LetterAgent
Mail physical letters by just asking your AI assistant.
Home > Guides > Dropbox Fax and HIPAA
No, not in a way you can rely on. Dropbox Fax publishes no Business Associate Agreement for the fax product, and under HIPAA a covered entity needs a signed BAA before any vendor touches protected health information. A comparison updated in August 2026 landed the same way: without that agreement, it should not be used for patient information. This is general information, not legal advice.
HIPAA compliance is not a feature you buy; it is a legal arrangement plus a set of practices. The Business Associate Agreement is the contract in which a vendor accepts its HIPAA obligations for the data it handles: safeguarding the information, reporting breaches, and limiting use to what the agreement allows. Encryption protects data in transit and at rest, but it does not create that legal relationship. A fax service can use strong encryption and still leave a clinic exposed, because without a signed BAA there is no documented chain of responsibility if something goes wrong. Regulators ask for the agreement first and the technical controls second.
| Question to ask any fax vendor | What a compliant answer looks like | Dropbox Fax's position |
|---|---|---|
| Will you sign a BAA for the fax product? | Yes, in writing, before any patient data flows | No published BAA for the fax product |
| Is there an audit trail of sent and received faxes? | Per-user logs with timestamps | Ask sales; not published for the fax product |
| Who can access stored faxes? | Role-based access, documented | Governed by your Dropbox account settings |
| Can I get compliance reports? | SOC 2 or HIPAA reports on request | Historically through the Dropbox Sign sales channel, with conditions |
This is where the confusion starts. Dropbox, the file storage product, does sign Business Associate Agreements for customers on its business tiers, and healthcare organizations use it for protected health information under those agreements. Dropbox Fax, formerly HelloFax, is a different product in the same family, and the BAA that covers your Dropbox storage does not automatically extend to the fax service. Treat them as two separate vendors for compliance purposes: confirm the agreement for each product that will touch patient data. A compliance officer who hears "we use Dropbox" and assumes the fax side is covered is making exactly the mistake HIPAA auditors look for.
Use a fax service that signs a BAA as a standard part of onboarding, not as a special request through a sales team. The reputable healthcare fax vendors publish their BAA process, their audit logging, and their access controls openly, because their buyers are compliance officers who check these things. Expect the compliant options to cost more than a consumer fax plan; the agreement, the logging infrastructure, and the breach-notification obligations are part of what you are paying for. Whatever you choose, get the BAA signed before the first fax containing patient information goes out, not after.
HIPAA is US law, but the basic principle travels. Canadian clinics deal with provincial privacy laws and PHIPA in Ontario, which impose similar expectations: written agreements with vendors that handle personal health information, and documented safeguards. The UK and EU have their own data processing agreement requirements under GDPR. The pattern is the same everywhere: if a vendor handles sensitive health data, the contract has to say so explicitly. "The product seems secure" is not a substitute in any jurisdiction.
Ready to fax it? Fax with LetterAgent: describe it to your AI assistant, approve the exact quoted price, and it is sent.
LetterAgent is a working name. Prices include print, postage, and our service fee. US prices in USD, Canadian prices in CAD (Canadian prices exclude applicable sales tax, added at checkout). Currently in private testing.
Need help? Ask your assistant: it can check a job's status any time. If it ever can't handle something: hello@getletteragent.com