Fax has an odd reputation in security terms. It is treated as trustworthy because it is old, and as unsafe because it is old, and both instincts get in the way of the actual question: which risks does moving to a cloud service remove, which does it introduce, and which does it leave exactly where they were.
This page answers those three, and then says precisely what a fax service can and cannot do for a compliance obligation, because that boundary is where the real exposure sits.
What the risks actually are
The misdirected fax
A wrong digit sends a document to a stranger, and there is no recall. This is the most common fax incident by a wide margin, it is a human error rather than a technical one, and no service prevents it. What a cloud service changes is that you can tell afterwards exactly what went where, which is the difference between an incident you can assess and one you can only guess at.
The document sitting in a tray
A physical fax machine in a shared corridor is an unattended pile of other people's information. Removing the machine removes this risk outright, and it is the clearest security win in the whole migration.
The machine's own memory
Fax machines store what they send and receive, often on a drive, and are then disposed of like printers. Worth handling deliberately at retirement.
The transmission itself
A traditional fax over an analog line is not encrypted. Its practical protection was that intercepting it required physical access to a line. That has been a weak assumption for a long time.
What cloud fax introduces
Two things, and it is more honest to name them than to claim there is no trade.
A third party now holds your documents. That is what makes contractual terms and access controls load-bearing rather than paperwork.
Faxes become an archive. Every fax is now a stored, searchable document. That is useful, and it is also a growing body of sensitive material subject to whatever retention rules apply to it. Storage without a retention policy is an exposure that accumulates quietly.
What LABUSA eFaaS provides
Stated as capabilities, because that is what they are:
- Encryption in transit and at rest while the service holds the document.
- Access controls governing who can send from which number and who can see what.
- Audit logs recording fax activity, so who sent what, when, and with what result is answerable after the fact.
- Transmission records (timestamp, destination, page count, outcome) retained as evidence rather than as a printout.
- Secure cloud storage of sent and received documents.
The full list is on the features page.
One limit worth being explicit about
Encryption protects the document while the service holds it and while it moves between you and the service. It does not extend past the destination fax number. A fax delivered to a counterparty's machine prints, or lands in whatever system they run, under their controls and not yours.
That is not a shortcoming of any particular provider. It is what fax is. Any description of fax security that implies protection all the way to the recipient's hands is overstating it, and the practical consequence is that the misdirected fax above stays the risk to design around.
Compliance, stated precisely
This is the part that matters most and is most often blurred.
A service provides safeguards. An organization is compliant, or is not. No fax product can make a covered entity HIPAA compliant, because compliance depends on what your staff send, to whom, under what authorization and for how long you keep it, none of which a supplier controls or can see.
What a supplier can do is provide the technical safeguards you build on, and enter the agreements that make the arrangement accountable. What it cannot do is transfer your obligation.
HIPAA
Faxing is not prohibited under HIPAA. The Security Rule, at 45 CFR Part 164, Subpart C, sets administrative, physical and technical safeguards for electronic protected health information, and the covered entity remains responsible for meeting them. Where a provider creates, receives, maintains or transmits PHI on your behalf, a Business Associate Agreement is the instrument that makes the relationship accountable, the required provisions are set out at 45 CFR 164.504(e).
If you handle PHI, ask whether your provider will sign one. It is a yes or no question and it should be answered before anything else.
GDPR
The General Data Protection Regulation governs personal data of people in the EU whatever channel it travels on, so a fax is not outside it. Two practical consequences for a fax service: where the data is stored and processed matters, and the provider is normally a processor acting on your instructions, which has to be written down.
PCI DSS
Cardholder data faxed on an order form is in scope. The PCI Data Security Standard, maintained by the PCI Security Standards Council, applies to how that data is handled, stored and transmitted. The most useful question here is usually not how to secure the fax but whether the card number needs to be on it at all.
Financial services
If you handle consumer financial information, the FTC Safeguards Rule at 16 CFR Part 314 requires a written information security program covering the systems that hold it, which now includes a fax archive. The FTC publishes guidance on the Gramm-Leach-Bliley Act for how this applies in practice.
How to read a compliance claim
When any supplier (including this one) lists standards in its marketing, the useful response is four questions: what exactly is certified, by whom, against which version, and when was it last assessed? A logo is not an answer, and neither is a regime name in a feature list. A supplier that will answer those four in writing is telling you something; one that will not has told you something too.
What to do about it
Decide retention before you decide storage. The policy question comes first; storage is trivially easy to extend and awkward to plan backwards.
Route to roles, not people. A fax destination tied to an individual becomes an access problem the moment they leave.
Decide who reads the transmission reports. A failure nobody sees is the expensive failure mode.
Confirm offboarding. How fast access is revoked, and what happens to that person's stored faxes.
Ask whether it needs to be faxed at all. The most effective control on a channel is not using it for data that does not need to travel that way.
Where to go next
What to Look For in Electronic Fax turns this into questions to put to a provider. Migrating from Fax Machines to Cloud Fax covers retiring the hardware safely, and Guide to Electronic Fax is the broader picture.
If you want our four answers in writing, ask us, including whether we will sign a Business Associate Agreement for your situation.
Sources
- 45 CFR Part 164, Subpart C: HIPAA Security Rule, Electronic Code of Federal Regulations.
- 45 CFR 164.504: business associate contract requirements.
- Regulation (EU) 2016/679 (GDPR), official text.
- PCI Data Security Standard, PCI Security Standards Council.
- 16 CFR Part 314: FTC Safeguards Rule.
- Gramm-Leach-Bliley Act guidance, U.S. Federal Trade Commission.