Neither fax nor email is automatically the secure choice. The useful question is how your specific document moves, where copies remain, and who can access it at each step.
| Method | Main controls to check | Common exposure |
|---|---|---|
| Traditional fax machine | Correct number and physical access at both ends | Misdials and printed pages in shared trays |
| Online fax | Upload connection, provider access and retention, transmission route, recipient access | Copies at the provider or in an emailed receive inbox |
| Standard email | Sender and recipient account security, mail transport, forwarding and storage | Wrong-address sends, account compromise, and copies in multiple inboxes |
| Protected email or portal | Authentication, access expiry, recipient experience, and storage | Misconfigured access or a recipient who cannot open the message |
Encryption can protect part of a route without protecting all of it. For example, HTTPS can protect an online fax upload, while the onward transmission may involve a fax provider and a telephone network. Likewise, email transport encryption does not mean only the sender and recipient can ever access stored copies. Ask each provider what is protected in transit and at rest.
A fax delivery status confirms a transmission outcome. It does not prove that a named person read or accepted the document. The same distinction applies to an email send receipt.
The U.S. Department of Health and Human Services permits faxed treatment disclosures when reasonable safeguards are used; it gives verifying the number and securing the receiving machine as examples. For a covered entity or business associate using a cloud provider to handle electronic PHI, HHS describes the need for a suitable business associate agreement and other HIPAA safeguards. Neither “fax” nor “encrypted email” is a compliance shortcut. Confirm your own requirements and the provider’s agreement before sending regulated material.
See Are Faxes Secure? for a stage-by-stage fax checklist. If a recipient accepts fax and a one-time send fits your needs, review Onetime Fax pricing and the send flow.
No. Security depends on the service, the route, access controls, and the recipient. Compare the specific fax and email workflows available to you.
No. HTTPS protects the browser connection to the service; it does not establish encryption through every provider and telephone-network step.
No. A covered entity must assess its safeguards and provider agreements. HHS says a cloud service that handles electronic PHI on its behalf generally requires a business associate agreement.
No. It reports the transmission result, not who read the pages at the destination.