Is Fax Secure? Understanding the Risks from Sending to Storage

An employee sends a confidential document and receives a successful transmission confirmation. The pages are readable, nothing appears to be missing, and the system reports no error. From the sender’s perspective, the exchange is complete.

But was the destination number correct? Who could retrieve the document at the other end? If it arrived as an email attachment, where else might it now be stored?

Those questions explain why “Is fax secure?” does not have a universal yes-or-no answer. Fax can support the exchange of sensitive information, but its security depends on the systems, connections, people, and document-handling practices involved. The method of transmission is only one part of that assessment.

A traditional machine may produce pages in a shared office. A software-based service may deliver documents to a departmental queue, individual account, or email inbox. Each arrangement changes who can access the information and where safeguards are needed. Moving away from paper may remove one exposure while leaving others unresolved.

Recipient verification illustrates the point. In its guidance on physician-to-physician faxing, the U.S. Department of Health and Human Services identifies confirming the destination number and securing the receiving machine as examples of appropriate safeguards. These precautions address risks that a successful transmission report cannot rule out.

The same need to examine the whole process applies when evaluating encryption. Knowing that a connection is encrypted does not explain how the document is handled after delivery. Likewise, encrypted storage does not establish whether everyone with access has a legitimate reason to view the contents.

For organizations reviewing fax security, the starting point is to follow the document: where it originates, how it travels, who receives it, and what happens to every necessary copy.

This article examines the risks along that journey and the safeguards worth assessing at each stage. It also explains how to interpret security claims so that decisions reflect the actual workflow rather than assumptions about fax technology.

A fax workflow is secure only to the extent that its safeguards address the ways information could be exposed, altered, lost, or made unavailable. Evaluating it requires looking beyond the sending application or machine to include the recipient, intermediate systems, user access, and retained documents.

Two organizations can use the same fax software and have different levels of protection. One may restrict access to designated employees and maintain verified recipient details. Another may deliver every incoming document to a broadly accessible inbox. The software is only part of the explanation.

The Information Being Sent and the Consequences of Exposure

Start by identifying the documents involved. A publicly available brochure and a file containing personal identification details do not present the same consequences if sent to the wrong destination.

For each document category, consider:

• Confidentiality: Who should be able to view the information?
• Integrity: How will employees establish that the document is complete, readable, and associated with the correct record?
• Availability: Can authorized staff retrieve it when needed, including during an interruption?

These questions help translate “secure faxing” into specific requirements. For a time-sensitive document, delayed access may be a significant concern alongside unauthorized disclosure.

The Systems and People Along the Transmission Path

Map where the document goes between preparation and receipt. Depending on the setup, it may pass through an employee’s device, a fax application, provider infrastructure, external connections, and a receiving system before reaching the intended person.

Protection needs to be understood across those stages. Ask where documents are processed or temporarily stored, which parties administer those systems, and where the information becomes accessible to a user.

A safeguard at one stage should not be treated as proof of protection everywhere else. For example, a protected connection to a service does not explain what happens when the receiving organization prints or forwards the document.

The Receiving Environment

The sender can verify a destination and choose an appropriate transmission method, but the receiving environment also affects security.

A shared machine may leave printed pages accessible to people passing through an office. A digital queue may expose documents to employees whose roles do not require access. An individual inbox may limit initial visibility but still allow unnecessary forwarding or downloading.

For sensitive exchanges, establish the appropriate recipient and receiving process in advance. Where relevant, confirm that the receiving team knows how to handle the document and that an unattended general destination is suitable for the information involved.

The Copies Created Before and After Transmission

The document’s journey may begin before it enters the fax system and continue after delivery. Employees might save an export to a desktop, print a working copy, download the received file, or attach it to another message.

Each copy creates another location to account for. Identify which copies serve a necessary purpose, who can access them, and how long they should remain.

This is why a fax security review should include the surrounding email, endpoint, and records-management practices. Assessing the fax application alone can miss places where the same information remains exposed.

Whether Safeguards Work in Daily Use

Finally, examine whether employees can follow the intended process consistently. Recipient verification is less effective if no one maintains saved numbers. Restricted access can become outdated when staff change roles. An incident procedure offers little help if employees do not know where to report a mistake.

