
What does MyFax recommend for HIPAA-compliant cloud faxing?
Its FAQ points HIPAA customers to eFax Corporate. Any BAA terms for that product are set out on its own pages, not by MyFax.