Is it legal to fax patient information under HIPAA?

Yes. HHS says providers may share patient information for treatment by fax with reasonable safeguards, such as confirming a fax number you don't use often and pre-programming the numbers you send to regularly.

Is CMS banning fax in healthcare?

Not across the board. CMS-0057-F requires many payers to offer an electronic prior-authorization API by January 1, 2027. CMS-0053-F sets electronic standards for claims attachments, with compliance due May 26, 2028, as reported in the trade press. Both target payer paperwork. Neither stops one practice faxing a referral to another.

How much do US hospitals still fax?

In 2025, 40% of US hospitals said they often sent summary-of-care records by mail or fax, and 35% often received them that way (ONC, AHA IT Supplement data).

Is Free Fax Desk HIPAA compliant?

We don't make that claim for any software, and nobody else should either. Free Fax Desk keeps faxes on your own PC and sends nothing to us. The business associate agreement is between your office and your fax carrier.

Fax in Healthcare: What Gets Faxed, Why, What Breaks

What a practice actually faxes

In a 2019 MGMA poll, 89% of US medical practices said they used a fax machine. The top uses were sharing records, referrals, labs and results, payer communication, and pharmacies (MGMA, 2019). Add orders to home health and physical therapy, and signed forms coming back. On a normal day most of what comes off the fax line is one of those.

Hospitals are in the same position. In 2025, 40% of US hospitals often sent summary-of-care records by mail or fax, and 34% sometimes did. That figure had dropped to 30% in 2023 and went back up (ONC, from the AHA IT Supplement, 2025). Across the whole industry the volume is widely reported as about 9 billion (2019) pages a year. Nobody we could find has actually measured it.

Why it stays

The law allows it. HIPAA does not ban fax. The HHS guidance says providers may share patient information for treatment by fax with reasonable safeguards. Its own examples are to confirm a fax number with the recipient when it isn't one you use regularly, and to pre-program the numbers you send to often (HHS, HIPAA FAQ).

Everyone has a fax number, and EHRs don't all talk to each other. A referral from a family practice on one EHR to a specialist on another often has no electronic path between them. In interviews with primary care doctors and specialists at two Midwest health systems, a referring doctor put it this way: "For external referrals, I don't have any software that I'm using. It's a script pad that I'm faxing" (Savoy et al., 2023). The federal health IT office (ONC) does not even count eFax as electronic exchange in its hospital surveys (ONC Data Brief 71, 2024).

Payers still take it. In 2024, 22% of medical prior authorizations were fully manual: phone, mail, fax or email. 43% went through payer portals and 35% were fully electronic (CAQH, 2024). A manual request took 24 minutes of staff time against 16 through a portal (CAQH, 2024).

What is changing, and what isn't

Two federal rules aim at the payer side.

Prior authorization (CMS-0057-F). Since January 2026, Medicare Advantage, Medicaid, CHIP and federal-exchange plans have to decide standard requests within 7 calendar days and urgent ones within 72 hours. By January 1, 2027 they must offer an electronic prior-authorization API. Drugs are excluded. The rule still lets them send a denial reason by portal, fax, email, mail or phone (CMS, 2024).
Claims attachments (CMS-0053-F). Finalized March 20, 2026. It sets electronic standards for the clinical documents sent to support a claim, and CMS projects $781.98 million a year in savings. The press release opens with "Say goodbye to fax machines" (CMS, 2026). Compliance is due May 26, 2028, as reported in the trade press.

Both rules cut fax between practices and insurers, eventually. Neither one touches the referral to the specialist down the road, the records request from a lawyer's office, or the pharmacy asking about a refill. Most of a front desk's fax traffic will still be there in 2028.

What goes wrong

The wrong number. One wrong digit, or a number that has gone stale, and patient information lands somewhere it shouldn't. St. Luke's-Roosevelt Hospital Center in New York paid $387,200 and accepted a three-year corrective plan after staff faxed a patient's HIV status and mental-health information to the patient's employer. The same clinic had misfaxed another patient's records nine months before (HHS OCR, 2017, as reported by HIPAA Journal).

The fax nobody owns. A referral arrives, gets printed, and sits in a tray. The paper above cites earlier studies finding that 30% to 50% of outpatient specialty referrals are never completed (Savoy et al., 2023). Fax is not the only reason, but a page with no owner is an easy one to lose.

"We never got it." The other office says it never arrived. You remember sending it. Without a delivery record, it's your word against theirs, and the patient waits while you send it again.

