An attachment of a HIPAA-compliant fax follows the same standards as the fax itself, meaning that it is kept secure and private. The cloud fax service will encrypt the attachment in transit and at rest so it cannot be intercepted or accessed by unauthorized personnel. Any organization utilizing a cloud fax service to send PHI must also sign a Business Associate Agreement (BAA) with their chosen vendor. This agreement outlines all of the security measures necessary for HIPAA compliance, such as configurable data retention policies, encrypted transmissions, and other protections.