Conditional. Sfax lists a BAA for its secure cloud fax service on the Plus, Contender and Enterprise plans, and the Standard plan is listed without one. Whether you can send PHI depends on your plan and on a signed BAA.
Is Sfax HIPAA compliant? BAA by plan, covered services and exclusions
Conditional BAA available on Plus, Contender and Enterprise plans for Sfax secure cloud fax; the main exclusion is the Standard plan, listed without a BAA. Verified 2026-10-20. Sfax is owned by Consensus Cloud Solutions, Inc.
This page is published by Chanty, Inc., which owns and runs HIPAA Compliant Wiki. Sfax is a fax service, and rankings and verdicts here do not depend on payment. See all vendor HIPAA checks for other vendors.
Short answer
BAA available on the Plus, Contender and Enterprise plans for the Sfax secure cloud fax service. The Standard plan is listed without a BAA. Plus starts from $682/year for 700 pages/month, paid annually.
This is a statement about plans and services, not a certification. HIPAA has no product certification, and a BAA alone does not make a fax workflow compliant.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Standard | No BAA listed | Not applicable | Not applicable |
| Plus | BAA available | Signed with the customer on request; BAA form listed under protected HIPAA resources | Not published by the vendor |
| Contender | BAA available | Signed with the customer on request; BAA form listed under protected HIPAA resources | Not published by the vendor |
| Enterprise | BAA available | Signed with the customer on request; BAA form listed under protected HIPAA resources | Not published by the vendor |
Minimum seats for a BAA: Not published by the vendor.
A common trap: a clinic starts on Standard for a low page volume, then begins faxing referrals or lab results from it. Check the plan before the first PHI fax, not after.
What the BAA covers and what it excludes
Covered
- Sfax secure cloud fax, on Plus, Contender and Enterprise.
Excluded
- The Standard plan has no BAA listed.
- The vendor publishes no list of excluded features.
Anything outside the fax service, such as other products or third-party systems you connect to, is not stated as covered. Confirm scope in the BAA text before routing PHI through anything other than the fax service itself.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
The vendor's statement that faxes are encrypted in transit and at rest is quoted under Sources. The controls above describe what the vendor says, not an audit by this directory.
How to use Sfax with PHI
Sfax's BAA covers the vendor's side of the arrangement. The rest sits with your organization:
- Confirm your plan is Plus, Contender or Enterprise, not Standard.
- Get the BAA signed before anyone sends PHI.
- Configure user access so each staff member sees only the fax queues they need.
- Remove access when staff leave or change roles.
- Verify recipient fax numbers before sending. A misdialed number to a non-covered party is a disclosure problem no BAA fixes.
- Set internal policies on what may be faxed, and train staff on them.
Compliance depends on the signed BAA, your configuration and your policies together.
Alternatives with a BAA
Each of these lists a BAA on specific plans. See HIPAA-compliant fax services for the full category table.
- eFax: conditional; BAA from eFax Business.
- Fax.Plus: conditional; BAA on Enterprise.
- iFax: conditional; BAA on Plus.
- RingCentral: conditional; BAA on paid RingEX plans, all tiers.
- SRFax: conditional; BAA on Healthcare Lite.
The order is alphabetical by plan-independent criteria and is not influenced by payment.
Sources
- Get a Secure Fax Free Trial Today | Sfax — Pricing page, checked 2026-10-20. "PLUS $682 / Paid Annually Save $62 / year 700 total pages/mth Unlimited users Toll-free number 1 year storage Overage $0.10/page BAA Available No Hidden Fees"
- HIPAA Compliant Secure Faxing from Sfax — Trust center, checked 2026-10-20. "We will sign a BAA as your HIPAA fax partner."
- HIPAA Compliant Secure Faxing from Sfax — encryption — Trust center, checked 2026-10-20. "Sfax keeps your faxes encrypted at all times — both in transit and at rest."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Does Sfax sign a BAA?
Yes, on request, per the vendor's HIPAA page. The BAA is available on the Plus, Contender and Enterprise plans.
Which Sfax plans include a BAA?
Plus, Contender and Enterprise. The Standard plan is listed without a BAA.
Is the Sfax Standard plan suitable for PHI?
Not on the published terms. Sfax lists no BAA for Standard, so this directory does not treat it as covered. Move to a plan with a BAA, and sign it, before sending PHI.
Does Sfax encrypt faxes?
The vendor states that faxes are encrypted in transit and at rest. The exact wording is quoted under Sources.
How much does the Sfax Plus plan cost?
From $682/year, paid annually, for 700 pages/month. The price of the BAA itself is not published by the vendor.