A useful assessment pairs each safeguard with an owner and a way to check it. That makes security an ongoing operating responsibility rather than a feature assumed to be present when the system is installed.

Some fax security problems begin before transmission starts. An employee selects an outdated contact, attaches the wrong file, or includes pages intended for someone else. The system may then send exactly what it was instructed to send, even though the instruction was incorrect.

The first safeguards should therefore address two questions: Is this the correct destination, and is this the correct information to send there?

Verify New or Changed Recipient Details

A saved fax number is convenient, but it should not be treated as permanently accurate. Organizations change locations, departments move, and contact information becomes outdated.

Establish a verification process for new recipients and changes to existing details. Use a trusted contact record or independently established communication channel to confirm the destination. If a request unexpectedly changes where sensitive documents should be sent, resolve the discrepancy before updating the saved entry.

HHS guidance on sharing patient information for treatment identifies confirming an unfamiliar fax number with the intended recipient as a reasonable safeguard. It also describes preprogramming frequently used numbers as a way to reduce misdirection.

Saved destinations still need maintenance. Assign responsibility for updating entries and removing obsolete ones, and use clear labels that distinguish similar departments or locations.

Review the Actual Document Being Sent

Correct recipient details do not prevent disclosure if the wrong document is attached. Before sending, check the file itself rather than relying only on its name.

A focused review should confirm:

• The document belongs to the intended person, account, or case.
• Every included page is relevant to the exchange.
• Unrelated records or supporting materials have not been included accidentally.
• The document is complete, readable, and ready for the recipient to use.

For paper workflows, check both the selected pages and the device’s document feeder. For software-based workflows, review the selected attachments and, where available, the prepared fax preview.

Keep the check proportionate to the consequences of an error. Particularly sensitive or unusual exchanges may justify a second-person review, while routine transactions may be better supported by clear procedures and well-maintained recipient records.

Limit Unnecessary Information

Consider what the recipient needs for the specific task. Sending an entire file when only a particular document is required can expose additional information without helping the recipient complete the work.

This does not mean removing context that is necessary to understand or act on the document. Establish appropriate document packages for recurring workflows so employees do not have to make the same decision from scratch each time.

Apply the same care to cover sheets. Include enough information to support routing and follow-up, while avoiding sensitive details that do not need to appear there. A confidentiality notice may give an unintended recipient instructions, but it cannot prevent someone from reading a misdirected fax.

Check Resends as Carefully as Initial Submissions

A request to resend can create pressure to act quickly. Before repeating the transmission, establish whether the first attempt failed technically or whether the recipient is having trouble locating the document.

Confirm the destination again if there is uncertainty. Repeatedly sending to an unverified number can reproduce the original error and create additional copies.

For important exchanges, retain the appropriate transmission record and follow the agreed confirmation process. The objective is to resolve the delivery problem while maintaining the same care used for the first submission.

Once the document and destination have been checked, the next question is how the information travels between systems. This is where security descriptions can become unclear: a service may advertise “encrypted faxing” without explaining which connections are protected or where that protection ends.

Evaluate encryption against the actual route your documents take. Sending between users of the same platform may involve a different path from sending to an outside fax machine or delivering a document through email.

Encryption in Transit Applies to Specific Connections

Encryption in transit protects information while it moves across a particular connection. For example, a provider may protect the connection between an employee’s browser and its fax service.

That statement alone does not explain the remaining journey. The service may process the document and pass it through other systems before it reaches the recipient.

Ask the provider to identify each relevant segment:

• From the employee’s device or business application to the fax service.
• Between systems that process and transmit the document.
• From the service to the external receiving environment.
• From the receiving service to the employee who retrieves it.

For each segment, establish whether encryption applies, where it terminates, and what happens if the expected protection is unavailable. Avoid treating protection on the first connection as evidence that every subsequent connection uses the same safeguards.

Encryption at Rest Answers a Different Question

Encryption at rest concerns stored information rather than information moving across a connection. It is relevant during transmission because a service may temporarily store documents while preparing them, waiting for an available destination, or retrying an unsuccessful attempt.

Ask whether protection covers temporary files and queued documents as well as long-term archives. Also clarify which authorized processes or personnel can decrypt the information.

