2026 Fax Security Checklist: SOC 2, MFA, and Audit Trails

By

Paperless Productivity

Posted on January 23, 2026

As fax platforms have evolved into integrated applications, the surrounding security model has become more complex. Each integration expands both capability and risk.

The systems that store, route, and integrate fax data need the same governance and scrutiny as any or PHI or PII system. Secure enterprise fax environments in 2026 share a common set of controls. Organizations should verify that their fax platform supports:

  • Strong identity controls, including MFA and centralized identity provider integration
  • Role-based access control that limits permissions according to job responsibilities
  • Encryption in transit and at rest for fax images and metadata
  • Policy-based retention and archival to control the lifecycle of sensitive records
  • Immutable audit logs that document transmission activity and user actions
  • Secure integrations with telephony, APIs, and service accounts
  • Centralized monitoring and incident response visibility

These controls, and the detailed checklist below, apply to OpenText Fax (RightFax) and all other enterprise fax platforms.

This guide is for informational purposes based on our implementation and advisory experience. It does not constitute legal or regulatory advice. Consult qualified professionals to determine the requirements that apply to your environment.


A 2026 Fax Security Checklist

Vendor & Framework Alignment

  • Fax vendor holds SOC 2 Type II certification
  • Vendor controls align with SOC 2 principles: availability, confidentiality, change control, monitoring, third-party risk
  • Shared responsibility model is documented and understood

Identity & Access Control

  • MFA enforced for all fax access points (admin, user, API)
  • Fax authentication integrated with centralized IdP
  • Role-based access mapped to job duties
  • Clear separation between end users, administrators, and auditors
  • No shared or generic accounts

Data Protection

  • Encryption enforced in transit and at rest
  • Legacy components that lack encryption are isolated or retired
  • Retention policies documented and enforced
  • Automated deletion enabled where retention is no longer required
  • Archival routes only to secured EHR, ECM, or document systems

Audit & Legal Readiness

  • Immutable fax logs enabled
  • Logs record sender, recipient, timestamps, transmission details, and handling outcomes
  • Fax logs correlate with identity, telephony, and EHR data
  • Logs retained long enough to support audits, disputes, and investigations

Integration Security

  • Centralized identity governs all fax authentication
  • Conditional access policies apply to fax platforms
  • SIP trunks and gateways secured
  • Telephony traffic monitored for abnormal volume or routing changes
  • Service accounts tightly scoped
  • API credentials rotated on a defined schedule
  • Data mappings reviewed for accuracy and scope
  • Automated workflows reviewed for failures and duplicate storage

Monitoring & Operations

  • Fax authentication and activity events feed into centralized security monitoring
  • Alerts defined for failed logins, unusual access patterns, and permission changes
  • Fax explicitly included in incident response procedures
  • Evidence preserved during investigations before logs rotate or purge
  • Periodic reviews of MFA, access roles, retention policies, and log integrity
  • Configuration and access drift checked on a defined schedule
  • Tabletop exercises include fax-related incidents and outages
  • Fax included in disaster recovery and continuity planning

Security Frameworks: Looking Beyond HIPAA

HIPAA establishes a baseline for protecting healthcare data, but it does not define a complete security program. The regulation requires safeguards such as access controls and encryption but leaves many operational details open to interpretation.

SOC 2 is a more comprehensive, industry-agnostic operational framework. It focuses on controls related to security, availability, confidentiality, change management, monitoring, and third-party risk. While SOC 2 certification is not required for healthcare organizations, alignment with its principles can help Covered Entities to show consistent operations and clear evidence during reviews.

However, SOC 2 Type II certification is critical for fax vendor selection. We consider it a hallmark of a mature, enterprise-grade fax vendor for the healthcare space.

Identity & Access Control

Strong access control remains the most effective way to reduce risk. In short, the goal is to limit fax access to only verified users with clearly defined permissions.

Multi-factor authentication (MFA) is a universal best practice. It should protect all access points, including administrative consoles, user clients, and APIs. Password-only authentication is no longer considered sufficient for systems that handle sensitive data.

Most organizations benefit from integrating fax authentication with a centralized identity provider. This allows existing policies to apply automatically, and also simplifies onboarding and offboarding by keeping account management within a single identity system. Authenticator apps or push notifications usually suffice, although higher-risk or higher-permission roles might justify hardware keys or FIDO2. 

Role-based access control complements MFA by limiting what users can do after authentication. Permissions should follow the principle of least privilege and clearly distinguish between end users, administrators, and audit or compliance roles.

Protecting Fax Data Throughout Its Lifecycle

Fax transmissions are inherently secure. Modern enterprise fax platforms also keep fax images and metadata secure at rest. Any legacy components that cannot meet current encryption standards should be isolated or retired as part of modernization efforts.

Retention policies also deserve attentionStoring fax records indefinitely may create unnecessary exposure, while overly aggressive deletion can create operational gaps. Most organizations strike a balance through policy-driven retention rules, automated deletion schedules, and controlled archival into secure EHR, ECM, or document management systems

Audit Trails & Legal Defensibility

Fax activity frequently becomes evidence in disputes involving patient care, billing, or contractual obligations. For that reason, auditability is as important as transmission security.

Comprehensive audit logs should capture who sent a fax, when it was transmitted, where it was delivered, and how it was processed. These logs must be tamper-resistant so records cannot be altered after the fact.

When correlated with identity data, telephony records, and EHR events, fax logs provide a clear chain of custody for sensitive information. That visibility strengthens compliance posture and simplifies investigations when questions arise.

Integration Security

Many significant security risks are not within the fax platform itself, but at its integration points. Shared identity and logging infrastructure makes fax activity easier to monitor and govern.

As we discussed earlier, centralized identity integration keeps auth policies consistent across applications and reduces the risk of orphaned accounts. Telephony infrastructure—including SIP trunks and gateways—should be secured and monitored for unusual volume or routing behavior.

Application integrations require equal attention. Service accounts should have narrowly defined permissions, API credentials should rotate regularly, and automated workflows should be reviewed periodically to prevent silent failures or unintended data duplication.

Operational Governance & Readiness

Security controls are only effective if they are monitored and tested.

Fax systems should feed authentication and activity events into centralized monitoring platforms alongside other infrastructure logs. This makes it easier to detect failed login attempts, unusual access patterns, or unauthorized permission changes.

Incident response planning should explicitly include fax systems. Misdirected transmissions, compromised accounts, and unauthorized archive access require clear procedures for containment and evidence preservation.

Regular operational reviews reinforce these controls. Periodic checks of access roles, MFA enforcement, retention settings, and log integrity help detect configuration drift before it creates risk.


Fax remains a dependable channel for sensitive information, but the surrounding platform requires the same governance as any other critical system. Strong identity controls, comprehensive audit trails, vendor oversight, and continuous monitoring keep fax environments secure and defensible.

Paperless Productivity® helps healthcare organizations and other regulated firms review enterprise fax deployments, identify control gaps, and develop practical improvement roadmaps. Reach out if you’d like to discuss your environment or learn what we’re seeing across large RightFax deployments in 2026.

Request Consultation
Close