Is Documo (mFax) HIPAA compliant?
Yes, Documo states HIPAA compliance comes standard with every plan at no extra fee and that it signs a business associate agreement for healthcare customers, including on its cheapest tier.
Applies to Documo Cloud Fax. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Ask for the agreement. Documo makes it available on request rather than executing one automatically at signup.
- Have it in place before the first fax containing patient information is sent or received.
- Give Documo the correct legal name of your covered entity so the agreement names the right party.
- Any tier works: Documo states HIPAA compliance comes standard with every plan, with no added fees.
- Ensure the mailbox behind email-to-fax and fax-to-email delivery is covered by its own agreement.
- Confirm whether signature and document-automation add-ons sit inside the same agreement before putting patient documents through them.
Does Documo (mFax) sign a business associate agreement?
Yes. Documo offers one. All plans. Documo states HIPAA compliance comes standard with every plan, with no added fees. Contact Documo with the legal name of your covered entity and ask for the agreement, then sign and return it before sending patient information.
What this means in practice
Documo, previously sold as mFax, takes the opposite approach to eFax on plan tiers. Its pricing page states plainly that HIPAA compliance comes standard with every plan, and its own material confirms all plans are compliant with no added fees and that Documo signs an agreement for healthcare customers. A single-clinician practice on the entry-level plan is on the same footing as an enterprise buyer.
The agreement is still something you request rather than something that appears at checkout. Contact Documo with the legal name of your covered entity, get the document signed and returned, and only then start faxing patient records. Plans differ by pages, users and numbers, not by whether the agreement is available.
Coverage ends where Documo's service ends. Email-to-fax and fax-to-email deliver into a mailbox governed by someone else's agreement, and Documo's HIPAA page speaks about faxing rather than its signature and document-automation products, so confirm those separately.
How organizations get this wrong
- Treating signup as the agreement. Documo makes it available on request, so nothing is executed until you ask and return a signed copy.
- Using email-to-fax from a personal or uncovered mailbox, which puts patient documents outside any agreement before they reach Documo.
- Running patient documents through Documo's signature or automation add-ons without confirming those products sit inside your executed agreement.
- Under-buying pages on the entry tier and letting overages disrupt referrals during a busy period.
What the agreement does not cover
- The email account used for email-to-fax or where inbound faxes are delivered, governed by your mail provider's own agreement.
- Documo's signature and document-automation products, whose scope is unconfirmed rather than confirmed.
- Your own retention, access control and disposal practices for faxed records.
Keep a record of your Documo (mFax) agreement
Sources
- Plans & Pricing | Cloud Fax & AI Document Automation: Documo. Read July 29, 2026.
- HIPAA Compliant Fax, Secure and Scalable for Healthcare: Documo. Read July 29, 2026.
Documo can change these terms at any time. If something here no longer matches what Documo tells you, tell us.