This is a template, not an executed BAA. It becomes effective only when both parties sign it and Faximus confirms that the identified account is HIPAA-enabled. A BAA is available on request after review.
Do not send PHI on a free, sandbox, trial, or non-BAA account. Request a BAA at compliance@faximus.io.

Faximus HIPAA Business Associate Agreement

Version: 2026.10.27-r2
Template status: Complete when signed and the identified Faximus account is confirmed as HIPAA-enabled

This Business Associate Agreement (BAA) is entered into by and between:

Faximus LLC, a South Carolina limited liability company with its principal office in Spartanburg County, South Carolina (Faximus or Business Associate),

and

[Customer legal name], a [state and entity type] with its principal office at [address] (Customer or Covered Entity).

Customer may itself be a business associate acting for one or more covered entities. In that case, references to Covered Entity include Customer in its applicable role, and Faximus acts as Customer's subcontractor business associate.

This BAA supplements the agreement under which Faximus provides cloud fax and related services to Customer (Services Agreement).

1. Effective date and activation condition

This BAA becomes effective on the later of:

the date of the last signature below; and
Faximus's written or in-product confirmation that the specific tenant or account identified in Schedule 1 is enabled for HIPAA-regulated use.

Signing this BAA does not make a free, trial, sandbox, test, non-eligible plan, or unidentified tenant HIPAA-enabled. Customer may not submit PHI before both conditions are met.

2. Definitions

Capitalized terms not defined here have the meanings given in the HIPAA Rules.

Breach has the meaning in 45 C.F.R. 164.402.
Designated Record Set has the meaning in 45 C.F.R. 164.501.
Electronic PHI or ePHI means electronic Protected Health Information.
HIPAA Rules means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 C.F.R. Parts 160 and 164, as amended.
Individual includes a personal representative recognized under 45 C.F.R. 164.502(g).
PHI means Protected Health Information that Faximus creates, receives, maintains, or transmits for Customer in connection with the Services.
Required by Law has the meaning in 45 C.F.R. 164.103.
Secretary means the Secretary of the U.S. Department of Health and Human Services or the Secretary's designee.
Security Incident has the meaning in 45 C.F.R. 164.304.
Subcontractor has the meaning in 45 C.F.R. 160.103.
Unsecured PHI has the meaning in 45 C.F.R. 164.402.

3. Scope

3.1 Covered Services

This BAA applies only to PHI processed through the HIPAA-enabled tenant or account identified in Schedule 1 and only for the services described there.

3.2 Excluded systems and data

This BAA does not apply to:

a free, trial, sandbox, test, development, or non-BAA account;
a personal email account or system outside the Services;
an integration, webhook endpoint, fax recipient, device, or downstream provider controlled by Customer;
data that is not PHI; or
records governed by 42 C.F.R. Part 2 unless the parties sign a separate written addendum expressly accepting that data.

3.3 Services Agreement

The Services Agreement remains in effect. If this BAA conflicts with the Services Agreement about PHI, this BAA controls. The Services Agreement controls for commercial, intellectual-property, service, and liability issues not specifically addressed here, to the extent permitted by HIPAA.

4. Permitted uses and disclosures by Faximus

Faximus may use and disclose PHI only as follows:

4.1 Provide the Services

Faximus may create, receive, maintain, transmit, render, route, store, retrieve, secure, troubleshoot, and otherwise use or disclose PHI as necessary to provide the services in Schedule 1, if the same use or disclosure would be permitted for Customer under the HIPAA Rules.

This includes transmitting PHI to the fax number, user, endpoint, carrier, or other destination that Customer selects and making the content available to authorized Customer users.

4.2 Required by Law

Faximus may use or disclose PHI as Required by Law.

4.3 Management and administration

Faximus may use PHI for its proper management and administration or to carry out its legal responsibilities. Faximus may disclose PHI for those purposes only if:

the disclosure is Required by Law; or
Faximus obtains reasonable assurances that the recipient will keep the PHI confidential, use or further disclose it only as Required by Law or for the purpose of the disclosure, and notify Faximus of a breach of confidentiality.

