What Is a BAA and Why Does Your Fax Service Need One?

If you work in healthcare and you use an eFax service, you have probably heard the term BAA thrown around. Maybe you have been told you need one. Maybe you are not entirely sure what it means or why it matters. Here is the complete explanation — what a BAA is, what it requires, and why operating without one is a HIPAA liability your practice cannot afford.

A Business Associate Agreement is a contract required by HIPAA between a covered entity — your medical practice, hospital, clinic, or healthcare organization — and a Business Associate, which is any vendor or service provider that handles Protected Health Information or PHI on your behalf. Under HIPAA, if you share patient information with a third-party vendor — including by sending or receiving faxes containing patient records — that vendor becomes a Business Associate and a BAA is legally required.

Any healthcare organization that uses an eFax service to send or receive faxes containing PHI needs a signed BAA from that eFax provider. This includes medical practices and physician offices, dental offices, mental health practices, physical therapy and rehabilitation centers, hospitals and health systems, medical billing companies, and healthcare attorneys handling patient records.

A compliant BAA obligates your eFax provider to use PHI only for the purposes outlined in the agreement, implement appropriate safeguards to protect PHI, report any breaches or security incidents to you, ensure their subcontractors are also bound by HIPAA requirements, and return or destroy PHI at the end of the business relationship.

Using an eFax service to transmit PHI without a signed BAA is a HIPAA violation — even if the service itself uses encryption and other security measures. HIPAA violations carry civil penalties ranging from $100 to $50,000 per violation, with a maximum of $1.9 million per violation category per year. It does not matter if you have been using the service for years without an incident. The violation is in the absence of the agreement, not in any data breach.

Most HIPAA-compliant eFax providers make getting a BAA straightforward — you request the BAA, they send you a document to sign, and the agreement is in place. If a provider refuses to sign a BAA or claims they do not provide one, stop using that service for any PHI immediately.

DiaFax provides BAAs for healthcare customers. The process is simple — request it when you sign up and it is handled. DiaFax uses 256-bit encrypted transmission, secure digital delivery, and full audit logging — everything required for HIPAA compliance.

DiaFax is HIPAA-compliant with a BAA included. $16 per month for 500 pages, no fax machine, no fax line. Visit diavoice.net/services/diafax or call (256) 724-3100.