Skip to main content
Your application handles patient health information and needs to fax it - lab results, prescriptions, insurance claims, referral letters. HIPAA requires a Business Associate Agreement with any service that stores or processes PHI on your behalf, and mintfax stores fax documents during processing. This guide walks through the setup: signing a BAA, choosing a retention mode, keeping PHI off the cover page, verifying webhooks, and testing the full flow in the sandbox before going live. For the full compliance reference (encryption details, audit log schema, conduit exception, compliance boundary), see HIPAA compliance. This page is the “do this” checklist.

​
Prerequisites

  • A mintfax account with live access. Live access activates with the account’s first credit purchase. Sandbox environments are not covered by a BAA because they do not process real PHI.
  • A sandbox API key (mfx_test_...) for testing. See the quickstart if you need one.
  • A webhook endpoint that can receive HTTPS POST requests (for Step 4).

​
Step 1: Sign a BAA

Sign in to the mintfax dashboard and accept the BAA. The agreement is a self-serve click-through, and you can download the signed PDF as soon as you accept. Key facts about the BAA:
  • Free for every customer, not an add-on. No plan, tier, or sales call gates it.
  • mintfax keeps a record of the acceptance on your account: template version, signer name and title, IP address, user agent, and accepted_at. The record belongs to your account, not to a single environment.
  • Sandbox environments are not eligible. The sandbox is for testing document formats, API integration, and delivery flow - never for real PHI.
Do not send faxes containing PHI until you have accepted the BAA.

​
Step 2: Choose a retention mode

mintfax offers two retention modes, configured per environment in the dashboard. Pick the one that fits your compliance program.

​
Zero-footprint mode

PHI is scrubbed as soon as a fax is delivered or fails (the fax.delivered or fax.failed events). Operational metadata (status, timestamps, error codes, attempt history, destination number) is kept, so the fax record stays queryable. This is the strictest option and supports HIPAA’s minimum-necessary principle. Zero-footprint is off by default; turn it on per environment in the dashboard. Once a fax has been scrubbed:
  • GET /v1/faxes/{id}/image returns 422 with error fax_data_purged.
  • POST /v1/faxes/{id}/resend returns 422 with error fax_data_purged, because the original document is gone.
  • GET /v1/faxes/{id} still returns the fax, with PHI fields nulled.

​
Standard mode with custom retention

If your workflows require retrieving fax images after delivery (for audit, reprint, or patient portal display), use standard mode with a retention window. The default is 90 days, and you can set any window from 7 to 365 days per environment in the dashboard. Set a shorter window to limit exposure. In standard mode you can also delete a specific fax immediately, without waiting for the retention window:

​
Step 3: Keep PHI off the cover page

A cover page prints first and often sits in a shared fax tray before the intended recipient picks it up. mintfax treats the cover page body as PHI: it is deleted with the fax content under your retention mode. That protects the stored copy, not the printed one. A cover page is not a compliance artifact, so leave patient names, conditions, and identifiers off it entirely. Cover pages can be set per fax or as an environment default. See the cover pages guide for the built-in templates.

​
Step 4: Verify webhook signatures

If your application receives webhook events from mintfax (delivery confirmations, failure events), you need to verify that each payload actually came from mintfax and has not been tampered with. This is especially important when the payload references PHI-related fax records. Every webhook request includes three headers (Standard Webhooks specification): The signature is HMAC-SHA256 over {webhook-id}.{webhook-timestamp}.{body}, base64-encoded. Use a Standard Webhooks reference library to verify - it will handle constant-time comparison and the 5-minute timestamp tolerance for you. The Verify webhook signatures page has complete verification code in five languages, plus secret rotation handling.

​
Step 5: Test in the sandbox

Before sending real PHI through production, run through the full flow in the sandbox:
  1. Send a fax with a synthetic document to +15005550001 (the sandbox success number). Confirm the response returns status: "queued".
  1. Do not expect a fax image. The sandbox does not render fax images, so GET /v1/faxes/{id}/image returns 404 for sandbox faxes. To check how the pages print, send synthetic content from a live environment with zero-footprint off and call the same endpoint before the retention window ends. With zero-footprint on, the image is scrubbed as soon as the fax is delivered or fails, and the call returns 422 with error fax_data_purged.
  2. Verify retention behavior. If you turned on zero-footprint mode, wait for the fax.delivered or fax.failed event, then call GET /v1/faxes/{id}. The fax record should come back with its PHI fields set to null.
  3. Confirm audit entries. Call GET /v1/account/audit with the environment filter set to your sandbox, or download the audit CSV from the dashboard.
  4. Test webhook verification. Send a fax and confirm your webhook endpoint receives the event, verifies the signature, and rejects a replayed copy.
Never send real PHI through a sandbox environment. Sandbox environments are not covered by a BAA and are not subject to the same retention and encryption controls as production environments. Use synthetic test documents for sandbox testing.

​
What you handle vs. what mintfax handles

Outside the compliance boundary: upstream carriers, the analog PSTN leg, recipient fax machines, your webhook endpoints, and Stripe. See HIPAA compliance - compliance boundary for the full disclosure.

​
What to do next

  • HIPAA compliance - full compliance reference covering encryption, audit logging, the conduit exception, and compliance boundary.
  • Cover pages - built-in templates and token substitution.
  • Webhook signing - verification code in five languages with replay protection and key rotation.
  • Data retention - standard vs. zero-footprint mode, what gets deleted vs. retained.
Last modified on October 19, 2026