Key facts

• HHS has not banned faxing. The HIPAA Privacy Rule permits providers to disclose protected health information by fax for treatment when reasonable and appropriate safeguards are in place.
• A fax machine, app or cloud service cannot be HIPAA compliant on its own. Compliance depends on the administrative, technical and physical safeguards an organization puts around each disclosure.
• When OCR or AI software reads a faxed page, the same obligations extend to the digital file, the extraction process and any downstream routing.
• Encryption is addressable under the current Security Rule, but HHS treats it as a safeguard that must be implemented when reasonable and appropriate. Proposed changes would make it mandatory, along with MFA and an annual asset inventory.
• Cloud fax platforms and OCR vendors that store or process ePHI generally need business associate agreements. A transmission-only phone carrier may fit the conduit exception, but storage changes the analysis.
• Audit logs, role-based access and human review of uncertain matches are part of a defensible workflow.
• HHS proposed a Security Rule overhaul on Jan. 6, 2025, including AI-specific risk analysis. Final action is targeted for July 2027.
• Breach numbers remain high, and shadow AI tools deployed without IT approval can evade asset inventories and BAA review.

Two referral forms leave the same clinic on the same morning. Both contain protected health information. Both are faxed to a specialist. One travels through an encrypted, logged channel covered by a signed business associate agreement. OCR software reads the page, extracts the patient’s name and diagnosis, and files the result into the correct chart. The other lands in a shared hallway output tray, where anyone walking past can pick it up. The documents are identical. The compliance positions are not.

That contrast is the heart of the current debate over fax and HIPAA. The federal government has never told healthcare organizations to stop using fax machines. The Department of Health and Human Services says the Privacy Rule permits physicians to disclose PHI to another provider by fax for treatment, as long as reasonable and appropriate safeguards are in place. The question is not whether a fax machine carries a compliance sticker. The question is whether the organization has built a workflow that protects the information from send to receipt, from page to pixel, and from OCR to chart.

HIPAA regulates the safeguards around a fax

Does a fax need to be HIPAA compliant? For a covered entity or business associate sending PHI, the answer is that the disclosure must be wrapped in reasonable safeguards. But a fax machine, an app or a cloud service cannot be compliant on an organization’s behalf. HHS has said covered entities must have reasonable and appropriate administrative, technical and physical safeguards for PHI sent by fax. That can include confirming the recipient’s number, pre-programming frequently used numbers and training staff on how to handle misdirected faxes. Once a faxed page becomes a digital file, the Security Rule’s safeguard standards apply as well.

The distinction matters because compliance is often discussed as if it were a product feature. It is not. A vendor can sell encryption, audit logs and access controls. It can sign a business associate agreement. But the covered entity still owns the risk analysis, the written policies, the training program and the day-to-day decisions about who may open a document and where it may be routed. A fax that arrives intact but sits in a shared queue, or gets filed to the wrong chart, can still expose a patient’s information. The industry’s breach numbers are already high. Breach tracking data counted 772 large healthcare data breaches on the federal portal for 2025 as of early January 2026, a record.

The workflow is the compliance unit

Older fax compliance advice focused on the machine: keep it in a secure area, use a cover sheet, verify the number, retrieve pages promptly. Those steps still matter. But the modern fax workflow is longer. A cloud fax service receives the signal, converts it to an image, stores the image, runs OCR or another extraction model, applies routing rules and may hand the result to an electronic health record or a care management platform. Each step is a place where PHI can be exposed, misrouted or copied into a system that was never reviewed.

Encryption is the obvious place to begin. Under the current Security Rule, encryption is an addressable specification. That label has led some covered entities to treat it as optional, though HHS has long said addressable does not mean optional. Organizations must implement encryption when it is reasonable and appropriate, or document why it is not and implement an equivalent safeguard. For cloud fax, encryption should cover the stored images and the OCR text, at rest and in transit. It should also cover backups and any temporary files created during processing. If a vendor cannot explain where the reading happens and how the extracted text is protected, the buyer has more work to do.

Audit logs are the second pillar. Every send, receipt, view and routing decision should leave an entry that someone can pull up later. That matters for security investigations, for breach assessments and for ordinary quality control. If a referral is filed under the wrong patient, the organization needs to know who or what made the match, when the file was viewed, and whether the error was corrected. A log that records only the transmission but not the OCR or routing step leaves a gap.