The 100-page fax. Specialists in the same study described referrals arriving with "100 pages of records". The one line they needed was somewhere inside (Savoy et al., 2023).

What matters in Free Fax Desk for a practice

Named numbers and a confirmed send. The address book remembers who you fax, and FaxDesk asks you to confirm the full number before a send. That is the pre-programmed-numbers and confirm-new-numbers advice from HHS, built into the page (how sending works).
An owner for every fax. Every incoming fax is assigned to a person or a team and stays on their list until someone marks it done. A referral can't sit in a tray (how it works).
Proof it arrived. FaxDesk watches each sent fax until the other machine takes it, and Refax with proof re-sends it with a first page stating when it originally went (delivery watch, refax with proof).

Faxes stay on your own PC. We don't claim to make anyone HIPAA compliant. Your business associate agreement is between your office and your fax carrier, and your safeguards are yours. FaxDesk makes the careful way of doing it the easy way.

For the bigger picture beyond healthcare, see Is fax still used? The numbers, checked at the source.

Questions

Is it legal to fax patient information under HIPAA?: Yes. HHS says providers may share patient information for treatment by fax with reasonable safeguards, such as confirming a fax number you don't use often and pre-programming the numbers you send to regularly.
Is CMS banning fax in healthcare?: Not across the board. CMS-0057-F requires many payers to offer an electronic prior-authorization API by January 1, 2027. CMS-0053-F sets electronic standards for claims attachments, with compliance due May 26, 2028, as reported in the trade press. Both target payer paperwork. Neither stops one practice faxing a referral to another.
How much do US hospitals still fax?: In 2025, 40% of US hospitals said they often sent summary-of-care records by mail or fax, and 35% often received them that way (ONC, AHA IT Supplement data).
Is Free Fax Desk HIPAA compliant?: We don't make that claim for any software, and nobody else should either. Free Fax Desk keeps faxes on your own PC and sends nothing to us. The business associate agreement is between your office and your fax carrier.

Sources

MGMA Stat poll, "Time warp: the lingering legacy of fax in medical practices", 5 November 2019 (n=1,581). https://www.mgma.com/mgma-stats/time-warp-the-lingering-legacy-of-fax-in-medical-practices
ONC Health IT Quickstats, Methods used by hospitals to engage in interoperable exchange (AHA IT Supplement, 2018-2025). https://healthit.gov/data/quickstats/methods-used-hospitals-engage-interoperable-exchange/
ONC Data Brief No. 71, Interoperable Exchange of Patient Health Information Among U.S. Hospitals: 2023, May 2024. https://www.ahadata.com/system/files/media/file/2024/06/ONC-Brief-Interoperable-Exchange-of-Patient-Health-Information-Among-US-Hospitals-2023.pdf
HHS, HIPAA FAQ: sharing patient information for treatment by fax, e-mail or phone. https://www.hhs.gov/hipaa/for-professionals/faq/does-hipaa-permit-a-doctor-to-share-patient-information-for-treatment-over-the-phone/index.html
Savoy A et al., Consultants' and referrers' perceived barriers to closing the cross-institutional referral loop, Int J Med Inform, 2023. https://pmc.ncbi.nlm.nih.gov/articles/PMC10863292/
CAQH, 2024 CAQH Index report (prior authorization, pp. 17-19). https://www.caqh.org/hubfs/Index/2024%20Index%20Report/CAQH_IndexReport_2024_FINAL.pdf
CMS fact sheet, Interoperability and Prior Authorization Final Rule (CMS-0057-F), 17 January 2024. https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-prior-authorization-final-rule-cms-0057-f
CMS press release, Claims Attachments and Electronic Signatures Final Rule (CMS-0053-F), 20 March 2026. https://www.cms.gov/files/document/nsg-attachments-final-rule-press-release.pdf-0
HIPAA Journal, CMS final rule on health care claims attachments (effective and compliance dates). https://www.hipaajournal.com/cms-hipaa-final-rule-health-care-claims-attachments/
HIPAA Journal, St. Luke's-Roosevelt $387,200 settlement for disclosure of HIV status to employer, 2017. https://www.hipaajournal.com/impermissible-disclosure-of-hiv-status-employer-387000-hipaa-penalty-8818/

If you're on a Phone.com fax line, Free Fax Desk is free: a fax inbox on your own PC, where every fax has an owner. Not affiliated with Phone.com.

Fax in healthcare: what gets faxed, why it stays, and what goes wrong