By Sarah Martinez · Published November 12, 2026 · 9 min read
Quick answer: Insurance agencies still fax because carriers, adjusters, lenders and medical offices still send and request faxed documents: applications, signed forms, loss runs, claim paperwork and proof of insurance. A compliant setup encrypts every fax, gives each person their own login, keeps a record of every send and is backed by a vendor you have vetted under your state's insurance data security law. mFax Business gives an agency a team fax line, email-to-fax and a signed BAA for health business, from about $9/mo.
Fax for insurance work is rarely about the fax machine. It is about the people an agency deals with every day. A mortgage lender wants evidence of insurance before closing. A health plan takes appeals at a fax number. An adjuster asks for signed statements. A commercial underwriter needs the signed application and five years of loss runs.
Most of those counterparties will take email or a portal some of the time. Fax is the channel almost all of them accept, and the one many of them still publish first.
This guide is written for independent agencies and brokers. It covers what gets faxed, which rules apply to those documents (GLBA, state insurance data security laws, HIPAA and the junk fax rules) and how to set up a fax workflow that will satisfy your carriers and your regulator.
Why Insurance Agencies Still Fax
Insurance agencies still fax because the other side of the transaction does. An agency sits between clients and a long list of organizations, each with its own intake channel:
- Carriers and underwriters. Many still accept signed applications, endorsement requests and cancellation forms by fax, especially for small commercial and specialty lines.
- Claims departments and independent adjusters. Proof-of-loss forms, signed statements, repair estimates and medical bills often travel by fax when a claim portal isn't available to the agency.
- Mortgage lenders and servicers. They ask for evidence of insurance and mortgagee clause changes, and a faxed declarations page is a common answer. If you also work with real estate agents, our fax for real estate guide shows the closing side of the same exchange.
- Health plans and medical providers. Health carriers publish fax numbers for claims, appeals and prior authorization. Our guides to the Aetna fax number and the Anthem fax number list them by department.
- Clients. Older clients and small businesses often have a fax but no scanner, and they fax back what you send them.
Fax also leaves a record. When a transmission is delivered, the receiving machine confirms the pages came through, which gives you something to file when a deadline is disputed.
What Insurance Agencies Fax: Documents by Line of Business
The documents below are the ones agencies most often send or receive by fax. Every one of them contains nonpublic personal information, which matters for the rules in the next section.
| Document | Usually sent to | What to watch |
|---|---|---|
| Signed applications (ACORD forms, carrier applications) | Carrier or wholesaler | Carrier rules on faxed signatures; SSNs and driver's license numbers on the form |
| Loss runs | From the prior carrier to your agency | Request them on agency letterhead with the insured's signed authorization |
| Endorsements, cancellations, reinstatements | Carrier | Effective dates: keep the delivery confirmation |
| Proof of insurance, declarations pages, mortgagee changes | Lender or loan servicer | Confirm the lender's fax number from the loan paperwork, not from a search result |
| Claim forms, proof of loss, signed statements | Carrier claims department or adjuster | Claim number on every page; check whether the carrier prefers a portal |
| Medical records, bills, prior authorization requests | Health plan or provider | Protected health information: HIPAA applies |
| Premium finance agreements | Premium finance company | Bank account details: verify the number by phone first |
Verify fax numbers before sending
A wrong digit sends a client's Social Security number to a stranger. Take the number from the carrier's or lender's own documents or website, and call to confirm any number that arrived by email. Email instructions can be forged.
The Rules That Apply to Faxed Insurance Documents
No law bans faxing insurance documents. Several laws decide how you must protect them. The four that matter for most agencies are the Gramm-Leach-Bliley Act, your state's insurance data security law, HIPAA for health information, and the federal junk fax rules for marketing.
GLBA: enforced by your state insurance regulator, not the FTC
The Gramm-Leach-Bliley Act (GLBA) requires financial institutions, insurance included, to protect their customers' nonpublic personal information. For anyone "engaged in providing insurance," enforcement belongs to the state insurance authority under 15 U.S.C. § 6805(a)(6).
That is why the FTC's Safeguards Rule usually isn't the rule your agency answers to. The FTC says it applies to financial institutions "that aren't subject to the enforcement authority of another regulator under section 505" of GLBA (FTC Safeguards Rule guidance). It still makes a useful benchmark, and it tells covered businesses to encrypt customer information "on your system and when it's in transit." If your agency also runs a separate business the FTC names, such as tax preparation, that business can fall under the FTC rule.