Access control rounds out the list, and skipping it has a documented cost. The 2024 attack on a major healthcare payment processor began with compromised credentials on a system where multi-factor authentication was not turned on. It ultimately affected approximately 193 million individuals. That case is a reminder that a fax workflow is only as strong as the identity controls around the systems that receive, store and read the fax. Role-based access should limit who can see a document, change a routing rule or export extracted data. Multi-factor authentication should protect administrative accounts and, increasingly, any account that can reach ePHI.

Business associate agreements and the conduit exception

The business associate agreement holds the arrangement together legally. HHS’s sample BAA provisions outline what the contract must require of a vendor, including Security Rule safeguards, breach reporting and matching terms for subcontractors. Under HHS cloud guidance, a cloud provider storing ePHI is a business associate even if it does not hold the encryption key. The conduit exception is limited to transmission-only services. By that logic, a phone carrier moving the fax signal counts as a conduit, while a cloud fax platform storing copies generally counts as a business associate.

That analysis extends to the AI layer. If OCR or data extraction runs at a separate company, that company needs coverage too, usually under a subcontractor BAA with the vendor. The covered entity should confirm that the agreement reaches the software reading the page, not just the line carrying it. A vendor may have a BAA for the transport service and a separate arrangement for analytics, storage or model training. Buyers should ask which entity touches the PHI at each stage and whether the contract covers every one of them.

HHS’s advice on misdialed fax numbers applies to routing rules as well. If a rule misfires and files a referral under the wrong patient, the result is no different from a misdialed number. Staff should review uncertain matches before anything gets filed. Automated systems can be tuned to flag low-confidence extractions, duplicate patient records and mismatched dates of birth. The goal is not to eliminate automation but to place human review where the software is least certain.

AI and OCR are part of the disclosure

OCR engines, extraction models and routing rules all handle the page now, and each of those steps carries the same obligations as the transmission. A fax that is read by AI is not just a fax. It is a data processing pipeline. The page image is stored, the text is extracted, the fields are mapped to a patient record and the result may trigger a downstream action such as scheduling, billing or a clinical alert. Each of those steps should be covered by the risk analysis and the safeguards that surround the fax itself.

That is why the location of the reading matters. Some vendors run OCR inside the same controlled infrastructure as the fax service. Others send the image to a third-party API, a model provider or a separate analytics platform. The covered entity needs to know which one is happening and whether the BAA extends that far. It also needs to know whether automated actions are logged and who checks the matches the software is not sure about. A vendor that can produce encryption, access controls, audit logs and a signed BAA should make the shortlist. A vendor that cannot should not.

The Security Rule is catching up with software that reads

HHS has started writing AI into the rules, though the biggest changes are still proposals. The Security Rule overhaul published on Jan. 6, 2025 would make encryption of ePHI mandatory with limited exceptions, require multi-factor authentication and call for an annual technology asset inventory and network map. It also names AI directly. A risk analysis must include consideration of the type and amount of ePHI accessed by the AI tool, to whom the data is disclosed and to whom the output is provided.

Timing is uncertain. After nearly 5,000 comments, final action is now targeted for July 2027. OCR’s own estimate put first-year compliance costs at $9 billion, and the proposal would give organizations 240 days after the final rule to comply. None of that is likely to change who does what. Vendors provide the tools. Practices still run the program. A cloud fax company can supply encryption, an audit trail and a controlled place for OCR to run. The policies, staff training and risk analysis remain with the covered entity.

That division gets blurry when staff bring in AI tools on their own. In a survey of 250 health security and AI leaders, 72% said AI tools or agents are being deployed without formal IT approval. Tools that IT never approved are unlikely to appear in an asset inventory, let alone be checked against a BAA. An inventory requirement like the one HHS proposed is meant to surface them. The same survey found that 28% of organizations have agentic AI in production already, while 44% are piloting or testing it.

What buyers should ask

A practice can buy a compliant document stack. Compliance is not sold that way. It has to be run from inside the practice, with written policies that get updated and staff who are trained on them. A fax vendor that cannot produce encryption, access controls, audit logs and a signed BAA should not make the shortlist. For the AI layer, buyers should push further. Find out where the reading actually happens. Ask whether the BAA extends that far. Ask whether automated actions are logged. Ask who checks the matches the software is not sure about. Ask how the vendor handles misdirected faxes, duplicate records and low-confidence extractions.

The answers will vary by vendor, by workflow and by the size of the organization. But the questions are now part of HIPAA compliance for any fax that becomes a digital record. The page may still arrive over a phone line. The moment it is read by software, the safeguards must follow it into the chart.

Source:TNW | Contributed News