HIPAA compliant fax service
On mintfax, the BAA is a click in the dashboard, at every tier. No sales call, no support ticket, no email round-trip. The customer’s authorized signer reviews the prefilled template, clicks “I agree”, and the executed PDF is downloadable immediately. The same click writes a durable evidence record: account, template version, signer name and title, accepted_at, IP, and user agent. The DPA lives on the same self-serve path as a separate document; a customer can accept neither, one, or both.
The paperwork is a dashboard action, not a procurement cycle, and the underlying controls come with the account rather than with the invoice.
In the fax market, a BAA is usually gated behind a higher-tier plan, a sales cycle, or a support email. On mintfax it is one click, at every tier.
HIPAA-relevant controls
| Control | mintfax detail | Notes |
|---|---|---|
| Encryption at rest | AES-256 envelope encryption for fax content. mintfax-managed keys, one per environment, rotated automatically. | Customer-managed keys (BYOK) are not offered. |
| Encryption in transit | TLS 1.2 minimum on inbound API traffic and outbound webhook delivery. Endpoints registered with plain HTTP are rejected at registration. | The T.30 carrier leg over the PSTN is unencrypted by protocol. See “Compliance boundary” below. |
| Exportable audit log | GET /v1/account/audit (paginated JSON, cross-environment with an environment filter) and CSV download from the dashboard. SHA-256 hash chain via prev_hash and row_hash, verifiable offline. Retention 6 years from row creation, matching 45 CFR 164.530(j)(2). | Fixed retention. Not customer-configurable. |
| Configurable retention | PHI content retention default 30 days, customer-configurable per environment between 7 and 365 days. Active per-fax scrub via DELETE /v1/faxes/{id}/content. Zero-footprint mode is a per-environment toggle. | Zero-footprint mode scrubs PHI on fax.delivered or fax.failed; operational metadata is preserved. Default off. |
| Public subprocessor list | Name, role, region, subprocessor DPA link, and status published on a public page. Primary changes announced 14 days in advance via email to account admins, dashboard banner, Atom feed, and the page itself. | A standby section pre-discloses candidates that may be activated on short notice, with the same 14-day advance notice on addition. |
Encryption at rest. Content encryption is AES-256 with envelope encryption under mintfax-managed keys. The database itself sits behind cloud-provider at-rest encryption on top of that. Customer-managed encryption keys are not offered.
Encryption in transit. TLS 1.2 minimum for both inbound API traffic and outbound webhook delivery. Webhook URLs registered with plain HTTP are rejected at registration time.
Exportable audit log. Read events for PHI content access appear in the audit stream, including any mintfax personnel action that renders customer PHI in support tooling. Personnel rows carry a pseudonymous staff identifier and a mandatory reason, and appear in the customer’s own audit feed. Retention is fixed at 6 years to match HIPAA 45 CFR 164.530(j)(2).
Configurable retention. PHI content retention defaults to 30 days from the moment a fax reaches a terminal state. It is customer-configurable per environment between 7 and 365 days. Active per-fax deletion is available at any time via DELETE /v1/faxes/{id}/content; the fax resource stays queryable with PHI fields nulled. Zero-footprint mode is a per-environment toggle that scrubs PHI immediately on fax.delivered or fax.failed. Operational metadata (status, error codes, timestamps, attempt history) is preserved. Default off. Billing records are retained permanently regardless of retention mode.
Public subprocessor list. Every entry lists name, role, region, link to the subprocessor’s own DPA, and status (primary, standby, or historical). A standby section pre-discloses candidates that may be activated on short notice. Adding to standby carries the same 14-day advance notice as adding a primary.
Compliance boundary
mintfax’s commitments cover the API infrastructure, content storage, operational databases, and application logs. They do not cover upstream carriers, recipient fax infrastructure, developer webhook endpoints, or payment processors. The T.30 leg over the PSTN is unencrypted by protocol. The BAA states this boundary. The developer-facing guide at /docs/hipaa states the boundary in full.
Frameworks not held and controls not provided
mintfax operates under a signed BAA and implements the controls above. Meeting HIPAA is the covered entity’s job; the controls above are what it depends on from mintfax.
mintfax does not hold SOC 2, HITRUST, ISO 27001, FedRAMP, or PCI DSS Level 1. These are not offered.
mintfax does not claim end-to-end encryption. Customer-managed encryption keys are not offered. Storage is single-US-region; region selection is not offered. mintfax does not label cover-page templates as “HIPAA-compliant”. The hipaa cover template can omit recipient_name and subject from the printed page, but the cover itself is not a compliance artifact.
Portability
If a customer moves off mintfax, three artifacts stay: the executed BAA PDF, the audit stream export, and the machine-readable error catalog. The full portability answer lives on /compliance.