What VitalFax does and does not claim
Straight answers on HIPAA, certifications and independent assessment.
Read this first
This article states VitalFax’s actual position, which may be less than a procurement questionnaire expects. It is kept accurate rather than reassuring.
There is no such thing as HIPAA certification
No authority certifies software as HIPAA compliant. Any vendor claiming to be "HIPAA certified" is describing something that does not exist. Compliance is a property of an organization's whole programme — administrative, physical and technical — not a badge a product can hold.
What VitalFax provides is the technical half: encryption, access control, audit logging, tenant isolation, retention controls, and a Business Associate Agreement. The administrative half is yours: a security officer, a risk analysis, policies, workforce training.
What VitalFax will sign
A Business Associate Agreement, available during signup and from your compliance page. It is executed before you transmit protected health information, and the acceptance record includes the exact text you agreed to.
What has and has not been independently assessed
VitalFax has had a careful internal security review and runs an adversarial test suite against its own isolation boundaries. It has not had an independent penetration test or a SOC 2 audit. The public compliance page says so and will continue to until that changes.
If your procurement requires either, that is a reasonable requirement and VitalFax does not meet it yet.
Subprocessors
Every vendor that could touch your data is listed on the public subprocessors page, with whether a BAA is executed with each. A vendor with no executed BAA does not carry protected health information.
Last reviewed 2026-10-28. Help articles live in the VitalFax repository and are changed alongside the behaviour they describe, so an article and the product cannot drift apart unnoticed.