HIPAA Compliance for Fax in Healthcare Demands Safeguards, Not Just Technology

Why Fax Technology Alone Isn’t HIPAA-Compliant

The US Department of Health and Human Services (HHS) allows healthcare providers to fax protected health information (PHI) for treatment under the Privacy Rule, but compliance depends on the safeguards organizations implement—not the fax technology itself. According to The Next Web, HHS has never instructed healthcare to stop using fax machines, but it requires "reasonable and appropriate safeguards" to protect PHI.

A fax machine, app, or cloud service cannot achieve compliance on an organization’s behalf. Compliance is determined by how the technology is used, including encryption, access controls, and audit logs. The HIPAA conduit exception applies only to transmission-only services, such as phone carriers moving fax signals. In contrast, cloud fax platforms that store copies of transmissions are typically classified as business associates and must sign a business associate agreement (BAA).

Critical Components of a Compliant Fax Workflow

For a fax workflow to meet HIPAA standards, providers must ensure encryption, access controls, and audit logs are in place. Adam Korbl, founder and CEO of iFax, told The Next Web that vendors lacking these features—along with a signed BAA—should not be considered for contracts.

AI-driven tools, such as optical character recognition (OCR) software, add another layer of complexity. Korbl emphasized that buyers must verify where PHI is processed, whether the BAA extends to the AI layer, and whether automated actions are logged. Without these controls, AI integration could introduce compliance risks.

Proposed Security Rule Overhaul and AI Risks

HHS’s proposed updates to the Security Rule would introduce stricter requirements, including mandatory encryption, multi-factor authentication, and an annual inventory of technology assets. The rule would also require risk analyses to evaluate how AI tools access and process electronic PHI (ePHI), reflecting growing concerns about unauthorized AI deployments in healthcare.

The urgency of these changes is underscored by the 2024 Change Healthcare breach, which exposed data on approximately 193 million individuals due to compromised credentials. According to The Next Web, 72% of health security and AI leaders reported AI tools being deployed without formal IT approval, highlighting the need for tighter oversight.

Regulatory Shifts and Industry Implications

The proposed Security Rule overhaul is part of a broader regulatory push to address vulnerabilities in healthcare data security. Final action on the rule is targeted for July 2027, giving providers and vendors a window to adapt their compliance strategies.

While HHS has not explicitly targeted fax technology, the focus on encryption, audit logs, and BAAs signals a shift toward holding organizations accountable for how they manage PHI—regardless of the communication method. This aligns with Lazyfounder’s earlier reporting on regulatory scrutiny of AI in healthcare, including discussions led by policymakers and religious leaders about balancing innovation with safety.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

For healthcare providers and startups handling PHI, this story is a reminder that compliance is not a one-time checkbox but an ongoing operational challenge. The proposed HHS rules—particularly around encryption, multi-factor authentication, and AI oversight—could reshape how organizations manage fax and digital communications. Vendors offering fax or AI-driven healthcare solutions must ensure their products support these requirements, or risk being excluded from contracts.

The Change Healthcare breach serves as a cautionary tale: reliance on outdated or unsecured workflows can have devastating consequences. Founders building tools for healthcare should prioritize transparency about where PHI is stored, how it’s processed, and whether their BAAs extend to third-party integrations like AI. The July 2027 deadline for the Security Rule updates is a firm timeline to get these safeguards in place.

Related on Lazyfounder

• More health news