Is eFax HIPAA Compliant?

Yes, eFax offers services intended to support HIPAA-compliant faxing, but the plan and agreement matter. Its current Business plan lists a Business Associate Agreement (BAA). Personal does not list one. Larger organizations can evaluate eFax Corporate through a separate proposal. Our eFax product review also examines general pricing and document workflows.

This guide concerns eFax at efax.com, the provider. Electronic faxing and online faxing describe the broader category. A generic reference to “e-fax” does not identify a particular vendor or establish HIPAA eligibility.

For a physician, the practical question is whether staff can send and receive patient documents through the covered service. For IT, it is whether the agreement, account controls and connected systems cover the actual deployment.

Which eFax plans list a BAA?

The current eFax pricing page distinguishes Personal and Business. The small-business page also explains the position of legacy Protect subscribers.

Prices are in US dollars. Business pricing above uses monthly billing after the introductory promotion. Its five included users can be relevant to a small practice, but an included user allowance does not establish which permissions each person receives.

If you already use Personal for ordinary documents, resolve eligibility before adding protected health information (PHI). A plan change should be checked together with the agreement and settings rather than assumed to make every existing workflow suitable.

Which service and agreement does the eFax BAA apply to?

Section 24 of the published eFax terms contains a Business Associate Addendum and refers to the Business, Protect and Unite “Secured Service.” The addendum applies to Consensus US where the customer is a covered entity or business associate using that Secured Service. Read that scope alongside the agreement applying to your account.

The public addendum provides useful information before purchase. It does not establish that a particular legacy account, Corporate order, email route or connected application is covered on identical terms.

Before sending PHI, ask eFax to confirm the covered service, the agreement applying to your account, how the BAA becomes effective and any required configuration. Retain that confirmation with your vendor records.

A BAA establishes responsibilities between your organization and the service provider. Your practice still needs appropriate staff access, recipient verification and procedures for handling downloaded or forwarded documents.

Check the actual patient-document workflow

Browser access and staff accounts

eFax Business advertises web faxing, administration and user permissions. Demonstrate the workflow with synthetic documents: a referral arrives, the front desk identifies it, a clinician reviews it and an authorized staff member sends a response.

Verify who can view each number’s documents, whether each person uses an individual account and how a departing employee loses access. Ask which authentication and administrator controls are available on the selected plan; avoid transferring Corporate capabilities to Business by assumption.

A fax-system delivery confirmation does not prove that a person read the referral or entered it into the intended patient chart. Establish who checks failed or misdirected transmissions and how the practice responds.

During evaluation, also check:

• Whether MFA is available and enforced for the proposed accounts.
• Which send, receive and access events are recorded, and whether those records can be exported.
• How staff verify recipient numbers and respond to a wrong-number send.
• How shared workstations handle downloads, and when staff access is reviewed.

Email sending, notifications and attachments

eFax offers email-to-fax and email-related receiving workflows. Check these separately: sending an email as a fax, receiving a notification and receiving a document attachment create different copies and access paths.

Ask what arrives in the mailbox under the covered configuration. Does the message contain PHI, an attachment or a portal link? What transport requirements apply? Who can forward or download it, and how are copies retained?

Your email provider and internal handling also need assessment. A BAA for the fax service does not automatically cover a mailbox, shared forwarding rule or third-party archive. The eFax security information is a starting point; confirm the behavior demonstrated for your account.

Retention, export and account closure

Establish how long documents remain available, which retention settings administrators can change and how records can be exported. Ask how deletion, backups and account closure are handled under the applicable service.

Apply those answers to your practice’s records policy. An online fax archive is not automatically a complete medical-record retention system, and portal access should not be your only plan for preserving required records.

What about eFax Corporate and integrations?

eFax Corporate provides an enterprise route with administration, account management and API capabilities. Its healthcare offering warrants evaluation when fax forms part of a larger document or interoperability project.

Request a proposal identifying the exact products, endpoints, permissions and data flows. Public API information does not establish inclusion in the $39.99 Business subscription or immediate production access.

Likewise, assess security assurance at its stated scope. A HITRUST r2 claim associated with Corporate should not be presented as a certification automatically covering every eFax plan, integration or customer configuration.

How Fax.Plus approaches HIPAA faxing

Fax.Plus publishes this guide and is an alternative provider. For PHI, its healthcare fax requirements are explicit: Enterprise, enabled Advanced Security Controls (ASC) and a signed BAA. Basic, Premium and Business are not substitutes for that arrangement. The Alohi HIPAA documentation explains eligibility.

Fax.Plus Enterprise includes unlimited members, SSO and role-based team administration. Administrators can manage number assignments within the team structure, making it relevant when reception staff and clinicians need individual access. Assess assignments and consumption together; unlimited members does not mean unlimited fax usage.

Enterprise offers more than 40 locations for fax-document and backup storage. That choice concerns storage rather than every processing operation; review the documented data-residency scope against your requirements. The REST API remains available under ASC. Email sending and optional incoming attachments have specific security conditions, so demonstrate the intended email workflow before moving PHI.

The appropriate comparison is eFax’s covered Business or Corporate configuration against Fax.Plus Enterprise with ASC and the BAA. Compare the staff workflow, required controls and complete quote. A cheaper consumer subscription from either provider is not a like-for-like HIPAA comparison.

If you decide to change providers

Confirm the new account’s eligibility before transferring PHI. Preserve required fax history, verify number-transfer conditions and keep the current service active until any port is complete and tested. Check incoming and outgoing delivery and staff access before ending the old arrangement.