The proposed overhaul of the HIPAA Security Rule would delete the word “addressable” from the regulation. Every safeguard becomes required, including encryption of electronic protected health information in transit and at rest. It is a proposal, not law, and it will not take effect this year. But it points at a gap most healthcare organisations already have, and fax is sitting right in the middle of it.
Worth saying plainly before anything else: nothing described here is currently enforceable. The Notice of Proposed Rulemaking went out for comment in January 2025, drew tens of thousands of responses, and the final rule is not expected imminently. Anyone selling you compliance software on the basis that “the new HIPAA rules require” something is describing a document that has not been finalised.
The change that actually matters
Since 2003 the Security Rule has had two tiers. Required specifications you implement, full stop. Addressable specifications you implement, or document why they aren’t reasonable for your organisation and put an equivalent alternative in place.
Encryption of ePHI has always been addressable. In theory that flexibility exists so a small practice isn’t forced into an unworkable technical control. In practice, a great many organisations wrote a risk analysis memo explaining why encryption wasn’t reasonable and then never revisited it.
The proposal collapses the two tiers. Everything becomes required, with narrow exceptions. Encryption in transit and at rest, multi-factor authentication for ePHI access, an asset inventory and network map, an annual audit of every safeguard, and a 72-hour restoration target for critical systems.
Most of those are achievable with existing tooling. Encryption is the one that catches fax.
Why fax is the awkward one
Healthcare still runs on fax. Referrals, prior authorisations, lab results, discharge summaries. Estimates of the volume vary wildly, but nobody in the industry seriously argues it’s going away in the next five years.
The problem is what “fax” means technically. Section 164.312(e)(1) of the rule, Transmission Security, asks you to guard ePHI against unauthorised access when it’s transmitted over an electronic network. A traditional analogue fax over a copper line has no encryption at any point on the path, and the received document then sits in an output tray until somebody collects it.
There’s a common defence that analogue fax over the PSTN isn’t an “electronic network” in the sense the rule means, and therefore sits outside the encryption requirement. That argument has held up reasonably well so far. I’d be uncomfortable building a 2027 compliance posture on it, partly because the proposal explicitly says technology-neutral controls should follow the data rather than the transport.
The middle path is the one that quietly fails audits. Email-to-fax gateways look modern and often are, but opportunistic TLS on the SMTP hop falls back to plaintext without warning anyone. You get an encrypted-looking workflow whose weakest link is invisible until someone checks the mail logs.
What a compliant fax path looks like
Take the three requirements the proposal names and apply them to a fax server one at a time.
Encryption in transit. T.38 fax relay carried over a SIP session with TLS signalling and SRTP media. The fax negotiation itself is protected, and so is the call setup that reveals who is faxing whom. Secure SIP configuration is the piece people skip, and it’s the piece that makes the difference between a document that’s encrypted and a session that merely says it is.
Encryption at rest. Received faxes stored as encrypted files, with the keys held somewhere other than the same directory. This one is straightforward and rarely the failure point.
Access control and MFA. A fax that arrives into a shared inbox that six people log into with the same password is not access-controlled, whatever the storage encryption says. Per-user accounts, multi-factor authentication, and an audit log that records who opened which document and when.
Add one more that the proposal implies rather than names: retention and disposal. Faxes accumulate. If your server has every referral since 2019 sitting in an unindexed directory, your breach exposure grows every quarter for no clinical benefit.
ICTFax and where it sits on this
ICTFax is a FreeSWITCH-based fax server, which matters for this discussion because FreeSWITCH handles T.38 and secure SIP transport natively rather than through a bolt-on. TLS signalling, SRTP media, per-tenant isolation and per-user access control are configuration decisions, not custom development.
Being open source cuts both ways here and it’s worth being honest about it. You can inspect exactly how documents are stored and transmitted, which is more than most proprietary cloud fax vendors will show you. You also carry the responsibility for configuring it correctly, and a default install is not a compliant install. Somebody has to turn TLS on, set the storage encryption, and disable the shared inbox someone set up as a shortcut in 2021.
For organisations that want the shape of the requirement rather than the plumbing, we keep a broader write-up on HIPAA compliant fax server software that covers vendor selection alongside self-hosting.
The multi-tenant wrinkle
Service providers hosting fax for multiple healthcare clients carry a version of this problem that single-organisation deployments don’t. Under a business associate agreement, you’re accountable for safeguards on behalf of every tenant, and “we encrypt the platform” is not the same claim as “tenant A cannot reach tenant B’s documents.”
Three things to verify in a hosted setup. First, storage isolation: are documents partitioned per tenant at the filesystem level, or separated only by an application-layer check? Second, key handling: does each tenant’s data use distinct keys, so a single compromised key doesn’t expose everyone? Third, log separation, because an audit log that mixes tenants is one you can’t hand to a client during their own audit without redacting it first.
This is an area where self-hosting has a genuine advantage that’s rarely mentioned. When the fax server runs inside your own network, the isolation question has an obvious answer, and the business associate agreement conversation gets considerably shorter.
What to do in the next six months
Not much of this depends on the rule being finalised, which is rather the point. Every item below is defensible under the current Security Rule too.
- Write down every fax path in your organisation. The multifunction printer in the records room counts. So does the departmental line nobody has audited since the last director left.
- For each path, answer one question: is the document encrypted between the two endpoints? If the answer involves the word “probably”, it isn’t.
- Check whether your inbound faxes land in a shared mailbox. If so, that’s usually the fastest fix available and the biggest reduction in exposure.
- Turn on audit logging if it isn’t on. The proposal’s annual-audit requirement is unworkable without it, and you’ll want the history when the rule lands.
- Set a retention period and enforce it. Deleting what you don’t need is the only security control that gets cheaper over time.
The inventory step in particular tends to surprise people. Organisations that believed they had two fax lines routinely find seven, and the ones nobody knew about are always the ones with the weakest controls.
None of that requires a procurement cycle. Most of it requires an afternoon and someone with server access who’s willing to be unpopular for a week.
Frequently asked questions
Is the new HIPAA Security Rule in effect?
No. It’s a proposed rule published for public comment in January 2025. It has not been finalised and no compliance date exists. Treat anything you read about mandatory encryption deadlines as forward planning, not a current obligation.
Is traditional fax HIPAA compliant right now?
Analogue fax over a phone line is generally accepted under the current rule, provided you have appropriate physical safeguards around the machine and the received pages. The compliance risk with fax today is far more often about who can walk up to the output tray than about the transmission itself.
What does “addressable” mean in HIPAA?
It means you must assess whether the safeguard is reasonable and appropriate for your organisation. If it is, implement it. If it isn’t, document why and implement an equivalent alternative. It has never meant optional, though it’s frequently been treated that way.
Does T.38 encrypt the fax?
T.38 by itself is a relay protocol for carrying fax over IP, and it is not encrypted. You get encryption by carrying the SIP signalling over TLS and the media over SRTP. A vendor saying “we support T.38” has told you nothing about security.
Is email-to-fax secure enough for ePHI?
It depends on the configuration, which is the uncomfortable answer. If the SMTP hop uses enforced TLS and the gateway encrypts at rest, it can be. If it uses opportunistic TLS, transmissions can silently fall back to plaintext. Check the mail server logs rather than the marketing page.
Will we have to replace our fax infrastructure if the rule is finalised?
Probably not replace it, but likely reconfigure it. Most organisations running a modern fax server already have the capability and haven’t enabled it. The bigger lift for most is access control and audit logging rather than transport encryption.