By David Thompson · Published September 14, 2025 · 9 min read
Quick Answer: To send documents securely, use a channel the recipient controls: their secure portal if they have one, fax if they're a medical office, insurer, government agency or law firm, and otherwise an encrypted email or a password-protected file with the password sent by text. A plain email attachment is the weakest option. To fax without a machine, mFax sends from your phone, computer or browser over an encrypted connection and gives you a delivery receipt; practices that fax patient records get a signed BAA with mFax Business.
Most sensitive paperwork still leaves as an email attachment — a tax return for the accountant, a passport scan for a landlord, lab results for a new doctor. It's the easy way, and the weakest one. The file stays readable in your Sent folder and in the recipient's inbox for years, and one autocomplete slip delivers it to the wrong person.
Better options exist, and none of them is exotic. Which one fits depends on three things: who receives the document, how sensitive it is, and whether you need proof it arrived. Below, seven ways to send documents securely are compared side by side, with the steps for each and the spot where each one leaks.
The Most Secure Way to Send Documents Depends on the Recipient
The most secure way to send a document is a protected channel your recipient already uses and checks. A perfectly encrypted file is no help if the clinic can't open it, and an insurer's fax line is no help with a landlord. Start with who is on the other end:
| Who you're sending to | Best option | If that isn't available |
|---|---|---|
| Doctor's office, hospital or pharmacy | Their patient portal | Fax, to the number on their website or form |
| Health insurer | The member or provider portal | The fax number printed on the claim, appeal or authorization form |
| IRS, SSA or another agency | The upload option or fax number named on the form or notice | Mail, to the address on the form |
| Accountant, lender or law firm | Their client portal | A password-protected PDF, or fax if they list a number |
| Employer HR or landlord | Their onboarding or tenant portal | A password-protected PDF or a restricted share link |
| Family or a friend | An end-to-end encrypted messaging app | A restricted share link |
| Original signed or notarized papers | Certified mail or hand delivery | — |
Healthcare, insurance, government and law are the reason fax hasn't gone away. Many of their forms list a fax number and a mailing address but no email, so for them the real choice is portal, fax or mail.
"Sensitive" also covers more than medical records. A W-9 carries your Social Security or tax ID number, and a bank statement maps your finances, so both deserve the same care as a lab report.
7 Ways to Send Documents Securely, Compared
The methods differ in four places: whether the document is protected on the way, where copies stay afterwards, whether you can prove it arrived, and what the recipient needs to open it. Plain email sits in the last row as the baseline.
| Method | Protected on the way | Copies afterwards | Proof it arrived | Recipient needs |
|---|---|---|---|---|
| Recipient's portal | Encrypted upload | Behind the recipient's login | Usually a confirmation in the portal | An account with them |
| Online fax | Encrypted upload, then a direct call to their machine | Your fax history and their machine | Confirmation from the receiving machine | A fax number |
| Encrypted email | Message encrypted | Encrypted in both mailboxes | Usually none | A compatible service, or the opening steps |
| Password-protected PDF or zip | File encrypted | Encrypted file in both mailboxes | None | The password, sent separately |
| Restricted share link | Encrypted connection (HTTPS) | In your cloud account until removed | Some services show who opened it | The link, restricted to them |
| Encrypted messaging app | End-to-end encrypted | On both phones | Delivered and read ticks | The same app |
| Certified mail | Sealed envelope | Paper only | Delivery record; signature with a return receipt | A mailing address |
| Plain email attachment | Usually encrypted between mail servers, not end to end | Readable in both mailboxes | None | Nothing |
1. Upload It to the Recipient's Secure Portal
A portal is the recipient's own locked mailbox: the patient portal at a clinic, the client portal at an accounting or law firm, the upload page at a lender. The upload is encrypted, the file lands behind their login instead of in an inbox, and they decide who on their side can see it.
Where it leaks: rarely on the way. The risk is a fake portal: "you have a secure document" emails are a favorite phishing lure. Open the portal by typing the organization's address yourself, never from a link in an email you didn't expect. The other catch is that you need an account, and not every recipient has a portal.
