When you send a patient record through a hosted fax service, that PHI passes through someone else’s servers, and your only real protection is a Business Associate Agreement. Self-hosting open source fax server software changes the math: the data never leaves your control, so there’s no third party to sign a BAA with in the first place. You trade convenience for ownership.
Why the third-party BAA is a real exposure
The 2026 breach numbers for healthcare are ugly. Regulators have logged hundreds of large reported breaches, records exposed run into the hundreds of millions, and the average breach cost sits in the millions of dollars per incident. Fax still moves a huge share of clinical documents, so it lands squarely in that risk pool.
A BAA is a contract. It says your fax vendor promises to safeguard PHI and take on liability if they slip. What it does not do is stop the data from touching their infrastructure. Every fax you send crosses their network, sits in their storage, and depends on their patching schedule and their staff. If they get breached, your patients are in the report, and you’re the covered entity explaining it.
What open source fax server software actually gives you when you self-host
The alternative is to run the fax server yourself. With open source fax software, the code runs on your hardware, in your data center or private cloud, behind your firewall. PHI is generated, converted, transmitted, and logged inside a boundary you already control and already audit for HIPAA.
ICTFax is built for exactly this. It’s open source, white-label, and multi-tenant fax server software running on FreeSWITCH and ICTCore with an Angular portal. The feature set covers what a healthcare team needs day to day:
- Email-to-fax and fax-to-email so staff work from their inbox, not a machine in the hallway.
- T.38 and FoIP transport for clean transmission over IP.
- Detailed fax logs for audit trails and delivery proof.
- Multi-tenant isolation so departments or client organizations stay separated.
- REST APIs to wire faxing into your EHR or intake workflow.
Because you host it, none of that traffic crosses a vendor’s systems. You can read more about the underlying technologies behind ICTFax if you want to see how the pieces fit together.
The trade-offs you’re signing up for
Self-hosting isn’t free of responsibility, it just moves the responsibility to you. When you own the box, you own the patching. You own uptime. You own the security hardening, the backups, and the access controls. A hosted vendor absorbs some of that operational load, and for a small practice without IT staff, that can matter.
So the honest question isn’t which option is safer in the abstract. It’s whether your team can run infrastructure to a HIPAA standard. If you already manage servers, apply security updates on a schedule, and control network access, self-hosting removes an entire class of third-party exposure with little added burden. If you don’t have that capability yet, a hosted service with a solid BAA may be the pragmatic starting point.
Fitting a self-hosted fax server into a HIPAA program
If you go the self-hosted route, treat the fax server like any other system that touches PHI. Encrypt transport, restrict portal access by role, keep the fax logs for your retention window, and put the box on your normal patch and vulnerability-scan cadence. Open source helps here because you can inspect the code, run your own security review, and avoid opaque data flows you can’t audit. For a deeper look at the controls that matter, see the guide on a HIPAA compliant fax server.
The point of self-hosting isn’t that it’s magically compliant. It’s that it removes one whole party from your PHI’s path. Fewer parties means fewer contracts to trust, fewer systems that can be breached on your behalf, and a smaller attack surface you don’t directly manage.
Frequently Asked Questions
Does self-hosting fax mean I don’t need a BAA at all?
You still need BAAs with any vendor that touches PHI, like a SIP or FoIP carrier if you use one. What self-hosting removes is the fax application vendor from that list, since the software runs on your own infrastructure and the PHI never sits in their storage.
Is open source fax software actually HIPAA capable?
HIPAA compliance is about how you deploy and operate a system, not a checkbox on a product. Open source fax software like ICTFax gives you the transport security, access controls, and audit logs you need. You supply the hardening, encryption at rest, and access policies around it.
What if my team can’t run servers reliably?
Then a hosted service with a strong BAA is a reasonable choice, and there’s no shame in it. Self-hosting only reduces risk if you can actually meet the operational bar. Be honest about your IT capacity before you commit to owning the stack.
How does ICTFax keep tenants separated?
ICTFax is multi-tenant by design, so each department or client organization gets isolated fax handling, logs, and access. That lets a single self-hosted deployment serve several groups without their data mixing together.
Can I connect a self-hosted fax server to our EHR?
Yes. ICTFax exposes REST APIs, so you can trigger faxes, pull status, and route inbound documents straight into an intake or EHR workflow. Email-to-fax and fax-to-email cover the simpler cases without any custom integration.
If keeping PHI inside your own walls matters to your organization, take a closer look at ICTFax open source fax server software and see whether self-hosting fits your team. You own the infrastructure, and you own the peace of mind that comes with it.