A HIPAA compliant fax app is everything either side of the phone line.
Fax is still how a referral, a prior authorization and a signed order move between two practices that share no system. Building a HIPAA compliant fax app is mostly not about the fax. It is about who can open the page, which companies hold a copy of it, and whether you can show a log of both a year from now. The wider job is HIPAA compliant app development. This page is about the fax.
What follows: what the regulations say about a fax, and why turning fax into an app changes which rules reach it. Then a fax API a small practice can sign up for today, and the half of the problem that is harder than sending.
See who in the chain needs a BAAThe short version
Paper to paper sits outside the Security Rule, a fax app sits inside all of it.
Two machines passing paper down a phone line are doing something the HIPAA Security Rule mostly does not reach. Privacy Rule duties still apply, and so does minimum necessary. But the technical safeguards were written for information systems, and a fax machine is not one of those.
A secure fax app for healthcare inverts that. The document is a file before it is sent, in transit and after it lands. It rests on a server you do not own and opens on a phone that goes home in a pocket. Every technical safeguard now applies, and every vendor in the path is a business associate.
What the rules actually say about a fax
The definition that decides this sits in the HIPAA rules themselves. Electronic media means electronic storage material, plus the transmission media used to move information already held electronically. A transmission of paper by fax, or of voice by telephone, is not treated as a transmission via electronic media when the information did not exist in electronic form immediately before it was sent. That is why a fax machine in a back office has never been much of a Security Rule problem.
Scan the page first, or send a file that was never paper, and the exclusion is gone. The document is electronic protected health information for its whole life. The technical safeguards then apply as usual: one login per person, a session that ends after a set period of inactivity, a mechanism that records and examines activity in the system, and protection for the data crossing a network. Encryption and automatic logoff are addressable, which is not a synonym for optional. You implement them where that is reasonable, or document why not and use an equivalent safeguard.
One thing no product can sell you: the last leg into a fax machine at another clinic is a phone call, and you cannot encrypt it. Encryption covers the part you control, the app to the provider and whatever is stored. A medical fax app that implies the whole path is protected end to end is describing its own network, not the corridor where the page lands.
Everyone who touches the page is a business associate
A business associate is anyone who creates, receives, maintains or transmits protected health information on your behalf. For a digital fax app that is never one company. It is the fax provider, whatever stores the file, an OCR or summary service if you add one, and any relay that carries a copy onwards. Each needs an agreement signed before a real patient document passes through.
Two of them leak quietly. The first is the notification: if the alert names the sender and shows the first line, that preview sits on a lock screen and passes through a push service that signed nothing with you. Send a neutral alert instead. The second is forwarding inbound faxes to an ordinary email account, a disclosure to a provider you have no agreement with.
None of this is specific to fax. The same chain of agreements decides the shape of a hipaa compliant messaging app. Fax simply has more companies standing in the middle, because the page has to reach a machine that knows nothing about you.
Try it
Who ends up holding the page
Tick everything your design lets touch one fax. Each tick is a company or a screen you have to account for.
2 places one page ends up
- Carries the document to the phone line. A signed agreement is the price of entry.
- Storage you did not need is retention you now have to defend. Most providers let you switch it off.
Yes, there is a fax API you can sign up for today
Part of why this question keeps coming up: Twilio sunset Programmable Fax on 17 December 2021 and pointed customers at a migration partner. Tutorials still send people to it. What replaced it is a smaller set of fax-first providers, and at least one publishes healthcare terms you can accept on your own.
The Sinch Fax API documents the steps openly. You sign the business associate agreement yourself through DocuSign in the HIPAA section of the Build dashboard, and it is free to sign. You then uncheck both boxes in that section, under Fax and Services, which stops transmitted documents being stored on their servers. Two factor authentication goes on your user profile, every webhook URL has to be HTTPS, and the secure endpoint enforces TLS 1.2. Callbacks return the date and time a fax was sent or received.
So the answer is yes, with one caveat. Signing a BAA is not a certificate of compliance for you. It divides responsibility. Their side is transport and the storage settings you chose. Your side is the app: who holds an account, what is left on the device, and whether the log survives a phone being replaced.
Other fax providers advertise a signed agreement at small practice prices. We have not verified their terms, so read the agreement, the default retention setting and the price per page first. Porting matters too, because your fax number is printed on forms your referrers hold. Ask about it before choosing, as you would for a hipaa compliant phone app.
Receiving is the harder half
Sending is a button. Receiving is a queue. An inbound fax arrives as an image from a number nobody recognizes, with no patient attached, and the useful line often on page three. Somebody has to read every page and decide where it goes. An app that only sends has solved the easy half.
That makes routing the real feature. A shared inbox with a status on each item, an assignment to a named person, a patient or case to attach it to, and a note saying what was done. Without the last two you have built a folder of images with timestamps.
Then the evidence. Every send needs its confirmation: the number dialed, the page count, the result and the time. Every open needs a person against it. When a page goes to the wrong number, that record turns a panic into a documented risk assessment. Both directions belong in one table, and storing the sent and received log is a backend decision, not a fax one.
On the phone itself, four settings do most of the work: no page previews in notifications, no copies left in the camera roll, a session that ends on its own, and one login per person.
What each way of faxing actually gives you
| Option | BAA you can sign | Keeps PHI off vendor storage | Per user audit trail | Fits your chart workflow |
|---|---|---|---|---|
| Fax machine on a phone line | not required | Yes | paper log only | No |
| Consumer email to fax | No | No | No | No |
| HIPAA fax service, stock app | Yes | storage is usually the default | Yes | generic inbox |
| Fax API plus a shared inbox tool | Yes | if you switch storage off | depends on the tool | partly |
| Fax API inside an app you build | Yes | if you switch storage off | Yes | Yes |
Building one around your own practice
Off-the-shelf fax apps are good at transport and vague about your day. They hand you an inbox, not a chart. They price per user per month, which is awkward when the front desk is three people and two locums. And they stop where your workflow starts: this fax is a referral, for this patient, needing a reply by Friday. That last part is the app.
The build itself is not large. A provider with an agreement in place, storage switched off, a queue with assignment, and a log that keeps every send and every open. The hard parts are the number port, the retention policy you now have to decide rather than inherit, and resisting an AI summary from a vendor who signed nothing.
Newly is an AI app builder. You describe the app, it writes a real React Native and Expo project you own, and it runs that app on a cloud iPhone or Android simulator while it builds. iOS builds go to TestFlight through your own Apple Developer account. The Deploy tab has an Android section that builds, signs and uploads to Google Play internal testing, and it also builds a standalone release APK you can install on a phone directly. It costs $25 a month, with no free plan and no built-in payments. It is not a fax provider, it does not sign an agreement with you, and no real patient document belongs in a builder while you are still describing what you want.
Questions people ask about HIPAA compliant fax apps
Fax is permitted, and healthcare uses it constantly. Compliance belongs to the system around it, not the technology. A fax of paper between two machines sits largely outside the Security Rule, because the information did not exist in electronic form immediately before the transmission. Once the document is a file, the technical safeguards apply: unique logins, session timeouts, records of activity and protection in transit.
Describe the fax workflow your practice actually has
Write down who sends, who sorts the inbound queue, what every page has to be attached to, and what the log has to prove. Build the app around that.
Start building