A service can provide encryption both in transit and at rest without establishing end-to-end encryption. Those protections address different stages and need to be described separately.

End-to-End Encryption Requires Clearly Defined Endpoints

When a provider uses the term “end-to-end encryption,” request a precise explanation of what it means for your intended workflow.

Identify where encryption begins, where decryption occurs, and who controls or can access the keys. Clarify whether intermediaries can access readable document contents and whether the claim applies to every supported destination or only particular exchanges.

The endpoint matters. Protection that ends at a receiving service does not automatically describe what happens when that service sends an attachment to an inbox or prints the document.

A useful explanation should make these boundaries understandable without requiring the buyer to infer them from a general security label.

External Fax Destinations Need Separate Assessment

An outside recipient may use different equipment, services, and security arrangements. Compatibility with that destination does not establish that it supports the same encryption protections as the sending platform.

Ask how the provider handles that specific exchange, including any conversion or transfer between systems. Where the destination cannot support the protection required for a document, determine whether another approved exchange method is appropriate.

This assessment should also cover email delivery. If the workflow involves sending or receiving fax attachments through email, establish how those connections and mailboxes are protected rather than assuming the fax service’s controls extend to them.

Request Evidence That Matches Your Configuration

A general statement that a product “uses encryption” leaves important questions unanswered. Request documentation showing the relevant transmission paths, protection boundaries, and configuration requirements.

Use that information to assess the deployment you will actually operate. The meaningful question is whether the safeguards cover the connections and systems through which your documents will pass—and whether any remaining exposure is acceptable for the information involved.

Once a fax reaches its destination, security depends on how the receiving organization makes it available. A document may print immediately, enter a shared queue, or arrive as an email attachment. Each arrangement creates different opportunities for authorized work—and unintended access.

Delivery should place the document within a controlled process, with clear responsibility for retrieving and handling it.

Protect Documents at Shared Machines

A shared fax machine can expose incoming pages before the intended employee collects them. Consider its location, who can approach it, and how long documents typically remain in the output tray.

HHS guidance identifies placing a fax machine in a secure location as a safeguard against unauthorized access to patient information. The practical objective is to prevent sensitive pages from being available to people who have no reason to view them.

Assign responsibility for collecting and routing incoming documents, including during breaks and absences. For particularly sensitive exchanges, coordinating with the receiving employee may help reduce the time pages remain unattended.

Restrict Digital Queues to the Appropriate Teams

Digital delivery can remove the exposed printout, but a broadly accessible queue may create a similar problem electronically.

Determine which employees need access to each category of incoming document. A team handling customer applications may not need access to personnel records, even if both types arrive through the same fax platform.

Evaluate whether the system supports permissions that reflect those distinctions. Where supported, separate access to viewing documents, sending faxes, exporting files, and administering the service.

Shared work also needs individual accountability. Giving employees their own accounts can support access reviews and activity tracking, provided the platform records the relevant events. Confirm those capabilities rather than assuming they are included.

Treat Email Delivery as a Separate Access Decision

When incoming faxes arrive as attachments, access depends partly on the receiving mailbox. Review who can open that mailbox, whether access has been delegated, and whether forwarding rules send documents elsewhere.

For example, a departmental inbox may be accessible to temporary staff or employees who no longer support that function. Automatic forwarding could also move attachments outside the intended receiving environment.

Decide whether attachments are appropriate for the workflow or whether another supported delivery method better fits the information involved. Whatever method is selected, employees need clear instructions on forwarding, downloading, and transferring documents into the official record.

Provide Coverage Without Unnecessary Access

Employees need a way to cover absences and urgent work, but permanent access for an entire department may be broader than necessary.

Define who provides backup coverage and how access is approved. Where the system supports temporary permissions, specify when those permissions should end. Otherwise, establish a manual review to remove access that is no longer required.

Apply the same discipline when employees change roles or leave. Include fax queues and related mailboxes in the access-change process so that permissions do not remain simply because the service was overlooked.

Make Exceptions Visible

Some incoming documents will reach the wrong internal queue or arrive without enough information for assignment. Establish a restricted process for reviewing and redirecting those items.

Avoid resolving uncertainty by circulating the document widely and asking who recognizes it. Instead, designate an authorized person or team to investigate, using only the information needed to identify the appropriate destination.

