By David Thompson · Published February 26, 2026 · Updated June 8, 2026 · 6 min read
Quick Answer: eFax is HIPAA compliant only on its Protect ($49.99/mo) and Corporate plans. The Plus and Pro tiers do not include a Business Associate Agreement and cannot be used to send or receive PHI. For affordable HIPAA-compliant faxing, mFax Business includes a BAA on every paid plan starting at about $9/mo.
If your healthcare practice is evaluating whether eFax is HIPAA compliant, the answer depends entirely on which plan you choose. Only two of eFax's four pricing tiers include the safeguards required by HIPAA — and even those come with fine print that compliance officers should review carefully.
Below, we break down exactly which eFax plans qualify, what security features they provide, where the fine print gets concerning, and how eFax compares to mFax Business for faxing PHI securely.
Is eFax HIPAA Compliant?
eFax can be HIPAA compliant — but only on specific plans. The two consumer-oriented tiers, Plus ($18.99/mo) and Pro ($24.99/mo), do not include a Business Associate Agreement (BAA), which is the minimum legal requirement before any vendor can handle Protected Health Information (PHI).
Without a BAA, using eFax Plus or Pro to fax medical records, insurance claims, prescriptions, or any document containing PHI would constitute a HIPAA violation — regardless of the encryption eFax provides on those plans.
Only eFax Protect ($49.99/mo) and eFax Corporate (custom pricing) include a BAA and the full set of administrative, technical, and physical safeguards that HIPAA requires from a fax service.
Common Mistake
Many healthcare offices sign up for eFax Plus or Pro because of the lower price, not realizing these plans are not HIPAA compliant. Without a BAA, your practice is exposed to penalties ranging from $141 to $2,134,831 per violation category.
eFax Plans: Which Tiers Include HIPAA?
Here's a plan-by-plan breakdown of eFax's HIPAA status:
| Plan | Price/mo | Pages Included | BAA | HITRUST | HIPAA Compliant |
|---|---|---|---|---|---|
| eFax Plus | $18.99 | 340 (170 send + 170 receive) | No | No | No |
| eFax Pro | $24.99 | 550 (275 send + 275 receive) | No | No | No |
| eFax Protect | $49.99 | 1,000 total | Yes | No | Yes |
| eFax Corporate | Custom | Custom | Yes | Yes | Yes |
All plans carry a $10 one-time setup fee and charge $0.10 per page for overages beyond the included allowance.
Key takeaway: The minimum cost for HIPAA-compliant eFax is $49.99/month — nearly triple the Plus plan. For our full breakdown of eFax's pricing across all tiers, see our eFax review.
eFax HIPAA Security Features
On the Protect and Corporate tiers, eFax provides these security features relevant to HIPAA compliance:
- AES-256 encryption at rest — faxes stored on eFax servers are encrypted using the Advanced Encryption Standard
- TLS 1.2 encryption in transit — fax data is encrypted during transmission between your device and eFax's servers
- Business Associate Agreement (BAA) — the legally binding contract required before any vendor can process PHI on your behalf
- Audit trails — timestamped logs of sent and received faxes, including recipient details and delivery confirmation
- jSign e-signatures — a digital signature tool included free with Protect, useful for signing medical forms electronically
- Access controls — user authentication and role-based permissions
eFax Corporate adds HITRUST CSF r2 certification, a rigorous security framework that many large health systems and insurance payers require from their vendors.
TLS 1.2 vs. TLS 1.3
eFax uses TLS 1.2 for data in transit. The newer TLS 1.3 standard eliminates several known vulnerabilities and is faster. mFax Business uses TLS 1.3 — see our encryption guide for the technical differences.
The Fine Print: 3 Things to Know Before You Buy
eFax Protect checks the major HIPAA boxes, but compliance officers should be aware of these issues that HIPAA analysts have flagged:
1. The Clause #7 Contradiction
eFax's Customer Agreement includes language stating that users agree not to use the Services to store PHI unless they are using "eFax Secure." This creates confusion: eFax markets Protect as its HIPAA-compliant plan, but the legal agreement references a different product name — "eFax Secure" — as the required tier for PHI.
It's unclear whether "eFax Secure" is an internal name for Protect or a distinct product. If a breach occurs, this ambiguity could complicate your legal position.
2. HITRUST Certification Doesn't Cover Protect
eFax highlights its HITRUST CSF certification prominently in marketing materials, but this certification applies only to eFax Corporate, eFax Unite, and jSign — not to eFax Protect.
