Business Associate Agreements for Fax in 2026: What to Require

BAA Basics for Healthcare

Under HIPAA, any vendor that creates, receives, maintains, or transmits Protected Health Information (PHI) on your behalf is a Business Associate. This includes fax service providers, whether they operate cloud platforms, on-premises servers, or hybrid solutions.

A Business Associate Agreement (BAA) is a legally binding contract that establishes what the vendor can and cannot do with PHI, their security obligations, and what happens if a breach occurs. Without a signed BAA, your organization is directly liable for any HIPAA violations by that vendor.

When is a BAA Required?

For fax services specifically, a BAA is required when the service provider:

• Stores fax content: Cloud fax platforms that maintain copies of sent or received faxes
• Processes fax data: Services that convert, route, or index fax content
• Has access to transmissions: Even if they do not actively review content
• Provides delivery confirmation: Systems that track and log transmission details

The key question is whether the vendor could access PHI during normal operations. If the answer is yes, or even maybe, you need a BAA.

Essential BAA Clauses

A compliant BAA must include specific provisions required by HIPAA. When reviewing a fax vendor's BAA, ensure these elements are present:

Permitted Uses and Disclosures

The BAA must clearly specify what the vendor can do with PHI. For fax services, this typically includes transmission, temporary storage for delivery, and providing audit logs. Any use beyond these purposes should require your explicit authorization.

Safeguard Requirements

The vendor must agree to implement appropriate administrative, physical, and technical safeguards. For fax services, this includes:

• Encryption of fax content in transit and at rest
• Access controls limiting who can view fax content
• Full audit logging of all access and actions
• Secure disposal procedures when retention periods expire

Breach Notification

The BAA must specify the vendor's obligations if a breach occurs. Key provisions include:

• Timeframe for notifying you of a breach (HIPAA requires "without unreasonable delay")
• Information that must be provided in the notification
• Cooperation requirements during breach investigation
• Who bears responsibility for notification costs

Termination Terms

The BAA should address what happens to PHI when the relationship ends:

• Return or destruction of PHI upon termination
• Certification of destruction if applicable
• Ongoing confidentiality obligations after termination

Red Flags in Vendor Agreements

Not all BAAs are created equal. Watch for these warning signs that may indicate a vendor does not take HIPAA compliance seriously:

If a vendor resists modifying problematic clauses, consider it a serious warning sign. HIPAA-compliant vendors should be willing to negotiate reasonable terms.

International and Cross-Border Considerations

Healthcare organizations increasingly operate across borders, and fax services are no exception. When your fax vendor stores or processes data abroad, additional compliance considerations come into play.

Data Residency Requirements

Some healthcare regulations and organizational policies require PHI to remain within specific geographic boundaries:

• US-only storage: Many covered entities require that PHI never leave US soil
• State-specific rules: Some states have additional data residency requirements
• Government contracts: Federal healthcare contracts often mandate US data centers

International Data Transfers

If you fax to recipients abroad, or if your vendor operates internationally, consider:

• GDPR compliance: Faxing to European recipients may trigger GDPR obligations
• Cross-border PHI transfer: HIPAA still applies to PHI sent internationally
• Local privacy laws: Recipient countries may have their own requirements
• Data localization laws: Some countries require local data storage for healthcare data

Your BAA should address how the vendor handles international transmissions and what safeguards are in place for cross-border data flows.

Multi-National Healthcare Organizations

If your organization operates internationally, your fax vendor relationship becomes more complex:

• Ensure the vendor can meet compliance requirements in all jurisdictions
• Verify that data segregation is possible if required by local law
• Confirm audit log access meets each jurisdiction's requirements
• Review liability allocation across different legal systems

Negotiation Tips

While many vendors offer standard BAAs, you often have room to negotiate terms that better protect your organization:

Know Your Leverage

Larger organizations or those with multi-year contract potential have more negotiating power. Even smaller organizations can often negotiate by being willing to switch vendors.

Focus on Critical Terms

Prioritize negotiations on the most important clauses:

• Breach notification timelines (push for 24-48 hours)
• Liability caps (should be meaningful, not token amounts)
• Audit rights (you should be able to verify compliance)
• Data retention and disposal (clear timelines and procedures)

Document Everything

Keep records of all BAA negotiations, including rejected proposals. This documentation can demonstrate due diligence if compliance questions arise later.

Managing Your BAAs

A signed BAA is just the beginning. Ongoing management is essential for continued compliance:

BAA Inventory

Maintain a centralized inventory of all BAAs, including:

• Vendor name and primary contact
• Date signed and expiration date (if applicable)
• Types of PHI the vendor accesses
• Key terms and any negotiated modifications
• Renewal and review schedule

Regular Reviews

Review each BAA periodically, especially when:

• The vendor changes their services or terms
• HIPAA regulations are updated
• Your organization's use of the service changes
• Contract renewal approaches

Vendor Compliance Verification

Periodically verify that vendors are meeting their BAA obligations:

• Request current security certifications and compliance documentation
• Review audit logs for unusual access patterns
• Confirm that security practices match BAA commitments
• Document your verification activities

Conclusion

Business Associate Agreements are not just legal paperwork. They are essential safeguards for your organization and your patients. When evaluating fax vendors:

• Never use a fax service without a signed BAA
• Review BAA terms carefully, especially breach notification and liability
• Verify data residency meets your requirements, especially for international operations
• Ensure the vendor provides thorough audit logs for compliance documentation
• Maintain ongoing oversight of vendor compliance

Ready to work with a fax vendor that takes compliance seriously? Get started with Avofax and get a BAA that protects your organization with complete audit logging included.