What we claim, and what we do not.
Vendors in this market routinely imply more than they have. This page exists so you can tell exactly where VitalFax stands before you evaluate anything else about it.
What we do say
- Designed for HIPAA-regulated workflows. The product is architected around tenant isolation, access control, audit logging and least-privilege support access.
- VitalFax will enter into a Business Associate Agreement with customers. A versioned agreement is presented in-product and acceptance is recorded.
- Every access to a document is recorded in an append-only audit trail that your own administrators can read.
- VitalFax personnel have no standing access to customer documents.
- Notifications, logs and webhook payloads are designed to exclude clinical content, and that exclusion is enforced in code.
What we do not say
- We do not claim to be "HIPAA compliant". Compliance is a property of an organization and its complete programme, not a badge a software vendor awards itself.
- We are not SOC 2 certified. No audit has been performed.
- We are not HITRUST certified.
- We have not commissioned an independent penetration test.
- We do not publish uptime history, because we do not yet have enough of it to publish honestly.
- We do not list customer logos, testimonials, reviews or awards, because we do not have any to list.
Business Associate Agreement
Current version: 2026-01
The agreement is presented inside the product to an Organization Owner. Acceptance records the signer, their title, the time, and a hash of the exact text shown, so which version was agreed to is provable later.
What it covers
1. Purpose and scope
This Agreement governs the handling of Protected Health Information (PHI) that the Covered Entity or Business Associate ("Customer") transmits to or stores within the VitalFax service. It applies to all documents, fax transmissions, secure exchanges and metadata processed on the Customer’s behalf.
2. Permitted uses and disclosures
VitalFax may use and disclose PHI only as necessary to provide the service, as required by law, and for the proper management and administration of VitalFax. VitalFax will not sell PHI, will not use PHI for advertising, and will not use PHI to train machine-learning models.
3. Safeguards
VitalFax will implement administrative, physical and technical safeguards designed to protect the confidentiality, integrity and availability of PHI, including tenant isolation, access controls, encryption in transit, encryption at rest for production storage, and audit logging of access to documents.
4. Subcontractors
VitalFax will ensure that any subcontractor that creates, receives, maintains or transmits PHI on its behalf agrees in writing to restrictions and conditions at least as protective as those in this Agreement. A current list of subprocessors is maintained and made available to Customer.
5. Reporting
VitalFax will report to Customer any use or disclosure of PHI not permitted by this Agreement, and any Security Incident or Breach of Unsecured PHI of which it becomes aware, without unreasonable delay and in accordance with applicable law.
6. Access, amendment and accounting
VitalFax will make PHI available to Customer as necessary to satisfy Customer’s obligations regarding individual access, amendment, and an accounting of disclosures. The VitalFax audit trail is available to Customer administrators at all times.
7. Return or destruction
On termination, VitalFax will return or destroy PHI where feasible, and will extend the protections of this Agreement to any PHI that cannot feasibly be returned or destroyed for as long as it is retained.
8. Support access
VitalFax personnel do not have standing access to Customer documents. Support access requires an explicit, reason-recorded, time-limited grant which is logged in the Customer’s own audit trail.
Before you rely on this
The agreement text is a template pending review by counsel. It is presented and recorded faithfully by the software, but the wording itself has not been through legal review, and VitalFax has not yet executed Business Associate Agreements with its own production subprocessors. Both are prerequisites before VitalFax handles real protected health information.
In the product
The compliance centre
Administrators get the evidence they need without asking us for it.
Audit log
Filterable by event, object and date. Logins, document views, downloads, sends, role changes and agreement acceptance.
Access reports
Who has access to what, which roles they hold, and when they last signed in.
Security settings
Session lifetime, idle timeout, whether MFA is required, API key policy and IP restrictions.
Retention settings
How long documents are kept, with expired documents surfaced for deletion rather than removed silently.
MFA adoption
How many members have enrolled, so a policy can be introduced with evidence rather than guesswork.
Data export and deletion
Controls for producing a copy of your data and for requesting deletion, with each request recorded.
Outstanding
The work between here and a production deployment
These are not aspirations. They are the specific items that must be completed before VitalFax should hold real protected health information.
- 1Execute a Business Associate Agreement with the fax provider.
- 2Execute a Business Associate Agreement with the production object storage vendor.
- 3Execute a Business Associate Agreement with the email provider.
- 4Complete legal review of the customer-facing agreement text.
- 5Write and adopt the administrative policies HIPAA requires, including workforce training and sanctions.
- 6Complete a formal risk analysis and document the remediation plan.
- 7Commission an independent security assessment.
- 8Establish and rehearse the incident-response process end to end.
If you are evaluating VitalFax for real clinical traffic, ask us where each of these stands. We will answer with a date or with “not started”. Get in touch.