Short answer: Fax.Plus can be HIPAA-compliant, but only if you are on its Enterprise plan and have a signed Business Associate Agreement (BAA) in place — the free, Basic, Premium, and Business tiers do not include a BAA, and without one, sending protected health information (PHI) through the service is not compliant use, regardless of how secure the transmission itself is.
This page exists to answer that one question directly, for anyone evaluating Fax.Plus as a fax option for a clinical trial site, research office, or any operation that routinely handles PHI — consent forms, patient records, lab referrals, IRB correspondence with identifiable data attached. If you want the full mechanics of what makes any fax service HIPAA-compliant, see our companion guide, HIPAA-Compliant Fax Service: What Actually Makes One Compliant. If you’re evaluating Fax.Plus more broadly — pricing, reviews, whether it’s worth it — see our full Fax.Plus review.
Is Fax.Plus HIPAA compliant?
As confirmed on Fax.Plus’s own compliance documentation (checked August 2026), HIPAA compliance is explicitly scoped to the Enterprise plan: Fax.Plus signs BAAs with Enterprise customers, and what it calls Advanced Security Controls (ASC) is enabled alongside the BAA to support HIPAA compliance. In plain terms:
- Free, Basic, Premium, and Business plans — no BAA, not positioned by the vendor as HIPAA-compliant tiers.
- Enterprise plan (list price starts around $79.99/month as of August 2026, billed for 4,000 pages/month with unlimited team members) — the plan where a BAA is available and Advanced Security Controls can be enabled.
This matters because HIPAA compliance is not a property a vendor can grant you just by using its product — it’s a legal relationship. Under HIPAA, any vendor that creates, receives, maintains, or transmits PHI on your behalf is a “business associate,” and a covered entity or another business associate is required to have a signed BAA with that vendor before PHI moves through their system. Encryption and access controls are necessary but not sufficient on their own; without the BAA, using Fax.Plus (or any vendor) for PHI is a HIPAA problem irrespective of how the data is technically protected in transit.
Practically, that means the entry price for HIPAA-compliant use of Fax.Plus is the Enterprise tier, not the advertised Basic or Premium rate most searches surface first — a detail that changes the buying decision for a lot of research offices sizing this up on cost.
See Fax.Plus Enterprise pricing →
How to actually get HIPAA compliance on Fax.Plus
If Fax.Plus is otherwise a fit, getting to compliant use requires three concrete steps, not just picking a plan:
- Subscribe to the Enterprise plan. This is the gate — HIPAA features are not available to activate on any lower tier.
- Request and sign the BAA. Per Fax.Plus’s documentation, this is arranged as part of Enterprise account setup, not automatically issued. Confirm the BAA is fully executed before routing any PHI through the account.
- Enable Advanced Security Controls (ASC). Fax.Plus ties HIPAA-relevant configuration to this setting explicitly — it is not the default state of a standard account, even on Enterprise.
Confirm current terms directly with Fax.Plus before purchasing, since plan pricing and what’s bundled into each tier can change; this page reflects what was published as of August 2026.
Is Fax.Plus safe to use?
Safety and HIPAA compliance are related but not identical questions — a tool can be reasonably secure without being HIPAA-compliant for your specific use case, and that’s effectively the situation on Fax.Plus’s non-Enterprise tiers. On the general security question, Fax.Plus (run by Alohi SA, a Swiss company) publishes several standard indicators of a legitimate, security-conscious vendor: AES-256 encryption at rest, TLS in transit, and compliance badges for ISO 27001 and SOC 2 alongside its HIPAA and GDPR/CCPA claims. Those are the technical and organizational controls you’d want to see from any vendor handling sensitive documents, fax or otherwise.
Where it’s worth being precise: those certifications describe the vendor’s security posture in general, not a guarantee that your specific use of a lower-tier plan is HIPAA-compliant. A Basic or Premium account can be “safe” in the ordinary security sense — encrypted transmission, a legitimate company behind it — while still being the wrong choice for PHI specifically, because the BAA and ASC layer that HIPAA actually requires isn’t present. For a deeper look at real-world user sentiment (reviews, complaint patterns, support responsiveness), see the full Fax.Plus review.
Who Fax.Plus’s HIPAA tier is not right for
Be honest with yourself about volume and budget before committing to Enterprise pricing for HIPAA coverage alone:
- Low-volume PHI faxing. If your office sends only an occasional PHI-bearing fax, paying roughly $80+/month for Enterprise-tier access may not be the most cost-efficient route to compliance — some competitors in the HIPAA-compliant fax space price their compliant tiers lower, particularly at low monthly page volumes. See the provider comparison in our HIPAA-compliant fax service guide before committing.
- Budget-constrained clinics or small research offices. If Enterprise pricing is a genuine barrier, it’s worth shopping the BAA-inclusive tier pricing of alternatives directly against Fax.Plus’s Enterprise plan rather than assuming Fax.Plus is the cheapest compliant option by default — it may not be, depending on your volume.
- Anyone who has already signed up for Basic/Premium/Business expecting HIPAA coverage. That coverage is not there on those tiers; an upgrade to Enterprise plus a signed BAA is required, not a settings change.
Where Fax.Plus’s HIPAA tier is a reasonable fit: a research office or clinical site with moderate-to-high fax volume, an existing need for multiple team members and fax numbers, and a preference for a modern web/mobile/email-based fax workflow over legacy fax hardware or an older online-fax incumbent.
Frequently asked questions
Is Fax.Plus HIPAA compliant?
Only on its Enterprise plan, and only once you’ve signed a Business Associate Agreement with Fax.Plus and enabled Advanced Security Controls. Lower tiers (Free, Basic, Premium, Business) are not positioned by the vendor as HIPAA-compliant and do not include a BAA.
Does Fax.Plus sign a BAA?
Yes, but only for Enterprise-tier customers. It is arranged as part of Enterprise account setup rather than issued automatically on signup, and it is issued alongside Advanced Security Controls.
Is Fax.Plus safe to use?
In the general security sense, yes — it publishes AES-256 encryption at rest, TLS in transit, and ISO 27001 and SOC 2 compliance badges. That’s a legitimate, security-conscious posture. It is a separate question from HIPAA compliance specifically, which requires the Enterprise plan and a signed BAA regardless of how secure the underlying transmission is.
Can I use the free or Basic Fax.Plus plan for PHI?
No. Without a signed BAA — which Fax.Plus only offers on Enterprise — sending PHI through any lower tier is not HIPAA-compliant use, even though the transmission itself is encrypted.
What does Fax.Plus’s HIPAA-compliant Enterprise plan cost?
As of August 2026, Fax.Plus lists Enterprise pricing starting around $79.99/month (4,000 pages/month, unlimited team members). Confirm current pricing directly with Fax.Plus, as tiers and included volume can change.
Try Fax.Plus and check current Enterprise/HIPAA terms →
For the broader mechanics of HIPAA-compliant faxing — including how Fax.Plus compares to SRFax, iFax, and FAXAGE on this specific requirement — see HIPAA-Compliant Fax Service: What Actually Makes One Compliant. For pricing, reviews, and an overall verdict on Fax.Plus, see the Fax.Plus review.
