Sub-pages and related guides
Signing a BAA
mintfax signs a BAA with every customer at no additional cost. No plan, tier, or sales call gates the agreement. How to sign. The BAA is a self-serve click-through in the dashboard. Review the agreement and accept it. You can download the signed PDF as soon as you accept. What acceptance records. mintfax keeps a record of the acceptance on your account: the template version, the signer’s name and title, IP address, user agent, andaccepted_at. The record belongs to your account, not to a single environment.
Who qualifies. Every customer. Sandbox environments are not covered because they do not process real PHI.
Do you need a BAA?
Not every fax workload requires one. A BAA is necessary when PHI passes through mintfax infrastructure, which means the fax document, metadata, or both contain individually identifiable health information as defined by HIPAA. If your fax content contains appointment confirmations, lab results, prescriptions, insurance claims, or any other information that ties a health condition to a specific person, you need a BAA. If your fax content is purely administrative (billing invoices without patient detail, general office correspondence, marketing materials), you likely do not. When in doubt, sign one. It costs nothing.The conduit exception
HIPAA’s conduit exception applies to entities that transport PHI without accessing it - a postal service carrying sealed envelopes, for instance. mintfax does not qualify as a mere conduit. The service stores fax documents, processes the associated metadata, and retains audit log entries tied to each fax. Because mintfax has access to PHI during processing and storage, a BAA is the right instrument.Encryption
At rest. Fax content is stored with envelope encryption (AES-256) under mintfax-managed keys, one per environment, rotated automatically. Database storage uses the cloud provider’s default at-rest encryption. In transit. TLS 1.2 minimum on all connections, with TLS 1.3 on customer-facing endpoints (API, dashboard, docs). Webhook payloads are delivered over HTTPS and signed with HMAC-SHA256 using a per-endpoint signing secret you can rotate at any time. See the webhook signing guide for verification recipes.Retention controls
Two retention modes, configured per environment. Standard mode. PHI (fax content, cover page body, sender and recipient names, and recipient company) is retained for a configurable period (default 90 days, adjustable per environment between 7 and 365) and then deleted. You can actively purge PHI content at any time via the API (DELETE /v1/faxes/{id}/content) without waiting for the retention window to elapse; the fax record itself remains queryable with PHI fields nulled. The destination number and operational metadata are kept as operational data. Billing records are retained permanently.
Zero-footprint mode. PHI is scrubbed as soon as a fax is delivered or fails (the fax.delivered or fax.failed events). Operational metadata (status, timestamps, error codes, attempt history, destination number) is preserved, so the fax resource stays queryable with PHI fields nulled. After the scrub, GET /v1/faxes/{id}/image and POST /v1/faxes/{id}/resend return 422 with error fax_data_purged. Zero-footprint is off by default; turn it on per environment in the dashboard. This mode supports HIPAA’s minimum-necessary principle. Billing records remain.
Set the mode per environment in the dashboard.
What gets deleted vs. retained
Audit logging
mintfax writes two log streams. Every entry records who or what caused it: an API key, a dashboard user, mintfax personnel, or the system.- Operational stream. Service activity, retained under mintfax’s operational log policy.
- Audit stream. PHI access, contractual acceptance (such as BAA acceptance), personnel access, and state-of-record transitions. Retained for 6 years from entry creation, per HIPAA Privacy Rule 45 CFR 164.530(j)(2). Fixed; not customer-configurable.
prev_hash and row_hash. You can verify the chain offline with the published reference verifier scripts.
Export. GET /v1/account/audit returns your audit feed as paginated JSON. The feed covers the whole account, with an environment filter. The dashboard offers the same feed as a CSV download. Both include the hash-chain fields, so you can verify integrity on your side.
Cover-page contract
Faxes that contain PHI should include a cover page with a confidentiality notice so the receiving party knows how to handle the document. mintfax supports cover-page templates with token substitution. You define the template once - confidentiality notice, intended recipient, sender information - and mintfax attaches it to each fax automatically. See the cover pages guide for template syntax and available tokens.Compliance boundary disclosureThe controls on this page cover what mintfax operates: API infrastructure, content storage, operational databases, and application logs. They do not extend to:
- Upstream carriers. Carrier systems sit outside mintfax’s compliance boundary.
- The analog leg. The PSTN leg of a fax call is unencrypted by definition. Fax content over T.30 or T.38 is in the clear between the carrier and the receiving fax machine.
- Recipient fax machines. What happens to the document after it prints or arrives at the receiving device is outside mintfax’s control.
- Your webhook endpoints. Events delivered to your registered URLs leave mintfax’s infrastructure at the point of delivery. Securing your endpoint is your responsibility.
- Third-party payment processors. Stripe processes credit purchases; no PHI flows through Stripe.
Quick-start
- Sign the BAA. Accept the BAA click-through in the dashboard and download the signed PDF.
- Choose a retention mode. Under environment settings, select Standard (with your preferred retention window) or Zero-footprint.
- Send a fax. Use your sandbox API key to send a sandbox fax and verify that audit log entries, webhook events, and retention behavior match your expectations. Then switch to your live API key.