Is Documo (mFax) HIPAA compliant?
Yes — Documo states HIPAA compliance comes standard with every plan at no extra fee and that it signs a business associate agreement for healthcare customers, including on its cheapest tier.
Applies to Documo Cloud Fax. Last reviewed against Documo's own documentation. Next review December 27, 2026.
Reviewed by Carlos Mendez — IT Security Manager, regional healthcare network.
What you must do
- Ask for the agreement. Documo makes it available on request rather than executing one automatically at signup.
- Have it in place before the first fax containing patient information is sent or received.
- Give Documo the correct legal name of your covered entity so the agreement names the right party.
- Any tier works — Documo states HIPAA compliance comes standard with every plan, with no added fees.
- Ensure the mailbox behind email-to-fax and fax-to-email delivery is covered by its own agreement.
- Confirm whether signature and document-automation add-ons sit inside the same agreement before putting patient documents through them.
Does Documo (mFax) sign a business associate agreement?
Yes. Documo offers one. All plans. Documo states HIPAA compliance comes standard with every plan, with no added fees. Contact Documo with the legal name of your covered entity and ask for the agreement, then sign and return it before sending patient information.
What this means in practice
Documo, previously sold as mFax, takes the opposite approach to eFax on plan tiers. Its pricing page states plainly that HIPAA compliance comes standard with every plan, and its own material confirms all plans are compliant with no added fees and that Documo signs an agreement for healthcare customers. A single-clinician practice on the entry-level plan is on the same footing as an enterprise buyer.
The agreement is still something you request rather than something that appears at checkout. Contact Documo with the legal name of your covered entity, get the document signed and returned, and only then start faxing patient records. Plans differ by pages, users and numbers — not by whether the agreement is available.
Coverage ends where Documo's service ends. Email-to-fax and fax-to-email deliver into a mailbox governed by someone else's agreement, and Documo's HIPAA page speaks about faxing rather than its signature and document-automation products, so confirm those separately.
How organizations get this wrong
The specific mistakes we see with Documo (mFax), not generic advice.
- Treating signup as the agreement. Documo makes it available on request, so nothing is executed until you ask and return a signed copy.
- Using email-to-fax from a personal or uncovered mailbox, which puts patient documents outside any agreement before they reach Documo.
- Running patient documents through Documo's signature or automation add-ons without confirming those products sit inside your executed agreement.
- Under-buying pages on the entry tier and letting overages disrupt referrals during a busy period.
What the agreement does not cover
- The email account used for email-to-fax or where inbound faxes are delivered, governed by your mail provider's own agreement.
- Documo's signature and document-automation products, whose scope is unconfirmed rather than confirmed.
- Your own retention, access control and disposal practices for faxed records.
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with Documo (mFax), someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Documo’s own published documentation, read on the date shown.
- Plans & Pricing | Cloud Fax & AI Document Automation — Documo. No publication date given. Read July 29, 2026.
- HIPAA Compliant Fax, Secure and Scalable for Healthcare — Documo. No publication date given. Read July 29, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Documo’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.