4.4 Data aggregation

Faximus may provide data-aggregation services relating to Customer's healthcare operations only when the applicable order or Schedule 1 includes that service and the use is permitted by 45 C.F.R. 164.504(e)(2)(i)(B).

4.5 De-identification

Faximus may de-identify PHI only in accordance with 45 C.F.R. 164.514 and only to provide, secure, measure, or improve the Services. Properly de-identified information is not PHI. Faximus will not attempt to re-identify it except to validate the de-identification process or as Required by Law.

4.6 Reporting violations of law

Faximus may use or disclose PHI to report violations of law to an appropriate authority in a manner permitted by 45 C.F.R. 164.502(j)(1).

5. Prohibited uses and disclosures

Faximus will not:

use or disclose PHI except as permitted by this BAA or Required by Law;
use or disclose PHI in a way that would violate the HIPAA Privacy Rule if done by Customer, except for uses expressly allowed for management, administration, data aggregation, or legal responsibility;
sell PHI except as expressly permitted by HIPAA;
use PHI for marketing as defined by HIPAA unless Customer gives a lawful written instruction and all required authorizations exist;
use genetic information for underwriting;
use PHI for Faximus's independent advertising or unrelated commercial purpose;
use PHI to train a general-purpose AI model; or
allow a Subcontractor to create, receive, maintain, or transmit PHI without the written protection required by HIPAA.

6. Safeguards

6.1 General duty

Faximus will use appropriate administrative, physical, and technical safeguards to prevent a use or disclosure of PHI other than as allowed by this BAA. For ePHI, Faximus will comply with the provisions of the HIPAA Security Rule that apply to business associates.

6.2 Security program

Faximus will maintain a risk-based security program appropriate to the Services, including the measures described in Schedule 2. These measures include, as applicable:

access controls and unique user identification;
restricted privileged (administrative) access, and optional authenticator-app (TOTP) two-step verification for portal user accounts;
audit controls and operational logging;
integrity controls;
person or entity authentication;
supported encryption in transit and encryption at rest;
workforce confidentiality and security training;
incident-response and breach procedures;
backup, contingency, and recovery procedures;
periodic risk analysis and risk management;
vendor and Subcontractor oversight; and
documented policies and procedures.

Faximus may update individual controls as technology and risk change, provided that the overall protection of PHI is not materially reduced. TLS protects Customer's connection to the Faximus web portal and API. Ordinary fax transmission may traverse public or carrier telephone networks and is not represented as end-to-end encrypted to the recipient fax device. Fax content carried over telecommunications carrier and public telephone networks is not encrypted in transit on those networks. Customer selects fax as the transmission channel and must evaluate whether that channel is appropriate for the intended disclosure.

6.3 Minimum necessary

Faximus will request, use, and disclose only the minimum PHI reasonably necessary for its permitted purpose, to the extent practicable. Customer determines the content of a fax and is responsible for applying the minimum-necessary standard before submission. Faximus is not expected to review the clinical or business substance of each document.

7. Subcontractors

Faximus may engage Subcontractors to support the Services. Before a Subcontractor creates, receives, maintains, or transmits PHI, Faximus will:

enter into a written business associate agreement or other arrangement that satisfies 45 C.F.R. 164.308(b), 164.314(a), and 164.504(e);
require materially the same restrictions, conditions, and safeguards that apply to Faximus;
verify that the service and relevant account are eligible for HIPAA-regulated workloads; and
remain responsible for the Subcontractor's performance to the extent required by the Services Agreement and law.

Faximus will not confirm an account as HIPAA-enabled under Section 1 until these steps are complete for each Subcontractor that will create, receive, maintain, or transmit PHI for that account, and the list described below is available.

Faximus uses telecommunications carriers to carry fax traffic in transit only (SIP trunking and public telephone network connectivity), not to store or record fax content. On that basis, Faximus currently treats these carriers as transmission conduits rather than Subcontractors. Faximus does not have business associate agreements with these carriers, and this BAA does not extend to carrier-operated or public telephone networks. Carriers keep their own call detail records, such as fax numbers, call times, and call duration, under their own terms.

Faximus will maintain a current list of Subcontractors authorized to process PHI and will make it available to Customer. Faximus will provide at least 30 days' advance notice of a new PHI Subcontractor where practicable, with a shorter period permitted for an urgent security, continuity, legal, or provider-replacement need.

