How does HIPAA compliance work on FaxTerra?
Practices, therapists, billing services and any other organization that handles protected health information add HIPAA compliance to any paid plan. It brings a signed Business Associate Agreement and the controls to match. Here is exactly what it includes, what it costs, and how to add it.
What the HIPAA add-on is, and who it is for
HIPAA compliance costs $4.99 a month, or $49.99 a year on an annual plan. It is an add-on to any paid plan for organizations that fax protected health information (PHI): medical and dental practices, therapists and behavioral-health providers, medical billing services, home-health agencies, and anyone else whose faxes carry patient data. It is not a separate plan. Your pages, your number, and your billing stay exactly as they are; the add-on changes what protects them.
If you are a patient faxing your own records, you do not need it. HIPAA obligations fall on covered entities and their business associates, not on individuals sending their own information.
What it costs on each plan
Pick the plan whose page allowance fits, then add HIPAA compliance. The monthly totals:
- Starter + HIPAA: $9.98 a month, 50 pages a month.
- Business + HIPAA: $14.98 a month, 200 pages a month.
- Pro + HIPAA: $34.98 a month, 1,000 pages a month.
Annual billing is available on every plan, picked on the same card as the plan. The add-on then bills at $49.99 a year alongside an annual plan. Every plan includes your own dedicated fax number for receiving as well as sending, and as many people on the account as you like.
What the add-on includes
The same controls on every plan:
- A signed Business Associate Agreement (BAA) with FaxTerra, executed before you send any PHI.
- Per-document encryption at rest. Each stored document has its own AES-256 key on top of encrypted storage and an encrypted connection in transit.
- A six-year audit log. Every view and download of a document is recorded and kept for six years, and you can ask support for a copy of it for your own compliance reviews.
- PHI-free email and mobile push notifications. Arrival and delivery notices carry no names, fax numbers, or document details; you sign in to see the fax.
- Faxes stay in your inbox, and you send from the web or the app. PDF attachments on arrival emails, fax forwarding and sending faxes by email are not available, because an email travels outside the protections your BAA covers. Adding the add-on turns all three off.
- One-year inbox retention by default, and control over how long sent documents are kept.
- A BAA everywhere PHI is stored or processed. Our storage, database, hosting, and error-monitoring vendors each operate under their own BAA with FaxTerra.
How to add it
New to FaxTerra? Start on the HIPAA page and choose a plan. You sign the BAA before checkout, giving your organization, the name and title of the person authorized to sign, and your acceptance of the BAA and HIPAA service terms. The signed copy is emailed to you the moment it is executed and stays on your HIPAA compliance page. The add-on is in the same checkout as the plan.
Already subscribed on the web? Open HIPAA compliance in your account. You sign the BAA if one is not on file yet, then confirm the add-on. The confirmation states the exact amount for the rest of your current billing period, whether it is charged today or added to your next invoice, and what your subscription becomes from then on. On a team account, adding it is something admins and the owner do.
Bought your plan in the iPhone or Android app? Add it on the app's Billing screen at $4.99 a month or $49.99 a year, the same as on the website. You can sign the Business Associate Agreement in the app or on the web; either one counts on your account. Where the add-on is bought follows who bills your plan, which billing and who bills you sets out in full.
Plans without the add-on
Without HIPAA compliance, no plan includes a Business Associate Agreement. Add it before the first fax that carries patient data. From then on, documents on the account are encrypted with per-document keys, including documents already stored.
What "HIPAA compliant" really means
HIPAA has no certificate and no certifying body, so no fax service can truthfully call itself "HIPAA-certified." Compliance is a chain of security controls plus signed agreements. What FaxTerra does is provide the controls above and sign a BAA covering the storage and processing of your PHI. The telephone-network leg of a fax is carried by telecom conduits under HIPAA's conduit exception (78 FR 5571), the same basis on which every fax, phone call, and letter operates.
Removing it, and getting a copy of your BAA
If you added it on the web, remove it yourself from Plans & Billing. Removing it credits the unused remainder of the period on your next invoice. On the web the add-on is a line on your plan's subscription, so cancelling the plan ends it too. The cancel confirmation says so.
If you added it in the app, cancel it in the App Store or Google Play, where you cancel any subscription. There it is a separate subscription from your plan, and cancelling either one leaves the other running. Cancel both if you are leaving. Billing and who bills you has the steps for each store.
Either way your executed BAA stays available to download from HIPAA compliance in your account for as long as the account exists, and documents encrypted while the add-on was on stay readable. Once it is off, arrival and delivery notices go back to naming the number and the sender, and PDF attachments, fax forwarding and sending by email can be turned on again; they were turned off when the add-on was added and stay off until someone turns them on.
Frequently asked questions
Is FaxTerra HIPAA compliant?
Yes, with the HIPAA compliance add-on. It provides the controls HIPAA requires for faxing protected health information: a signed BAA, encryption in transit and at rest, an audit log, and PHI-free notifications. There is no such thing as a HIPAA certification, so we describe the controls rather than claim a badge.
Do you sign a Business Associate Agreement (BAA)?
Yes. Every account with HIPAA compliance executes a BAA with FaxTerra electronically before the add-on activates, and you can download your executed copy from your account at any time. Without the add-on, no plan includes a BAA.
How much does HIPAA compliance cost?
$4.99 a month on top of any paid plan, or $49.99 a year with an annual plan. It is the same price in the iPhone and Android apps. The plan sets your page allowance; the add-on sets the protections.
Is my PHI encrypted?
Yes. With the add-on, each stored document is encrypted with its own AES-256 key on top of encrypted storage. It travels over an encrypted connection. A document is decrypted when you view or download it, and when you send it again.
Can I cancel HIPAA compliance anytime?
Yes. If you added it on the web, remove it from Plans & Billing or cancel the whole plan; either is self-serve online. If you added it in the app, cancel it in the App Store or Google Play. It is a separate subscription from your plan there, so cancel both if you are leaving. Your executed BAA remains downloadable from HIPAA compliance in your account for as long as the account exists.