Practice email and fax under HIPAA: choosing tools

Practices search for “HIPAA compliant email” and “HIPAA compliant fax” hoping for a product they can buy and stop worrying about. HIPAA does not work that way. It applies to the practice and to the vendors that handle patient information for it, and whether email or fax use meets the rules depends on the agreement with the vendor, how the tool is set up and how your team uses it. A label on a vendor’s website does not settle any of that.

This guide explains what HHS says about email and fax, which vendors need a business associate agreement, the Security Rule safeguards to ask about, a list of questions for vendors, and how to handle patients who want plain email. We do not recommend specific products. Proving that mail from your domain is really yours, with SPF, DKIM and DMARC, is covered in our guide to email authentication for practices.

This is general information based on HHS guidance and the HIPAA rules as we read them in October 2026, not legal advice. Your own risk analysis under the Security Rule decides which safeguards are reasonable for your practice. We do not set up or resell email or fax services, and nothing here says any product meets HIPAA.

What HHS says about email with patients

HHS’s FAQ on email says the Privacy Rule allows providers to communicate with patients by email if they apply reasonable safeguards, citing 45 CFR 164.530(c). Its examples and points:

Check the address before sending, or send an alert to confirm the address first.
The Privacy Rule does not prohibit unencrypted email for treatment-related communications with patients, but other safeguards should apply, such as limiting the amount or type of information in the message.
Electronic transmission of protected health information also has to meet the Security Rule.
If a patient emails you first, you can assume email is acceptable to them unless they say otherwise. If you think they may not know the risks of unencrypted email, you can tell them and let them decide.
A patient can ask to be contacted by other means under 45 CFR 164.522(b). If unencrypted email is not acceptable to a patient who asks for confidential communications, offer a more secure electronic method, mail or phone.

So plain email is not forbidden, and encrypted email is not automatically enough. What matters is the safeguards around it and the patient’s wishes.

Fax

Fax is still common for referrals, records and prior authorizations. The same reasonable safeguards standard at 45 CFR 164.530(c) applies. In practice that means confirming the number before sending, especially the first time, using a cover sheet, keeping the receiving machine or inbox where only staff can see it, and sending only what the recipient needs. Disclosures to another provider for treatment do not need the patient’s authorization under 45 CFR 164.506, but the minimum necessary standard still applies to most other disclosures. Advertising faxes to other offices fall under separate federal rules, covered in our guide to junk fax rules for healthcare practices.

Online fax services that receive faxes into an inbox or portal store the documents, which matters for the next question.

Business associate or conduit?

A vendor that creates, receives, maintains or transmits protected health information for you is generally a business associate, and you need a business associate agreement with it. HHS draws one narrow exception:

Conduits. HHS says entities that only transport information, such as the US Postal Service, certain couriers and their electronic equivalents, are conduits and not business associates. A conduit accesses information only randomly or infrequently, as needed for transport.
Storage changes the answer. HHS’s cloud computing guidance says the conduit exception is limited to transmission-only services, with temporary storage incident to transmission. A service that stores the information is a business associate, even if it cannot view it because it does not hold the encryption key.

A hosted email account keeps messages in mailboxes. An online fax service keeps faxes in an inbox. Both store information, so treat them as business associates and get the agreement before patient information goes through them. Many vendors sign one only on certain plans or only after you turn on specific settings; read what the agreement covers. AI phone services that record calls or keep transcripts raise the same question; see our guide to HIPAA and AI receptionists.

Security Rule safeguards to ask about

The technical safeguards at 45 CFR 164.312 list what your systems should support. Some are required and some are addressable, which means you implement them if reasonable and appropriate, or document why and what you do instead. For email and fax tools, ask about:

Unique user identification (required): each staff member has their own login, no shared accounts.
Automatic logoff (addressable): sessions end after inactivity.
Encryption and decryption (addressable): stored messages and faxes are encrypted.
Audit controls: the tool records who accessed, sent or deleted what.
Transmission security, including encryption (addressable): messages are protected in transit, and you know what happens when the recipient’s system does not support encryption.

Add the administrative basics from the same rule: a risk analysis that covers email and fax, training for staff, and someone responsible for turning accounts off when people leave.

Questions to ask an email or fax vendor

Will you sign a business associate agreement, and on which plans? Get the agreement itself, not a statement on a marketing page.
What does the agreement cover? Some agreements cover only certain services or features in an account. Turn off what is not covered, or keep patient information out of it.
Which settings do we have to turn on? Encryption, retention, two-step login, audit logging. Ask for the vendor’s configuration guide.
How do patients receive encrypted messages? A link to a portal, a password, or nothing extra. Ask how it works on a phone, because that is where most patients will open it.
Where are messages and faxes stored, and for how long? And how do you export them if you leave.
What happens with breaches? The agreement should say how and when the vendor tells you about a breach of unsecured protected health information.
Do you use our data for anything else? Advertising, analytics or product training. A business associate may use and disclose information only as its agreement allows.

Habits that matter more than the tool

Keep patient details out of the subject line, which is often visible on a lock screen.
Use the patient portal for results and clinical messages when you have one, and email only to say a message is waiting.
Do not forward work email to personal accounts or use personal phones without the practice’s controls.
Do not paste patient details into marketing email tools, such as newsletter platforms, that are not covered by an agreement. Our guide to email marketing for practices covers the line between patient email and marketing email.
Record each patient’s communication preferences and any confidential communication request where every staff member will see them.

Website forms and email

A common leak is the website contact form that emails submissions to a front desk inbox. If the form collects health details, those details now sit in that inbox and pass through the form plugin and the email service. Our guides to website forms and HIPAA and online patient intake forms explain how to keep forms short or route them through a covered tool. On the sites we build in our medical website design work, forms collect only what the practice needs.

Frequently asked questions

Is Gmail or Outlook HIPAA compliant?

No product is compliant by itself. HIPAA applies to the practice and its business associates. A hosted email service stores messages, so it is a business associate and you need a business associate agreement, the right settings and safe habits before using it for patient information.

Can we email patients without encryption?

HHS says the Privacy Rule does not prohibit unencrypted email for treatment-related communications if reasonable safeguards apply, such as limiting the information. If a patient asks for confidential communications and finds unencrypted email unacceptable, offer another method.

Do we need a business associate agreement with our fax service?

If the service stores faxes, for example in an online inbox, HHS’s guidance treats it as a business associate. The conduit exception applies only to transmission-only services with temporary storage.

Is encryption required by HIPAA?

Under 45 CFR 164.312, encryption is an addressable specification. You implement it if reasonable and appropriate, or document why not and what you do instead. Most practices find encryption reasonable for email and stored faxes.

Can we fax records to another doctor without the patient’s permission?

Disclosures to another provider for the patient’s treatment do not need authorization under 45 CFR 164.506. Apply reasonable safeguards, such as confirming the fax number.

What if a patient emails us their health questions?

HHS says you can assume email is acceptable to a patient who emails you, unless they say otherwise. If they may not know the risks, tell them and let them choose.

Sources

More in Practice websites, privacy and tracking

Email and fax for a medical practice under HIPAA: how to choose tools and what to ask vendors