Customer may object on reasonable documented HIPAA or security grounds under the subprocessor process in the Data Processing Addendum.

8. Reporting and incident obligations

8.1 Impermissible use or disclosure

Faximus will report to Customer any use or disclosure of PHI not permitted by this BAA of which Faximus becomes aware. Faximus will provide the report without unreasonable delay and, where reasonably possible, no later than 10 business days after discovery.

8.2 Security Incidents

Faximus will report a material Security Incident that results in or is reasonably believed to have resulted in unauthorized access to, use, disclosure, modification, or destruction of PHI, or material interference with systems containing PHI.

The parties recognize that systems routinely experience unsuccessful events such as pings, blocked scans, failed login attempts, bot traffic, and denial-of-service attempts that do not compromise PHI. This Section serves as notice of those routine unsuccessful events, and Faximus need not report each one individually. Faximus will report a pattern if it materially affects the confidentiality, integrity, or availability of PHI.

8.3 Breach of Unsecured PHI

Following discovery of a Breach of Unsecured PHI at or by Faximus, Faximus will notify Customer without unreasonable delay and, where reasonably possible, no later than 10 business days after discovery. In all events, Faximus will meet the outside limit in 45 C.F.R. 164.410, subject to any shorter applicable law.

The initial notice will include, to the extent known:

the identity of each affected Individual, or the information reasonably available to identify them;
what happened and the dates of the Breach and discovery;
the types of PHI involved;
known or likely consequences;
steps Individuals may take to reduce harm;
Faximus's investigation, mitigation, and prevention steps; and
a contact for questions.

Faximus may provide information in phases and will supplement the notice promptly as material information becomes available.

8.4 Discovery

A Breach is treated as discovered on the first day it is known to Faximus or would have been known by exercising reasonable diligence, applying the agency principles in 45 C.F.R. 164.410.

8.5 Law-enforcement delay

A notice may be delayed when a law-enforcement official requests delay under 45 C.F.R. 164.412.

8.6 Customer-directed transmission

A disclosure to the number or destination Customer selected is a Customer-directed transmission. An incorrect number entered or maintained by Customer is not, by itself, a Breach by Faximus. Faximus will investigate and report if a platform error caused PHI to be routed somewhere other than Customer's instruction.

8.7 Individual and regulator notice

Customer is responsible for notices to Individuals, HHS, media, state authorities, and other persons unless law directly requires Faximus to notify or the parties agree in writing that Faximus will perform a specific notice task. Faximus will provide reasonable cooperation and available information.

9. Mitigation

Faximus will mitigate, to the extent practicable, a harmful effect known to Faximus from a use or disclosure of PHI by Faximus in violation of this BAA. Customer will reasonably cooperate with mitigation involving Customer's users, systems, recipients, or notices.

10. Individual rights and Customer assistance

10.1 Access

If Faximus maintains PHI in a Designated Record Set, Faximus will make the PHI available to Customer as necessary for Customer to meet 45 C.F.R. 164.524. Faximus will provide available records within 15 business days after a complete request, unless the parties agree to a different period or law requires faster action.

The parties recognize that Faximus normally provides transmission and short- or medium-term document storage rather than serving as Customer's designated medical record system. Customer ordinarily responds to the Individual.

10.2 Amendment

If Faximus maintains PHI in a Designated Record Set, Faximus will make amendments or take other measures directed by Customer as necessary for Customer to comply with 45 C.F.R. 164.526. Faximus may preserve an audit record of the original and amended data where lawfully required.

10.3 Accounting of disclosures

Faximus will document and provide information about disclosures as necessary for Customer to respond under 45 C.F.R. 164.528. Faximus is not required to create an accounting for disclosures that HIPAA excludes.

10.4 Restrictions and confidential communications

Customer will notify Faximus of a restriction under 45 C.F.R. 164.522 or confidential-communication arrangement that affects Faximus. Faximus will follow the restriction to the extent it is technically and operationally applicable to the Services. Faximus is not responsible for a restriction it has not received and acknowledged.