State insurance data security laws (NAIC Model #668)
Most of the specific security duties come from your state. The National Association of Insurance Commissioners (NAIC) wrote the Insurance Data Security Model Law (#668), and states adopt their own versions.
According to the NAIC state page for Model #668 (Summer 2026 edition), 28 jurisdictions have adopted the model in a substantially similar form: Alabama, Alaska, Connecticut, Delaware, Hawaii, Illinois, Indiana, Iowa, Kentucky, Louisiana, Maine, Maryland, Michigan, Minnesota, Mississippi, Missouri, New Hampshire, North Dakota, Ohio, Oklahoma, Pennsylvania, Puerto Rico, Rhode Island, South Carolina, Tennessee, Vermont, Virginia and Wisconsin. Other states have related laws or bulletins. New York has its own cybersecurity regulation, 23 NYCRR Part 500, which covers anyone licensed under the state's Insurance Law.
The model law applies to every "Licensee," meaning any person licensed or required to be licensed under the state's insurance laws, which includes producers. In the model text:
- Section 4 requires a written information security program based on a risk assessment. One of the listed measures is to protect nonpublic information "by encryption or other appropriate means" while it is transmitted over an external network.
- Section 4F requires you to "exercise due diligence in selecting" a third-party service provider and to require that provider to protect the information it holds. A fax service that stores your clients' documents is such a provider.
- Section 6 requires notice to the insurance commissioner "in no event later than 72 hours" after you determine that a cybersecurity event has occurred, when the model's criteria are met.
- Section 9 exempts a licensee with fewer than ten employees, including independent contractors, from Section 4. It also treats a HIPAA-compliant information security program as meeting Section 4, if the licensee certifies its compliance in writing.
Your state's version may differ
States change thresholds, deadlines and exemptions when they adopt the model. Read your own state's statute, which the NAIC state page cites, before you rely on the small-agency exemption.
HIPAA when health information is involved
HIPAA covers three kinds of covered entities: health plans, health care clearinghouses and certain health care providers. Under 45 CFR § 160.103, a health plan includes a health insurance issuer. A business associate is someone who handles protected health information while performing services for a covered entity, and the listed services include administrative, consulting and management work.
For an agency, that means health and benefits work can bring HIPAA with it. If you handle PHI on behalf of a health plan, expect the plan to ask for a business associate agreement (BAA). Any fax service that stores or transmits that PHI for you then needs a BAA with you too.
Marketing faxes: the TCPA junk fax rules
The federal junk fax rules apply to fax advertising. Under 47 CFR § 64.1200(a)(4), an unsolicited fax ad needs an established business relationship with the recipient. It must also carry an opt-out notice that is "clear and conspicuous and on the first page," and opt-out requests must be honored within 30 days. Faxing a quote that a client asked for is not an unsolicited ad, but a mass fax promoting a new commercial program can be. Our junk fax guide covers the rules and the FCC's complaint process.
Is a faxed signature accepted?
A faxed signature counts when the recipient's rules say it does. The federal E-SIGN Act states that it applies to "the business of insurance," and electronic records and signatures can't be denied legal effect just because they are electronic (15 U.S.C. § 7001). The same section also says nobody is required to agree to use or accept them. Carriers, lenders and courts set their own rules on whether a faxed application or proof-of-loss form is acceptable, so check before you rely on one. Our guide to whether a fax is a legal document covers the details.
How to Set Up a Modern Fax Workflow for an Insurance Agency
A modern agency fax workflow replaces the machine with a fax service that each person signs in to. The six steps below use mFax Business as the example. The same questions apply to any provider you evaluate.
Keep the fax number your carriers already have
Your number is printed on years of applications, carrier records and lender files, so don't change it. With mFax Business, porting is free: the workspace owner opens Settings › Team fax line › Move it to mFax and enters the account details exactly as the current carrier's bill shows them. Most transfers finish within 7 business days. Keep the old service active until then. See our fax number porting guide.
Give every producer and CSR their own login
A shared fax machine can't tell you who sent what, and your security program has to name who can see client data. In mFax Business, the owner invites each colleague by email. Members send and receive on the agency's team fax line, every teammate signs in with their own login, and the workspace keeps audit logs.