2. Fax It Through an Online Fax Service
Fax is the channel healthcare, insurers, government agencies and law firms still publish, and HHS's HIPAA guidance names it outright. Its FAQ on sharing patient information says providers may share it for treatment "by phone, fax, e-mail, or otherwise," as long as they use reasonable safeguards.
An online fax service takes the machine out of it. With mFax, the document travels from your phone or computer to mFax over an encrypted TLS connection and is stored encrypted on servers in the United States, where only you can open it. From there the fax is a phone call from a telecom carrier straight to the receiving machine — it doesn't wait in a chain of mailboxes. When that machine confirms every page, the fax shows Delivered, and the receipt downloads as a PDF.
Where it leaks: the number and the tray. One wrong digit sends the pages to a stranger, so confirm any number you don't use regularly — HHS's own example of a reasonable safeguard. On the far end the pages print or land in a fax inbox, so the cover sheet should carry a confidentiality notice and nothing else sensitive. The call itself is point to point rather than end-to-end encrypted; our guide to whether faxes are encrypted explains what that means in practice.
3. Send an Encrypted Email
Encrypted email scrambles the message so only the recipient can read it — when both sides have the tools for it:
- Outlook has an Encrypt option with a qualifying Microsoft 365 subscription. People on other mail services get instructions for opening the message.
- S/MIME and PGP, the standards behind certificate-based encryption, need certificates or keys set up on both ends. That keeps them mostly inside large organizations and technical circles.
- Proton Mail encrypts end to end between Proton users and can send a password-protected message to anyone else.
- Gmail's confidential mode isn't encryption. It adds an expiry date and an optional SMS passcode, and turns off forwarding, copying, printing and downloading. But as Google's own help page notes, recipients can still take screenshots or photos.
Where it leaks: at the recipient. Plenty of offices can't open certificate-encrypted mail, and an attachment saved out of an encrypted message is an ordinary file again.
4. Email a Password-Protected PDF or Zip File
When the recipient takes email and nothing fancier, encrypt the file instead of the message. Word's Encrypt with Password (under File › Info › Protect Document on Windows), Adobe Acrobat and most PDF editors add an open password, and 7-Zip makes AES-256-encrypted zip files.
- Use a passphrase. Four or five unrelated words beat a short password.
- Attach the file to an email with a plain subject line, like "Documents you asked for."
- Send the password another way — a text message or a phone call. Never in the same email.
Where it leaks: the email still sits in both mailboxes, scrambled but intact, and anyone who learns the password later can open it. Once the recipient opens the file, they hold an ordinary copy.
5. Share a Restricted Link Instead of an Attachment
Google Drive, OneDrive and Dropbox let you send a link instead of a file, so the document stays in one place you control. Done right:
- Share with the recipient's email address only — not "anyone with the link."
- Set an expiry date if your plan offers one.
- Remove access, or delete the file, once they have it.
Where it leaks: one wrong sharing setting opens the file to anyone who has the link, and links get forwarded. Large-file transfer services work the same way, with the same weak spot.
6. Use an End-to-End Encrypted Messaging App
For a document going to a person rather than an organization — an ID scan for a family member, a lease for a roommate — Signal and WhatsApp encrypt messages and attachments end to end. Both of you need the same app, and the file then lives on both phones and in any backups. Delete it once it has done its job.
7. Send Originals by Certified Mail
Some papers have to travel as paper: originals with an ink signature, notarized forms, certified copies. USPS Certified Mail gives you a mailing receipt and a delivery record, and a return receipt adds the recipient's signature. It's the slowest option here and the only one for originals.
How Do You Send Documents Securely by Email?
Encrypt something before you press Send — the message, the attachment or both — and send any password through a different channel. Step by step:
- Check the address letter by letter. Autocomplete makes it easy to pick the wrong Jennifer.
- Send only what was asked for. Leave out pages the recipient doesn't need.
- Encrypt. Use Outlook's Encrypt if your organization has it; otherwise password-protect the attachment.