10.5 Requests received directly

If an Individual sends Faximus a request concerning Customer's PHI, Faximus will direct the request to Customer and will not independently grant or deny it unless Customer instructs Faximus or law requires direct action.

11. Access by HHS

Faximus will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary for purposes of determining compliance with the HIPAA Rules. Where permitted, Faximus will notify Customer of the request and the information provided.

12. Customer obligations

Customer will:

use the Services and PHI in compliance with HIPAA, other applicable law, the Services Agreement, and this BAA;
submit PHI only through the identified HIPAA-enabled account and supported fields;
limit PHI to what is reasonably necessary;
verify recipients and fax numbers using procedures appropriate to the risk;
maintain appropriate cover sheets, policies, training, authorizations, notices, and workforce controls;
control and review users, roles, credentials, API keys, webhook endpoints, and email integrations;
configure retention appropriate to its legal and records obligations;
maintain its own authoritative records and backups where required;
notify Faximus of restrictions, revocations, confidential-communication arrangements, or changes that affect Faximus;
not request a use or disclosure that would violate HIPAA if done by Customer, except for a use expressly permitted to a business associate;
promptly report a suspected incident involving Faximus or a misdirected fax;
ensure each Customer-controlled recipient, integration, or downstream service is authorized to receive PHI; and
not submit Part 2 records unless a separate written addendum permits them.

Customer acknowledges that fax carries wrong-number, device, carrier, and human-routing risks. Customer must use an independently verified channel for critical or urgent communications and must confirm receipt when its policy or law requires.

13. Term and termination

13.1 Term

This BAA remains in effect while Faximus processes PHI for Customer under the Services Agreement.

13.2 Termination for cause

Either party may terminate the affected HIPAA-enabled Service for a material breach of this BAA if the breaching party does not cure the breach within 10 days after written notice. The non-breaching party may terminate immediately if cure is not possible, continued processing would violate law, or urgent action is needed to protect PHI.

If Customer knows of a pattern or practice by Faximus that materially violates this BAA, Customer will take reasonable steps to cure or end the violation and, if unsuccessful, terminate the affected arrangement as required by HIPAA. Faximus has a corresponding right to stop an unlawful Customer instruction or use.

13.3 Effect on the Services Agreement

Termination of this BAA terminates Customer's permission to submit PHI and may require termination or downgrade of the affected Service. It does not automatically terminate unrelated non-PHI services unless they cannot reasonably continue.

14. Return and destruction of PHI

14.1 Customer export

Before termination or expiration of the export window, Customer must use available tools or request reasonable assistance to export PHI it must retain.

14.2 Deletion

At termination, Faximus will return or destroy PHI that it still maintains, if feasible, according to Customer's configuration, the Services Agreement, and the Data Retention and Deletion Schedule.

14.3 Infeasible return or destruction

Return or immediate destruction may be infeasible for encrypted backups, immutable security records, legal holds, or records that law requires Faximus to keep. For retained PHI, Faximus will:

extend the protections of this BAA;
limit further use and disclosure to the reason for retention;
keep the PHI isolated from ordinary use; and
delete it when the reason for retention ends or the backup rotates out.

14.4 No medical-record retention promise

Faximus does not become Customer's legal medical-record custodian merely by retaining fax documents. Customer is responsible for selecting and paying for a retention period that meets its federal, state, professional, payer, contractual, and litigation-hold obligations.

15. No third-party beneficiary beyond HIPAA rights

This BAA does not create a private right beyond one that applicable law already provides. It does not make Faximus a healthcare provider or establish a treatment relationship with any Individual.

16. Liability and insurance

The liability, indemnity, and insurance terms in the Services Agreement apply to this BAA to the maximum extent permitted by law. Nothing in the Services Agreement eliminates a duty or direct liability imposed on a party by the HIPAA Rules.

17. Miscellaneous

17.1 Regulatory changes

A reference to the HIPAA Rules means the provision as amended. The parties will amend this BAA as reasonably necessary to comply with a material legal change.

17.2 Interpretation

Any ambiguity will be interpreted to permit compliance with HIPAA. Nothing requires a party to violate another applicable law.