If your organization or a payer contract requires HITRUST certification from vendors, eFax Protect does not qualify. You would need the Corporate plan, which requires a sales call and custom pricing.
3. BAA Not Reviewable Before Purchase
You cannot review eFax's BAA terms before subscribing to a Protect or Corporate plan. For healthcare organizations accustomed to having legal counsel review vendor agreements before signing, this lack of transparency is a notable gap.
Red Flag for Compliance Officers
A HIPAA-compliant vendor should provide BAA terms for review before you commit. If a vendor won't share the BAA upfront, flag it in your risk assessment.
What Does eFax HIPAA Compliance Actually Cost?
Let's compare real-world costs. A typical small medical practice faxing 200 pages per month (referrals, insurance claims, lab results):
| Cost Component | eFax Protect | mFax Business (usage-based) |
|---|---|---|
| Monthly plan | $49.99 | ~$9 ($3/seat + $4/100pp) |
| Pages included | 1,000 | Pay per page used |
| Overage cost | $0.10/page | No overage — usage-based |
| Setup fee | $10 (one-time) | None |
| BAA included | Yes | Yes (on request) |
| Year 1 total | $609.88 | ~$108 |
At 200 pages/month, mFax Business saves about $500 per year — an 82% reduction — while providing the same core HIPAA safeguards plus TLS 1.3 encryption and team accounts.
For higher-volume practices exceeding 500 pages/month, eFax Protect's 1,000-page allowance becomes more competitive. But even then, overages at $0.10/page add up fast during busy months.
Bottom line: Unless your organization specifically requires HITRUST certification (which only eFax Corporate provides), mFax Business delivers equivalent HIPAA compliance at a significantly lower price point.
eFax vs. mFax: HIPAA Compliance Compared
Here's a head-to-head comparison of the features that matter most for HIPAA:
| Feature | eFax Protect | mFax Business |
|---|---|---|
| BAA available | Protect & Corporate only | All paid plans |
| Encryption in transit | TLS 1.2 | TLS 1.3 |
| Encryption at rest | AES-256 | AES-256 |
| HITRUST certified | Corporate only | No |
| Audit trail | Yes | Yes |
| 2FA / MFA | Yes | Yes |
| Team accounts | Corporate only | All plans |
| Mobile app | Yes | Yes |
| HIPAA starting price | $49.99/mo | From $9/mo |
| BAA reviewable pre-purchase | No | Yes (on request) |
| E-signatures | jSign included | Not included |
Where eFax wins: E-signatures (jSign) bundled with Protect, and HITRUST certification available on Corporate.
Where mFax wins: Lower HIPAA entry price (about $9 vs. $49.99), TLS 1.3 encryption, team accounts on all plans, transparent BAA process, and no setup fees.
For a broader feature comparison beyond HIPAA — including international faxing, mobile UX, and cancellation policies — see our full mFax vs. eFax comparison.
How to Choose a HIPAA-Compliant Fax Service
When evaluating any fax vendor for healthcare use, verify these seven requirements. For the full technical breakdown, see our complete HIPAA fax guide.
- ✓BAA available: The vendor signs a Business Associate Agreement before you transmit any PHI.
- ✓TLS encryption in transit: All fax data is encrypted during transmission — TLS 1.2 minimum, TLS 1.3 preferred.
- ✓AES-256 encryption at rest: Stored faxes are encrypted on the vendor's servers.
- ✓Audit trail: Timestamped logs of every fax sent and received, with recipient details.
- ✓Access controls: Role-based access, unique logins per user, no shared accounts.
- ✓MFA / 2FA: Multi-factor authentication to prevent unauthorized access to fax accounts.
- ✓Transparent terms: BAA and security documentation available for review before you purchase.
Both eFax Protect and mFax Business meet the first six criteria. The key differences are pricing, encryption standard (TLS 1.2 vs. 1.3), and whether you can review the BAA before committing.
For our ranked list of all providers that meet these requirements, see the 10 best HIPAA-compliant fax services.
Get Started with HIPAA-Compliant Faxing
If your practice needs to send PHI securely, you don't need to pay $49.99/month for compliance. mFax Business includes a BAA on every paid plan, TLS 1.3 encryption, AES-256 at rest, audit trails, and team accounts — starting at about $9/mo with no setup fees. There are no rigid fixed tiers: you build your own plan with a live calculator, choosing the exact seats and pages your practice needs and paying only for what you use.
Visit mFax.to/business to request a BAA and get started.