Is eFax HIPAA compliant?
Only on eFax's business-grade plans — the agreement is listed on Business and Corporate, and the consumer Personal plan does not include one, so a solo practice on a cheap eFax number is unprotected.
Applies to eFax (Business, Corporate, Protect). Last reviewed against Consensus Cloud Solutions's own documentation. Next review December 25, 2026.
Reviewed by Carlos Mendez — IT Security Manager, regional healthcare network.
What you must do
- Buy a business-grade plan. eFax's plan comparison shows the agreement on eFax Business and eFax Corporate.
- Confirm the product name on your quote in writing — eFax's own pages name different products as carrying coverage, and the naming does not line up.
- Request and execute the agreement before any patient information is faxed. eFax describes agreements as available 'if needed or requested', so it is not automatic.
- For Corporate, work through eFax sales, who quote customised plans and supply the agreement documentation.
- Make sure the mailbox you route fax-to-email delivery into is itself covered by an agreement with its own provider.
Does eFax sign a business associate agreement?
Yes. Consensus Cloud Solutions offers one. Business-grade plans. Pricing shows the agreement on eFax Business and eFax Corporate; other eFax pages also name Unite, jSign and Protect. Not shown on eFax Personal. Request it from eFax sales when purchasing — the HIPAA page directs organisations to their contact form for custom plans and agreement documentation.
What this means in practice
eFax is sold by Consensus Cloud Solutions across a consumer tier and several business tiers, and the agreement only travels with the business ones. On eFax's own plan comparison, the agreement appears against eFax Business and eFax Corporate. It does not appear against eFax Personal — which is awkward, because the same table still describes Personal as HIPAA compliant. A practice that buys the cheapest number on that strength has encryption but no contract.
Product naming is genuinely inconsistent across eFax's pages: one names Business, Corporate, Unite and jSign as carrying coverage, another names Protect and Corporate. Before you sign anything, get the specific product name written into your quote alongside the agreement.
Coverage also stops at delivery. eFax's security certifications speak to eFax's own programme — they say nothing about where your received faxes land or who can read them afterwards.
How organizations get this wrong
The specific mistakes we see with eFax, not generic advice.
- Buying eFax Personal because the marketing says HIPAA compliant, when eFax's own comparison shows no agreement on that tier.
- Routing fax-to-email delivery into a personal Gmail or Yahoo inbox, putting every received patient record outside any agreement.
- Assuming an existing consumer eFax number upgrades automatically; the agreement follows the business-grade product, not the phone number.
- Citing eFax's certifications to an auditor as proof your practice is compliant rather than as vendor security assurance.
What the agreement does not cover
- eFax Personal, which the plan comparison does not show as including an agreement.
- Any eFax product not named on the agreement coverage list you are quoted.
- The mailbox or device where received faxes land after eFax delivers them.
- Your own retention, access control and disposal practices for received fax documents.
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with eFax, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Consensus Cloud Solutions’s own published documentation, read on the date shown.
- HIPAA Compliant Healthcare Fax & Data Solutions — eFax (Consensus Cloud Solutions). No publication date given. Read July 29, 2026.
- HIPAA, HITRUST, and More | eFax Compliance — eFax (Consensus Cloud Solutions). No publication date given. Read July 29, 2026.
- Plans & Pricing — eFax (Consensus Cloud Solutions). No publication date given. Read July 29, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Consensus Cloud Solutions’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.