How to choose a HIPAA-compliant eFax service

Safeguards to look for

• Encryption in transit and at rest. Look for TLS 1.2 or higher while faxes travel, and encryption for stored faxes.
• Where received faxes go. A service that emails faxes as attachments puts PHI in mailboxes you may not control. A better design keeps faxes in a private encrypted inbox and never emails the documents.
• Strong sign-in. Two-step verification and automatic sign-out on idle devices protect shared front-desk computers. Some services let the account owner set the idle timeout, for example 15, 30 or 60 minutes.
• Access by role. Front desk staff may need to send and receive without managing settings. Look for separate roles such as owner, admin, member and viewer.
• An audit trail. You should be able to see who viewed, downloaded or sent each fax, and export that record, for example as a CSV file.
• Retention controls. Decide how long faxes stay in the system, and use automatic purge so old records don't pile up.

Get Started Now

Your side of compliance

No service can make a practice compliant on its own. Write down who may fax PHI, use a cover page with a confidentiality notice, verify a new recipient's fax number before the first send, and send only the minimum necessary information. Include the fax service in your security risk analysis, and review the audit log as part of your regular checks. A short written fax procedure, reviewed once a year, is usually enough for a small practice.

The right tool makes those habits easier. With FaxToFax.com, reusable cover page templates keep your confidentiality notice consistent, each recipient number is confirmed before the fax goes out, and the append-only audit log records every view, download and send. That is why onlineefaxservices.com points healthcare readers to it, but run through the checklist above for any provider you consider.