That approach supports timely routing while limiting the number of people exposed to the contents.

A fax can remain sensitive long after the task it supported is complete. Copies may persist in the fax platform, an employee’s inbox, a downloads folder, a records system, or a paper file. Each location needs to be accounted for.

Storage security therefore involves more than encrypting an archive. It also requires deciding which copies should exist, how employees retrieve them, and when they can be removed.

Identify Where the Official Record Belongs

Establish the designated location for documents that must be retained. Depending on the workflow, this might be a case-management application, records repository, or another approved system.

A fax queue may serve as a receiving area without being the appropriate long-term archive. If employees transfer documents elsewhere, define how they confirm that the transfer is complete and accurate before removing temporary copies.

For example, an employee processing a signed application should verify that all pages are readable and associated with the correct account. Saving the file somewhere in the records system is insufficient if colleagues cannot reliably find it later.

Account for Copies Outside the Main Archive

Map the additional copies created during normal work. An incoming attachment might remain in an inbox after being downloaded and uploaded into another application. A printed copy may remain on a desk after the electronic record is filed.

For each location, determine whether the copy serves an ongoing purpose and whether its protection matches the information it contains. Pay particular attention to local folders and shared drives that fall outside the fax platform’s access controls.

Removing a document from the fax application does not establish that every copy has been removed. Employees need a clear process for handling working copies rather than assuming the central system manages them automatically.

Set Retention Rules by Document Type

The fact that a document arrived by fax does not determine how long it should be kept. Its content, business purpose, and applicable requirements should guide that decision.

The Federal Trade Commission’s guide to protecting personal information recommends a written retention policy identifying what information must be kept, how it is protected, how long it is retained, and how it is securely disposed of when no longer needed.

Translate the organization’s approved policy into settings and procedures that staff can follow. Establish who authorizes changes and how exceptions are handled. Before enabling automatic deletion, confirm that the rule applies to the affected records and accommodates any required preservation.

Clarify How Backups and Provider Copies Are Handled

Backups support recovery, but they also contain information that remains subject to protection. Ask how backup access is restricted, how long copies remain, and what happens when information is deleted from the active system.

For hosted services, clarify whether deletion affects active storage immediately and how remaining copies expire. Also establish the process for exporting records and removing retained information when the service ends.

These details help avoid promising immediate, complete deletion when the underlying systems follow a different lifecycle.

Include Disposal and Equipment Retirement

Document disposal should cover both routine cleanup and changes to the technology holding the information. Replacing a computer, returning a multifunction device, or decommissioning a server can leave stored documents outside the active workflow.

Have the responsible technical team identify storage media and apply an appropriate sanitization process before equipment leaves the organization’s control. Handle paper copies through the approved secure-disposal process.

Keep responsibility explicit: the employee completing a business task, the records owner, and the technical administrator may each control different copies. Coordinating those roles helps ensure that retained information stays available where needed without accumulating unnecessarily elsewhere.

Even with safeguards in place, an employee may send a document to the wrong number, discover unexpected access to a queue, or find that sensitive attachments have been forwarded outside the intended process. A defined response helps staff act promptly without creating further exposure.

The procedure should identify where to report the issue, who assesses it, and how relevant information is preserved.

Report the Problem Promptly

Employees should know whom to contact when they suspect a fax security incident. Depending on the organization, this may be a security team, privacy officer, designated manager, or internal incident-reporting channel.

The initial report should include enough information to begin an assessment:

• When the event occurred or was discovered.
• The sending account or device and intended destination.
• The actual destination, if known.
• The document type and approximate number of affected pages.
• Available transmission identifiers and actions already taken.

Avoid circulating the sensitive document widely as part of the report. Use the approved channel and provide access to the contents only when the people investigating need it.

Contain Further Exposure

Containment depends on the event. A misdirected fax may require stopping pending retries and correcting the saved destination. Unexpected forwarding may require reviewing mailbox rules. Suspected account compromise may require restricting access while the responsible team investigates.

For a document sent to an unintended recipient, follow the organization’s process for requesting secure deletion or destruction. Record the contact attempt and any response.

A recipient’s agreement to delete a document does not establish that it was never viewed, copied, or shared. Treat that response as part of the assessment rather than proof that the incident has been fully resolved.

