When healthcare organizations, financial institutions, and other regulated enterprises evaluate fax platforms, encryption frequently appears on the vendor checklist as a yes or no item. The vendor says yes, the checkbox gets marked, and the evaluation moves on. The problem is that encryption is not a binary. The type of encryption applied, where it is applied in the transmission chain, and whether it meets the specific standards that your regulatory environment requires are all questions that the yes-or-no checkbox does not answer.
Understanding what encryption standards a fax platform should support, and why the differences between those standards matter in practice, is the foundation for making an informed platform evaluation rather than relying on vendor marketing language that may be technically accurate but operationally insufficient.
TLS: The Baseline for Transmission Encryption
Transport Layer Security is the standard encryption protocol for securing data in transit over internet connections. For fax platforms that route transmissions over IP networks rather than analog PSTN lines, TLS encryption of the transmission path is the baseline requirement.
HIPAA’s Security Rule requires that electronic PHI transmitted over a public network be protected using appropriate safeguards. TLS applied to the transmission path satisfies that requirement when implemented correctly. The key qualifiers are version and configuration. TLS 1.0 and TLS 1.1 are deprecated and contain known vulnerabilities. A compliant fax platform should support TLS 1.2 at minimum, with TLS 1.3 preferred.
When evaluating a fax vendor’s TLS implementation, ask specifically which TLS versions are supported and which cipher suites are used. A vendor that supports TLS but has not disabled legacy versions or weak cipher suites has an encryption implementation that may not satisfy the technical safeguard requirements of a mature security program even if the top-line answer to “do you use TLS” is yes.
Lane’s Fax 2.0 routes transmissions through the etherFAX network, which uses current TLS standards and a purpose-built fax transmission architecture rather than VoIP infrastructure adapted for fax. The post on what makes Fax 2.0 different from traditional cloud fax covers the network infrastructure distinction in more detail.
FIPS 140-2: The Standard for Cryptographic Module Validation
FIPS 140-2 is a U.S. government standard published by the National Institute of Standards and Technology that defines the security requirements for cryptographic modules used to protect sensitive information. Compliance with FIPS 140-2 means that the cryptographic module implementing the encryption has been validated by an accredited testing laboratory to meet the standard’s requirements.
For fax platforms, FIPS 140-2 is most directly relevant to the encryption used for content deletion. Lane’s architecture destroys fax content after delivery using FIPS 140-2 compliant deletion. That means the deletion of PHI from the transmission infrastructure meets the cryptographic standard for secure erasure, not just deletion that leaves data recoverable through forensic tools.
For federal agencies and organizations that handle federal data, FIPS 140-2 compliance may be a contractual or regulatory requirement rather than a best practice. For healthcare organizations and financial institutions, it represents a level of cryptographic rigor that exceeds what many consumer fax services offer and provides independently validated assurance that encryption implementation meets established standards.
AES-256: The Standard for Data at Rest
Advanced Encryption Standard with 256-bit key length is the broadly accepted standard for encrypting data at rest. For fax platforms that store fax content, whether in a transmission queue, in a document archive, or in a user-accessible fax portal, AES-256 encryption of stored content is the expected standard.
The important caveat for evaluating fax platform encryption at rest is the question of what is actually being stored. Lane’s architecture destroys fax content after delivery rather than retaining it in a storage layer, which means the at-rest encryption question is largely moot because the PHI does not persist after transmission. For fax platforms that do retain content, AES-256 encryption of stored faxes is the minimum acceptable standard, and organizations should ask specifically whether encryption keys are managed by the vendor or customer-controlled.
HITRUST: The Healthcare-Specific Framework
The HITRUST Common Security Framework is a certifiable framework that incorporates HIPAA requirements alongside other regulatory standards into a unified security certification. HITRUST certification requires an independent assessment of an organization’s security controls against the CSF requirements, which makes it a more rigorous independent validation of security posture than self-attestation.
The etherFAX network, which underlies Lane’s Fax 2.0 and Passport platform, is HITRUST certified. For healthcare organizations that require vendors to demonstrate HITRUST certification as part of their vendor management program, this is directly relevant to fax platform evaluation.
HITRUST certification is not the same as HIPAA compliance, but it is an indicator that the vendor’s security controls have been assessed against a framework that incorporates HIPAA requirements, which provides a level of assurance beyond what a vendor’s self-certification provides.
What to Ask When Evaluating a Vendor
A practical encryption evaluation of a fax vendor should cover four specific questions. First, what TLS versions are supported and what cipher suites are in use? Second, is content destroyed after delivery and does that destruction use FIPS 140-2 compliant cryptographic methods? Third, for any content that is retained, what encryption standard protects it at rest and who controls the encryption keys? Fourth, has the vendor’s security implementation been independently assessed against HITRUST, SOC 2, or ISO 27001?
A vendor that can answer each of those questions with specificity is a vendor whose encryption implementation has been thought through. A vendor that responds with generic assurances about using “strong encryption” without specifying standards, versions, or independent validation is a vendor whose security posture deserves closer scrutiny before a contract is signed.
The post on how to evaluate an enterprise fax platform covers the broader evaluation framework that encryption sits within. The post on the difference between fax compliance and fax security addresses how encryption relates to the broader compliance posture that regulated organizations need to maintain.
Schedule a strategy call with the Lane team to discuss how Passport’s and Fax 2.0’s encryption architecture maps to your organization’s specific requirements.
