SecurelyFax

HIPAA Compliance

Last updated: June 2026

SecurelyFax offers a HIPAA-eligible service tier designed for U.S. covered entities and business associates that need to transmit Protected Health Information (PHI) by fax.

What "HIPAA-eligible" means

The HIPAA tier is configured to support a customer's HIPAA compliance program. SecurelyFax acts as a Business Associate when you transmit or store PHI through the service — because SecurelyFax persistently stores fax PDFs in encrypted S3 (typically days to years depending on retention configuration), the role goes beyond a mere conduit and a Business Associate Agreement (BAA) is required before any PHI may be transmitted.

Our role vs. the Telnyx conduit exception

SecurelyFax's underlying telecommunications carrier, Telnyx, performs the actual T.38 / PSTN transmission of fax data and does not sign BAAs. Telnyx operates under the HIPAA conduit exception, which the U.S. Department of Health and Human Services has confirmed applies to telecommunication and electronic-equivalent carriers that act "merely as a conduit for protected health information." See HHS guidance at 78 FR 5571-72. The conduit exception permits transient, transmission-incidental storage but does not extend to a service that retains PHI persistently on its own systems.

SecurelyFax does not qualify for the conduit exception because we persist fax PDFs in encrypted storage on the customer's behalf (retention windows of 30 days on free tier up to multiple years on the HIPAA tier). For that reason SecurelyFax is a Business Associate and signs a BAA with every HIPAA-tier customer.

Safeguards on the HIPAA tier

Storage and subscription

SecurelyFax has no legal obligation to retain PHI on a customer's behalf once that customer's HIPAA-tier subscription lapses, expires, is terminated by either party, or is suspended for non-payment. Storage is a service customers pay for under an active subscription — HIPAA does not require SecurelyFax to maintain PHI outside the commercial relationship. The Business Associate Agreement reflects this expressly.

When a HIPAA-tier subscription lapses or terminates:

  1. SecurelyFax sends the customer's administrative contacts at least thirty (30) calendar days' written notice by email before any deletion of PHI, including instructions on how to export.
  2. During the notice / wind-down period, the account is read-only — customer can sign in and use the export tooling to retrieve PHI but cannot send or receive new faxes.
  3. At the end of the wind-down period, all PHI is securely deleted from SecurelyFax's production systems and AWS is instructed to do the same with its retained copies in S3 and KMS.
  4. SecurelyFax provides written certification of destruction upon written request.

Customers are solely responsible for completing their export before the wind-down period ends. SecurelyFax has no liability for a customer's failure to timely export PHI.

Storage limits and overages

Sub-processors and BAAs

SecurelyFax categorizes its third-party vendors by whether they have persistent, non-incidental access to PHI:

What is not HIPAA-compliant

Customer responsibilities

Requesting a BAA

HIPAA-tier customers can execute a BAA in-app from /app/baa after subscribing. Review the starter template at /baa-template before execution; that document is the BAA SecurelyFax offers HIPAA-tier customers, subject to negotiation in writing. For prior review with counsel, contact hipaa@securelyfax.com.

Breach notification

SecurelyFax will notify the customer without unreasonable delay (and in any case within the timeframes required by 45 CFR §164.410) of any discovered breach of unsecured PHI.

Nothing on this page constitutes legal advice. Customers are responsible for their own HIPAA compliance program; SecurelyFax provides a compliant service tier and the contractual terms required to use it.