Sign the BAA if you touch health business
If your agency handles PHI, put the BAA in place before the first medical record is faxed. On mFax Business, the BAA is included on every plan: the owner opens Settings › Business Associate Agreement › Review & sign, and both sides sign electronically.
Send from the inbox your team already uses
Members of an mFax Business organization can fax from Outlook, Gmail or Apple Mail by addressing the message to the fax number at send.mfax.to, for example 12125550147@send.mfax.to. The email address each member signs in with is authorized automatically. Mail from other addresses is not faxed. The subject and body become the cover sheet, so keep client data in the attachment. Our email-to-fax guide walks through it.
Use a cover sheet with a confidentiality notice
Put the claim or policy number, the recipient's name and the page count on the cover sheet, and tick Confidential to add a confidentiality notice. Keep Social Security numbers, diagnoses and account numbers off the cover sheet, because it is the first page anyone at the receiving fax sees.
File the delivery receipt with the policy or claim
When a fax is delivered, the row shows Delivered and a PDF receipt is available to download. When it fails, the row says why, for example Recipient busy, No fax tone or Number not in service. Save the receipt in your agency management system next to the document it proves.
Faxing Claims to an Insurance Company: A Checklist
A faxed claim gets processed faster when the adjuster can match every page to the file. Before you send claim documents, run through this list:
- Get the right number. Use the fax number on the carrier's claim acknowledgment or claims web page. Health plans list separate numbers for claims, appeals and prior authorization.
- Put the claim number on every page. Pages can be separated on arrival, so a cover sheet alone isn't enough.
- Send one claim per fax. Mixing two insureds in one transmission is a privacy incident waiting to happen.
- Send only what was requested. A repair estimate doesn't need the full policy attached, and every extra page puts more personal information in someone else's fax tray.
- Keep the receipt. If the carrier later says it never received the proof of loss, the delivery receipt is your evidence that the pages arrived.
For general advice on choosing between fax, email and portals for sensitive files, see our guide on how to send documents securely.
What to Ask a Fax Provider: A Vendor Checklist
Model #668 asks you to do due diligence on a fax provider. These questions are the substance of it. Ask every provider the same questions and keep the answers with your information security program.
| Question to ask | Why your program needs it | mFax Business answer |
|---|---|---|
| Is data encrypted in transit and at rest? | Model #668 §4 names encryption over external networks | TLS 1.2+ in transit, AES-256 at rest |
| Is there an independent security audit? | Supports your vendor due-diligence file | SOC 2 Type II |
| Does every user have their own login? | Access controls and accountability | Yes, every teammate signs in with their own login |
| Is there an audit trail? | Investigating a possible cybersecurity event | Audit logs, plus a confirmed-or-failed status on every fax |
| Will you sign a BAA? | Required before a vendor handles PHI | Yes, included on every plan |
| Where is data stored? | Risk assessment and client questions | PHI is stored and processed in the US |
| Can we keep our number? | Carriers and lenders already have it | Yes, porting is free |
What It Costs
mFax Business is priced by seats and pages, from about $9/mo billed annually. The rate is $3 per seat and $4 per 100 pages a month, with 20% off annual billing. You set both with the calculator on the mFax Business page.
| Example agency | Seats | Pages a month | Monthly billing | Annual billing |
|---|---|---|---|---|
| Solo agent | 1 | 200 | ~$11/mo | ~$9/mo |
| Small agency | 3 | 500 | ~$29/mo | ~$23/mo |
| Agency with a claims desk | 5 | 1,000 | ~$55/mo | ~$44/mo |
The page allowance is shared by every seat. When it runs out, further faxes are refused rather than charged extra, and you can add pages in Settings › Plan. Plans cancel anytime. Fax numbers are local US and Canadian numbers.
The Bottom Line
Fax remains part of insurance work because carriers, lenders and health plans keep asking for it, not because agencies chose it. The useful question is whether your fax setup holds up under your state's insurance data security law: encrypted, with individual logins and a record of every send, from a vendor you have vetted.
mFax Business gives your agency a team fax line, email-to-fax for every member, audit logs, free number porting and a signed BAA for health business, all from about $9/mo. Build your own plan with exactly the seats and pages you need.