HIPAA Compliance

Our Commitment

FaxDash is committed to protecting the privacy and security of Protected Health Information (PHI) in compliance with the Health Insurance Portability and Accountability Act (HIPAA) and the HITECH Act. We understand that healthcare providers, insurance companies, and other covered entities rely on fax for critical communications, and we take that responsibility seriously.

Business Associate Agreement (BAA)

FaxDash will execute a Business Associate Agreement (BAA) with any covered entity or business associate that uses our service to transmit, receive, or store PHI. Our BAA outlines our obligations to protect PHI in accordance with HIPAA requirements.

To request a BAA, contact us at hipaa@faxdash.io.

Technical Safeguards

• Encryption at Rest — All documents and data are encrypted using AES-256 encryption via AWS server-side encryption (S3 and DynamoDB).
• Encryption in Transit — All data transmission uses TLS 1.2 or higher. No unencrypted connections are accepted.
• Access Controls — Unique user authentication via JWT tokens and API keys. No shared accounts or anonymous access.
• Audit Trail — Immutable audit logging of all document access, views, downloads, and modifications with timestamps and user identification.
• Automatic Logout — Sessions expire after inactivity to prevent unauthorized access.

Administrative Safeguards

• Workforce Training — All employees with access to systems handling PHI receive HIPAA awareness training.
• Risk Assessment — Regular risk assessments are conducted to identify and mitigate potential threats to PHI.
• Incident Response — Documented breach notification procedures in compliance with the HIPAA Breach Notification Rule.
• Minimum Necessary — Access to PHI is limited to the minimum necessary to provide fax services.

Physical Safeguards

• AWS Infrastructure — All data is stored in AWS data centers that maintain SOC 1/2/3, ISO 27001, and HIPAA compliance certifications. AWS has executed a BAA with FaxDash.
• No Local Storage — PHI is not stored on local workstations or mobile devices beyond temporary processing. All persistent data resides in encrypted cloud storage.

Document Vault

FaxDash provides a secure document vault with configurable retention policies for storing sent and received faxes. The vault includes:

• Immutable audit trail for all document access
• Configurable retention policies (30 days to 7 years)
• Soft delete with recovery period
• Automatic purging after retention period expires

Fax Transmission Security

• Telnyx — Fax transmissions are carried by Telnyx, a licensed telecommunications provider.
• Carrier handling — Sending a fax gives Telnyx a time-limited link to the document, which Telnyx retrieves in order to transmit it. A received fax is held by Telnyx until FaxDash downloads it; Telnyx does not publish how long it is retained after that.
• Delivery Confirmation — Transmission reports confirm successful delivery with timestamps and page counts.

AI Assistants and Connectors

FaxDash can be connected to an AI assistant (ChatGPT, Claude, or another MCP client) so it can send faxes and, if you grant that permission, read the faxes you receive.

• Connecting an assistant sends content to its provider. When you connect an assistant and approve its permissions, FaxDash discloses the content that assistant handles — documents it passes to us, and received faxes if you grant that permission — to the company running it, at your direction. That company processes it under its own terms, and FaxDash’s BAA does not extend to them.
• If HIPAA applies to you, get a BAA with that provider first. This applies to sending as much as to reading. A document the assistant hands us, or uploads on your behalf, passes through it outright, and a link it gives us is itself access to the document, which its provider may log or follow. Only a document you uploaded yourself and referred to by id stays out of the assistant — and even then, what you type to the assistant about it may carry PHI. Consumer and Team plans of ChatGPT and Claude are not covered by a BAA. Anthropic offers one for its first-party API and for sales-assisted Claude Enterprise plans; OpenAI offers one for its API and other HIPAA-eligible products on request. Confirm with your provider which of its surfaces your agreement covers before putting any PHI through a connector.
• Reading is a separate permission. An assistant can be allowed to send faxes without being able to read the ones you receive, which narrows what it sees. Each permission is approved individually on the consent screen, and every connection is recorded.
• You can revoke at any time. Settings › Security › Connected assistants lists every assistant with access and revokes it. It stops renewing its access; what it already holds lapses on its own within five minutes, its current token and any document link it was given alike.
• No connector, no exposure. If you never connect an assistant, none of this applies: no fax content reaches any AI provider through this route.

Data Retention

• Sent fax documents are retained for up to 3 years
• Received fax documents are retained for up to 3 years
• Temporary processing data (scanned images) is automatically deleted after 90 days
• Audit logs are retained indefinitely
• Customers can request early deletion of their data at any time

Breach Notification

In the event of a breach of unsecured PHI, FaxDash will notify the affected covered entity without unreasonable delay and no later than 30 calendar days after discovery, in accordance with 45 CFR § 164.410. The notification will include:

• A description of the breach and the types of PHI involved
• Steps the covered entity should take to mitigate harm
• A description of what FaxDash is doing to investigate and prevent future breaches
• Contact information for further inquiries

Subprocessors

• Amazon Web Services (AWS) — Cloud infrastructure, storage, and compute. BAA in place.
• Telnyx — Fax transmission and phone number provisioning.
• OpenAI — AI analysis of received faxes: the summary and category shown in your inbox. FaxDash does not have a BAA with OpenAI for this service, so analysis is not available for accounts covered by a FaxDash BAA: it is always off for them, it cannot be switched on, and no fax content from those accounts is sent to the provider. Any other account can turn it off in your account settings on the web dashboard, and with it off no fax content is sent to the provider at all. This role was previously filled by Google's Gemini API; the provider may change again, and this list is kept current with the one actually in use.

Contact

For questions about our HIPAA compliance program, to request a BAA, or to report a security concern:

• Email: hipaa@faxdash.io
• Web: faxdash.io