Preserve the Information Needed to Investigate

Retain relevant transmission records, timestamps, routing details, and available access logs through the approved process. Employees should avoid deleting evidence or changing settings beyond the actions necessary to contain the problem.

Distinguish confirmed facts from assumptions. A successful transmission record may show that a receiving system accepted the fax, but it may not identify who subsequently viewed it. Similarly, an account’s access permissions show what it could access, not necessarily what its user opened.

Document those limitations so the assessment accurately reflects the available evidence.

Escalate Decisions About Impact and Notification

The responsible team should assess the information involved, who may have received or accessed it, the extent of the exposure, and the measures taken to limit it.

Any decision about notification or other formal obligations should follow the organization’s applicable incident procedures and qualified privacy or legal review. Employees should escalate promptly rather than making their own assumptions that an event is either harmless or automatically reportable.

Correct the Cause and Check the Fix

After immediate response activities, identify why the incident occurred. An outdated destination may indicate weak contact maintenance. Repeated routing mistakes may point to confusing department labels. Unnecessary access may reveal that role changes are not reaching the fax administrator.

Assign corrective actions to specific owners and verify that they work. This might involve testing a revised routing rule, reviewing related permissions, or checking other saved destinations for the same problem.

The purpose of the review is to improve the process that allowed the incident to occur. A reminder to “be more careful” is unlikely to resolve a recurring configuration or ownership issue.

Use the following checklist to review the fax process your organization actually operates. Include the employees handling documents, the team administering the service, and the people responsible for security and records management.

For each area, record the safeguard in place, who maintains it, and how it has been verified. An unanswered question identifies a gap to investigate; it does not automatically mean the entire system needs replacing.

Before approving a solution or scheduling a migration, review whether the organization has enough information to proceed. The checklist below brings together the decisions that should guide implementation.

For each item, record its status, the person responsible, and any unresolved dependency. A requirement supported by documentation or a completed test provides a stronger basis for proceeding than a verbal assumption.

Business Needs and Workflow Ownership

• Necessary fax workflows are identified. The team understands which exchanges still require fax and which could use another approved method.
• Priority problems are documented. The project addresses specific issues, such as unsupported infrastructure, delayed routing, or repeated manual handling.
• Document responsibilities are assigned. Each receiving workflow has an owner, absence coverage, and a process for handling unresolved items.
• Success criteria are agreed. Business and technical stakeholders understand what the revised process must accomplish.

Infrastructure and Compatibility

• Active numbers and services are inventoried. The organization knows which numbers must remain available and what supports them.
• Application and equipment dependencies are documented. Systems that generate, transmit, receive, or store fax documents have been included in the assessment.
• Compatibility has been checked. Important workflows have been tested in the intended configuration, with remaining limitations recorded.
• Operating responsibilities are clear. The internal team and provider understand who manages maintenance, monitoring, support, and recovery.

Security and Document Handling

• The document journey is understood. The assessment covers submission, transmission, receipt, storage, and copies created outside the fax application.
• Protection claims have been clarified. The team knows where encryption applies and how information is handled at external destinations.
• Access requirements are defined. Permissions reflect job responsibilities, with procedures for reviewing and removing access.
• Records practices are established. The official storage location, applicable retention requirements, and handling of unnecessary copies are documented.

Migration and Operational Readiness

• The pilot has measurable acceptance criteria. Testing covers routine transactions and important exceptions.
• Employees and administrators are prepared. Training, support contacts, and shared-queue coverage are in place.
• Cutover and fallback responsibilities are assigned. The team knows who can approve, pause, or reverse the transition, and which recovery options remain available.
• Legacy retirement is planned. Required records, obsolete accounts, stored information, and redundant services will be addressed.
• Costs and performance baselines are recorded. Follow-up reviews have an owner and a scheduled date.

An incomplete item does not always prevent the entire project from moving forward. It should, however, lead to a clear decision about what must be resolved before the affected workflow changes. Use the checklist to identify dependencies early and make readiness decisions based on evidence.

Separate Documented Capabilities from Enabled Safeguards

A product may support a control that has not been enabled in your environment. Access restrictions, logging, authentication options, and retention settings should be checked against the configuration employees actually use.