- Keep the subject line and body generic. They show up in notifications and previews, and a password on the attachment doesn't cover them.
- Send the password by text or phone call.
- Clean up. Once the recipient confirms they have it, delete the message from your Sent folder and the file from your Downloads.
If the recipient lists a fax number, or the document is going to a clinic or an insurer, fax is often the simpler route — the recipient doesn't need to install or unlock anything.
How to Fax a Document Securely with mFax
You can fax from your phone or computer — no fax machine, no store counter. Here is the whole flow, in the app's own steps:
Confirm the fax number
Take it from the recipient's website, form or letter — or call and ask — rather than from an old email or a search result. A wrong digit is the classic way a fax goes astray.
Open mFax and start a new fax
Use the app on iPhone, Android or Windows, or open mFax in your browser, and choose New Fax. Enter the number with its country code — +1 for the US and Canada.
Add the document
Attach a PDF, a Word file or a photo; it's converted to fax pages for you. On iPhone, iPad or Android, the camera scanner turns a paper page into a fax-ready PDF. To sign first in the web or mobile app, open the page, choose Edit page and use Sign.
Add a cover sheet marked Confidential
Pick a template, fill in your name, the subject and a short message, and tick Confidential to add a HIPAA confidentiality notice. Keep names, account numbers and diagnoses off it — the cover sheet is the page on top of the tray. Our confidential fax cover sheet guide has wording that works.
Send, then keep the receipt
Check the page count and press Send. The fax stays In Progress while the pages cross — the app estimates about 40 seconds a page — and turns Delivered once the receiving machine confirms every page. Download receipt saves a PDF you can keep as your fax confirmation.
HIPAA and your own records
HIPAA's rules bind health plans, providers and their business associates — not a patient sending their own records. If you're faxing your own documents, the steps above are simply good practice.
Faxing patient records or client files every week? mFax Business is HIPAA-compliant faxing with a signed BAA on every plan, at no extra cost. PHI is stored and processed in the US, every fax ends in a confirmed-or-failed status, every teammate signs in with their own login, and the practice gets a team fax line for the replies. Build your own plan from the seats and pages you need — from about $9/mo, cancel anytime. Not sure what the agreement should cover? See what a BAA for a fax service includes.
Just need to send one document? Open the mFax app — upload the PDF and send it in under 2 minutes, free for 7 days.
7 Mistakes That Expose Sensitive Documents
Most leaks aren't hacks. They're small slips at either end of the trip:
- An old or mistyped address or number. Check every letter and digit against the recipient's own website or form.
- "Anyone with the link" sharing. It turns a private file into a public one for whoever the link reaches.
- The password in the same email. Whoever gets the email gets the file. Text the password or say it on the phone.
- Uploading to a random online converter. Many free PDF sites process your file on their servers. To sign or fill in a form, our free PDF editor works entirely in your browser — the file is never uploaded.
- A black box that isn't a redaction. A rectangle drawn over a PDF can leave the text readable underneath. Remove the page, or use a real redaction tool.
- Clicking a "secure document" link you weren't expecting. Go to the portal yourself instead.
- Leaving copies behind. The Sent folder, the Downloads folder, the shared office printer. In mFax, deleting a fax removes it for good — no copy is kept.
Phishing wears a padlock
Fake "secure message" and "shared document" notices are built to look like the real thing. If a document arrives that you didn't expect, contact the sender through a number or address you already have before you open it.
Send Your Next Document Securely
Pick the channel your recipient controls: their portal first, fax when they publish a number, an encrypted email or a protected file when they only take email. Whichever you choose, confirm the address or number, send only what was asked for, and keep proof that it arrived.
For a practice or office that sends records every week, mFax Business gives you a team fax line, HIPAA-compliant faxing with a signed BAA and a delivery receipt for every fax, on web, mobile and desktop — from about $9/mo, build your own plan.
For a single document, get mFax on the App Store, Google Play or the Microsoft Store, or open it in your browser, and send it free with the 7-day trial.