17.3 Notices

BAA and incident notices to Faximus must be sent to compliance@faximus.io and security@faximus.io. Customer's notice contact is listed in Schedule 1. Operational notice may also be sent through the account or established incident channel.

17.4 Electronic signatures and counterparts

This BAA may be signed electronically and in counterparts, each of which is treated as an original and together form one agreement.

Schedule 1 - Customer, Account, and Services

Customer legal name: ____________________________________________

Customer HIPAA role:
[ ] Covered Entity
[ ] Business Associate
[ ] Other: ______________________________

Faximus account or tenant identifier: ______________________________

Eligible plan or order: __________________________________________

HIPAA activation confirmation date: ________________________________

Covered Services:

outbound fax transmission: [ ] yes [ ] no
inbound fax receipt and inbox: [ ] yes [ ] no
document storage: [ ] yes [ ] no
API access: [ ] yes [ ] no
webhook delivery that may contain PHI: [ ] yes [ ] no
email integration that may contain PHI: [ ] yes [ ] no
other: ____________________________________________________________

Customer retention setting: ______________________________________

Customer privacy/security notice contact:
Name: ______________________________
Title: ______________________________
Email: ______________________________
Telephone: __________________________

Customer breach-notice contact, if different:
Name: ______________________________
Email: ______________________________
Telephone: __________________________

Schedule 2 - Security and Operational Commitments

For the HIPAA-enabled systems used to provide the Covered Services, Faximus will have the following safeguards in place before it confirms the account in Schedule 1 as HIPAA-enabled, and will maintain safeguards appropriate to the risk while this BAA is in effect, including:

1. Identity and access

unique user and service identities;
role-based access, with administrative access limited to a small number of named staff;
optional authenticator-app (TOTP) two-step verification for portal user accounts;
production access separated from ordinary development access;
prompt removal of access that is no longer needed, and replacement of credentials that are exposed or suspected to be exposed; and
documented authorization for support access to Customer data.

2. Data protection

supported TLS for ePHI in transit between Customer and Faximus interfaces;
encryption at rest for stored fax documents and production databases using managed encryption capabilities;
managed key and secret storage;
short-lived signed access methods for document retrieval where supported; and
controls designed to prevent PHI from appearing in ordinary application logs.

3. Audit and monitoring

logging of authentication, administrative access, document access where supported, fax lifecycle events, and security events;
monitoring and alerting appropriate to the environment;
protected access to logs; and
retention according to the applicable HIPAA plan and Data Retention and Deletion Schedule.

4. Infrastructure and application security

separated production and non-production environments;
cloud account and network controls;
web application firewall or edge protections for public interfaces;
controlled software changes, code review, testing, and deployment;
vulnerability, dependency, configuration, and patch management; and
tenant-authorization checks for Customer-facing data and operations.

5. Availability and contingency

backups appropriate to the production data stores;
documented restoration and continuity procedures;
incident-response roles and escalation;
retry and recovery mechanisms for supported fax workflows; and
periodic testing appropriate to the system's risk and maturity.

6. Workforce and vendors

confidentiality and security training;
sanctions or discipline for violations;
vendor risk review and a BAA or other arrangement that meets HIPAA requirements before a Subcontractor processes ePHI.

Schedule 3 - Permitted Fax Processing

Faximus may process PHI to:

receive a document and transmission instructions from Customer;
validate and render a supported document;
queue, route, retry, and transmit the fax through authorized carriers and media infrastructure;
receive an inbound fax for an assigned number;
store and make the fax available to authorized Customer users for the configured retention period;
provide status, attempt, audit, API, email, or webhook information selected by Customer;
meter usage and maintain billing records that do not unnecessarily contain PHI;
secure, monitor, troubleshoot, and support the Services; and
delete or export PHI under Customer's instruction and the retention schedule.

Faximus will not determine clinical appropriateness, minimum necessary content, recipient authority, or whether a fax should be part of Customer's Designated Record Set.

Signatures

The parties agree to this BAA through their authorized representatives.

Faximus LLC

By: __________________________________________
Name: ________________________________________
Title: _________________________________________
Date: _________________________________________

Customer: [Customer legal name]

By: __________________________________________
Name: ________________________________________
Title: _________________________________________
Date: _________________________________________