What makes a fax HIPAA compliant in the AI era

HHS has actually never ever informed health care to stop faxing. Its assistance states the Privacy Rule allows doctors to divulge PHI to another supplier by fax for treatment, as long as sensible and suitable safeguards remain in location.

Take 2 similar recommendation types sent out the very same early morning. One relocations through an encrypted, logged channel covered by a signed service partner arrangement (BAA), and OCR software application indexes it into the chart. The other beings in an output tray in a shared corridor. Exact same file, exact same law, 2 really various compliance positions.

HIPAA controls the safeguards around a fax

Does a fax requirement to be HIPAA certified? For a covered entity or company associate sending out secured health details, yes. A fax maker, an app or a cloud service can’t be certified on a company’s behalf. The guideline asks whether the company has sensible safeguards around each disclosure.

Covered entities, HHS states,”need to have in location affordable and proper administrative, technical, and physical safeguardsfor PHI sent out by fax, such as verifying the recipient’s number and picking to pre-program regularly utilized numbersAs soon as a faxed page ends up being a digital file, the Security Rule’s protect requirements use.

“Most individuals begin by asking whether a fax service is HIPAA certified, which’s the incorrect location to begin,” states Adam Korbl, Founder and CEO of iFax“HIPAA does not license a facsimile machine or an app. I ‘d rather individuals ask who can open the file, whether anything done to it is logged, and whether the BAA covers the software application checking out the page, not simply the line bring it.”

Korbl’s concerns all issue the workflow. A fax that gets here undamaged however beings in a shared line, or gets submitted to the incorrect chart, can still expose a client’s details, and the market’s breach numbers are currently high: The HIPAA Journal counted 772 big health care information breaches on the OCR website for 2025 since early January 2026, a record.

What a certified fax workflow covers now

OCR engines, extraction designs and routing guidelines all manage the page now, and each of those actions brings the exact same commitments as the transmission.

File encryption is the apparent location to start. Under the present Security Rule it’s an”addressablespec, a label The HIPAA Journal keeps in mind has actually led some covered entities to treat it as optional when it never ever was, and for cloud fax it ought to reach the OCR text along with the kept images, at rest and in transit. Every send out, invoice, view and routing choice ought to likewise leave an entry that somebody can bring up later on.

The BAA holds the plan together lawfully. HHS’s sample BAA arrangements detail what the agreement needs to need of a supplier, consisting of Security Rule safeguards, breach reporting and matching terms for subcontractors. Under HHS cloud assistance, a cloud service provider keeping ePHI is a company partner even without the secret, and the channel exception”is restricted to transmission-only services.By that reasoning, a phone provider moving the fax signal counts as an avenue, while a cloud fax platform keeping copies normally counts as a company partner. If OCR or information extraction performs at a different business, that business requires protection too, generally under a subcontractor BAA with the supplier.

HHS’s guidance on misdialed fax numbers uses to routing guidelines. If a guideline misfires and submits a recommendation under the incorrect client, the outcome is no various from a misdialed number. Personnel needs to examine unpredictable matches before anything gets submitted.

Here a supplier can do a great deal of the work. iFax states its health care platform sets AES-256 file encryption in transit and at rest with signed BAAs, role-based gain access to and audit logs, and runs OCR inside the exact same regulated facilities. That manages the technical side. Policies, personnel training and the danger analysis are still the covered entities to handle.

Gain access to control complete the list, and avoiding it has actually a recorded expense. The 2024 Change Healthcare attack started with jeopardized qualifications on a system where MFA wasn’t switched on, and it eventually impacted roughly 193 million people.

The security guideline is overtaking software application that checks out

HHS has actually begun composing AI into the guidelines, though the most significant modifications are still propositions. The Security Rule overhaul released on January 6, 2025 would make file encryption of ePHI compulsory with minimal exceptions, need multi-factor authentication and require a yearly innovation possession stock and network map. It likewise names AI straight: a threat analysis”should consist of factor to consider of, to name a few things, the type and quantity of ePHI accessed by the AI tool, to whom the information is revealed, and to whom the output is offered.

Timing doubts: after almost 5,000 remarks, last action is now targeted for July 2027. OCR’s own price quote put first-year compliance expenses at $9 billion, and the proposition would offer companies 240 days after the last guideline to comply. None of that is most likely to alter who does what, though: suppliers supply the tools, and practices still run the program.

“We can provide a practice the file encryption, the audit path and a regulated location for OCR to run. The policies, the personnel training, the threat analysis, that’s for the practice’s to own, not ours.” Korbl states.

That department gets blurred when personnel generate AI tools by themselves. In an Imprivata-commissioned study of 250 health security and AI leaders, 72% stated AI tools or representatives are being released without official IT approval, Axios reported. Tools that IT never ever authorized are not likely to appear in a possession stock, not to mention be examined versus a BAA, and a stock requirement like the one HHS proposed is implied to emerge them. The study likewise discovered that 28% of companies have agentic AI in production currently, while 44% are piloting or checking it.

Purchase the stack, run the program

A practice can purchase a certified file stack. Compliance isn’t offered that method. It needs to be ranged from inside the practice, with composed policies that get upgraded and personnel who are trained on them. A fax supplier that can’t produce file encryption, gain access to controls, audit logs and a signed BAA should not make the shortlist. For the AI layer, purchasers must press even more and discover where the reading in fact occurs, whether the BAA extends that far, whether automated actions are logged and who examines the matches the software application isn’t sure about.