Is eFax HIPAA Compliant? Online Faxing in Healthcare

At 4:40 on a Thursday, a 14-page referral packet goes out to a cardiology office. The eFax confirmation comes back clean. On Monday, the cardiology office calls to ask where the records are.

Someone pulls the send log. The number on file was the office's old fax line, and nobody knows who has that number now.

That gap sits at the center of most questions about online faxing and HIPAA. Is eFax HIPAA compliant? It can be, on a plan that comes with a signed business associate agreement. Your own safeguards still decide whether a given fax stays private.

Fax still moves a lot of paper in healthcare. Referrals, prior authorizations, and records requests run through it every day, and many outside offices won't take anything else.

This guide covers how eFax works, which plans include a business associate agreement, and what the HIPAA Security Rule asks of any online fax tool. It also covers where fax still earns its place.

Our view up front: keep fax for payers and outside offices that need it. Move patient paperwork off fax and email.

What Do Healthcare Professionals fax?

Fax shows up wherever two offices don't share a system. For a typical outpatient practice, that's most outside contact.

The Daily Fax Pile

Ask any front desk what came off the fax yesterday and the list looks a lot like this:

• Referral packets to and from specialists
• Prior authorization forms and the chart notes that back them up
• Lab and imaging orders, plus the results that come back
• Records requests from other practices, lawyers, and insurers
• Orders for home health, medical equipment, and physical therapy

Each item carries protected health information, or PHI. Each one also has to end up in the right chart, which is the part that eats staff time.

Why Fax Hangs On

Electronic exchange keeps growing. In a 2024 federal data brief, 84% of hospitals said they often sent summary of care records electronically in 2023, up from 71% in 2018. Only 73% often received them that way.

That same brief left eFax out of its count of electronic exchange, so an online fax doesn't qualify under federal counting.

Outside hospitals, the gaps are wider. A small orthopedic office, a home health agency, and a county clinic may each run different software. With no shared connection, fax becomes the common language.

What's Changing for Prior Authorizations

Prior authorization is one of the biggest fax streams, and federal rules are starting to move it. A CMS rule finalized in 2024 covers Medicare Advantage plans, Medicaid and CHIP programs, and plans sold on the federal marketplace.

Since January 1, 2026, those payers must decide urgent requests within 72 hours and standard ones within seven days. By January 1, 2027, they must offer an electronic prior authorization connection that EHRs can use. Commercial plans outside the rule may keep asking for faxes.

How Does eFax Work?

eFax is an online fax service owned by Consensus Cloud Solutions. It replaces the machine and phone line with a fax number tied to an online account.

Sending and Receiving

Staff send and receive faxes from a web account, from email, or from the eFax mobile app, according to eFax's product page. Incoming faxes land in the account, so no one has to stand by a machine.

The other office doesn't need eFax. A fax sent from eFax prints on their machine like any other, and a paper fax sent to your eFax number shows up online.

Consensus also sells products beyond basic faxing. Its higher-end tools, such as eFax Unite and eFax Clarity, are listed with EHR connections and data extraction for incoming documents.

Plans and What They Include

Your plan decides if a business associate agreement comes with it. eFax's pricing page showed these tiers in October 2026:

The page didn't show a monthly price for each plan, so get a written quote before you budget. Annual billing was listed at up to 17% off.

Is eFax HIPAA Compliant Or Not?

No tool is HIPAA compliant on its own. HIPAA applies to how your practice uses the tool, and the vendor's role is one piece of that.

The HIPAA Security Rule requires a covered entity to get written assurances from any vendor that handles its PHI. In practice, that's a signed business associate agreement, or BAA.

eFax says its BAA covers eFax Business, Corporate, and Unite. On a Personal plan with no BAA listed, we'd treat it as unsafe for patient records. With the right plan and a signed BAA, HIPAA-compliant faxing is possible. The four controls below show where eFax's part ends and yours begins.

Access Control

The technical safeguards in 45 CFR 164.312 call for a unique ID for each user and limits on who can see what. eFax Business includes an admin portal for setting user permissions.

Your part is the habits. Give each staff member their own login, skip the shared front desk password, and remove access the day someone leaves.

Transmission Security

eFax says it uses TLS 1.2 to protect faxes in transit. That covers the trip between your account and eFax's servers.

The last leg is different. A fax sent to a paper machine travels over a phone line and lands on a tray anyone can reach.

HIPAA's reasonable safeguards rule covers that gap. Confirm the number before each first-time send, use a cover sheet, and call ahead for anything sensitive.

Encryption

eFax says it encrypts data in transit and at rest with 256-bit AES across its product suite. Today, the Security Rule treats encryption as addressable, which lets a practice document an equal alternative.

That may change. HHS proposed in January 2025 to make encryption of ePHI required at rest and in transit. As of September 2026 the rule was not final, with a target date around July 2027.

Audit Control

eFax lists audit trails across its products. HIPAA requires a way to record and review activity in systems that hold ePHI.

Logs only help if someone reads them. Pick a monthly check, such as faxes sent to new numbers, and keep your HIPAA policies and records for six years, as the rule requires.

Is eFax What You Need For Healthcare Information Sharing?

eFax does one job: it moves documents to and from fax numbers. Whether that's enough depends on who's on the other end.

Where eFax Fits

Fax works well with outside offices you trade with on a set schedule. Think of a specialist who sends consult notes every week, or a payer that only takes faxed forms. A lab with a fixed fax line fits too.

For those, an online fax with a BAA beats a machine in the break room. Pages don't sit in a tray, and you can search what was sent.

Where It Falls Short

Patients don't own fax machines. When a practice uses fax or email for patient paperwork, staff end up printing, scanning, and retyping intake forms by hand.

Incoming faxes also need filing. On a basic plan, each one arrives as a file that someone has to open, name, and attach to the right chart.

Seat limits add cost as you grow. Take an office with eight staff who each need a login. On the Business plan, it pays for three added users at $10 a month each, before any page overage.

In our view, fax belongs at the edges of your practice, with payers and outside offices.

Now That You Know Everything About Online Healthcare Faxing And HIPAA Compliance, What Are The Alternatives To eFax?

The best eFax alternatives depend on who you're trying to reach. Outside offices and patients need different tools.

For Outside Offices and Payers

Start with what your EHR already offers. Many EHRs can send records through Direct secure messaging or a health information exchange, which the federal brief counts as true electronic exchange.

For payers, watch for the new prior authorization connections due by January 1, 2027. Until then, keep a BAA-backed online fax for the offices and plans that still need it.

For Patients: Texting and Online Forms

Patients answer texts. Secure two-way texting lets the front desk handle the calls and paperwork that used to go out by fax or mail.

Rural clinics have used HIPAA texting to clear front desk phone backlogs without asking patients to log in to a portal. The same setup works for two-way texting alongside CharmHealth.

Intake paperwork can move online too. Our guide to HIPAA compliant online forms for eCW practices covers what to look for when forms replace faxed and emailed PDFs.

Conclusion

Is eFax HIPAA compliant? On a plan with a signed BAA, it can be. Your team still owns the habits that keep each fax private.

Fax will stay part of healthcare for a while. Payers, outside offices, and records requests depend on it, and the federal prior authorization changes won't reach every plan.

Patients are a different story. Faxing or emailing their paperwork means scanning, retyping, and chasing forms that a text link could collect in minutes.

This week, check which eFax plan your practice is on and whether a BAA is signed. Then list the patient tasks still running through fax or email, and pick one to move first.

Ready to take patient paperwork off the fax line? Book a demo with Curogram to see secure texting and online forms working with your EHR.

Frequently Asked Questions