Also distinguish between a provider’s responsibility and your own. The service may protect its infrastructure while your organization remains responsible for mailbox permissions, downloaded documents, or employee access changes.

A useful security review establishes what is operating today, not simply what the product could support.

Prioritize Gaps by Their Likely Consequences

Address findings according to the information involved, the extent of potential exposure, and the importance of the affected workflow. Sensitive documents reaching an unrestricted inbox may warrant more immediate attention than an administrative improvement with limited security impact.

Give each corrective action an owner and a target date. Where a technical change will take time, identify an appropriate interim procedure and make sure affected employees understand it.

Revisit the Review When the Workflow Changes

Repeat relevant checks when introducing email delivery, changing providers, adding locations, reorganizing departments, or connecting another application. These changes can alter where documents travel and who can access them.

Use recurring incidents and staff feedback to guide follow-up reviews as well. If employees regularly bypass a procedure because it is unclear or impractical, investigate the cause and revise the workflow so the intended safeguards can be followed consistently.

Is Fax More Secure Than Email?

Neither method is universally more secure. The answer depends on the systems involved, how recipients are verified, who can access the information, and what happens to copies after delivery.

Compare the actual workflows. A fax printed in an unrestricted area and an attachment sent to a broadly accessible inbox both create exposure. Evaluate the safeguards supporting each option rather than relying on the communication method’s name.

Are All Digital Fax Services Encrypted End to End?

No. Digital faxing describes how documents are exchanged through software; it does not establish a particular encryption arrangement.

A service may protect specific connections and stored documents without providing end-to-end encryption across every destination. Ask the provider to identify the protected endpoints, where decryption occurs, and whether intermediaries can access readable contents. Confirm that the explanation applies to your intended workflow.

Does a Fax Confirmation Prove That the Intended Person Received the Document?

A successful transmission confirmation generally indicates that the receiving system accepted the fax according to the service’s reporting criteria. It does not necessarily establish that the correct person retrieved, reviewed, or acted on it.

Confirm what the status means in your system. For important exchanges, use an agreed follow-up process to establish that the document reached the responsible person.

Does a Confidentiality Notice Protect a Misdirected Fax?

A confidentiality notice can identify the intended recipient and explain what someone should do if they receive the document in error. It cannot prevent that person from viewing, copying, or sharing the contents.

Use notices as a supporting measure alongside recipient verification and careful document selection. If a fax is misdirected, follow the incident-reporting process even when the cover sheet includes a confidentiality statement.

Is Receiving Faxes as Email Attachments Secure?

It can be part of a protected workflow, but it requires assessment of the email environment as well as the fax service. Review mailbox permissions, authentication, forwarding rules, and how employees handle downloaded attachments.

Also establish where the official record belongs. A copy retained in the fax platform may follow different access and retention settings from the attachment in an employee’s inbox.

How Long Should Faxed Documents Be Kept?

There is no single retention period suitable for every fax. The document’s content, business purpose, and applicable requirements should determine how long it remains available.

Apply the organization’s approved records policy to the document and account for working copies, attachments, and backups. Receiving a document by fax does not, by itself, make it a separate category requiring indefinite storage.

Does Encryption Prevent Employees from Seeing Documents They Should Not Access?

Encryption protects information under defined conditions, but it does not replace access management. An employee whose account is authorized to retrieve a document may receive a readable version through the normal application.

Restrict permissions according to job responsibilities and review them when roles change. Assess who can view, download, export, or administer documents—not just whether stored files are encrypted.

What Should an Employee Do After Sending a Fax to the Wrong Number?

Report the event promptly through the organization’s approved channel, provide the relevant transmission details, and follow instructions for limiting further exposure. Stop pending retries where possible and preserve records needed for the investigation.

Any request to the unintended recipient for deletion or destruction should follow the organization’s procedure. Do not assume that a deletion assurance removes the need for an assessment.

Fax security depends on the complete document journey, from verifying the recipient to controlling access and managing retained copies. Reviewing each stage helps organizations identify where technical safeguards and everyday procedures need improvement. To assess how CallegraFAX could fit your requirements, explore the solution and discuss your transmission paths, receiving workflows, and storage needs with the Callegra team.