Fax and Legacy Telephony Security: Protecting Fax Servers, FoIP and Cloud Fax

Fax is still how many hospitals, pharmacies, law firms and courts move sensitive documents, and it is usually the least governed channel in the organisation. A misdialled number sends patient records to a stranger, an all-in-one printer with a fax line can be an unmonitored way into the network, and cloud fax services quietly turn faxes into email attachments stored by a third party. This guide covers the three forms fax takes today: analogue fax machines and multifunction printers, fax servers and fax over IP (FoIP), and cloud or internet fax. It explains the threats, the controls that matter for regulated sectors such as healthcare and legal, how to migrate away from analogue lines, and how to monitor fax as a data channel. It is for security, infrastructure and compliance teams; for wider voice and collaboration platforms, see the Unified Communications Security Guide.

Key takeaways

• Misdirection is the everyday risk: HHS gives confirming an unfamiliar fax number with the recipient and pre-programming frequently used numbers as examples of reasonable safeguards when faxing health information.
• The fax line is an attack surface: Check Point's 2018 Faxploit research showed that a single malicious colour fax, sent with only a phone number, could take over an HP OfficeJet all-in-one printer and pivot into the network (CVE-2018-5924 and CVE-2018-5925).
• Cloud fax is a data processor, not a phone line: HHS guidance is that a cloud provider storing electronic protected health information is a business associate needing a business associate agreement, even if it holds only encrypted data without the key.
• FoIP inherits VoIP weaknesses: T.38 fax relay over SIP is only as private as the signalling and media paths, so encryption, trunk authentication and segmentation decide the real protection.
• Analogue retirement forces decisions: in the UK, all PSTN-reliant devices need to be upgraded by January 2027, so every fax line and fax-capable device must be inventoried, migrated or switched off.

Where fax still lives and why it persists

Fax survives because it is legally familiar, works without shared identity infrastructure between organisations, and is built into clinical, pharmacy and court workflows. The NHS in England showed both sides: in December 2018 the government banned NHS purchases of fax machines from January 2019 and ordered them phased out by 31 March 2020, after a freedom of information request found more than 8,000 fax machines still in use, citing patient safety and cyber security. Secure email was the main replacement named. Many organisations elsewhere have no such mandate and still run fax at scale.

Threats to fax channels

• Misdirected faxes: wrong digits, outdated numbers in directories and auto-fill errors. This is the most frequent fax privacy incident in healthcare and legal settings, and the one HHS's safeguard examples address.
• Exposure at the device: pages left in shared trays, faxes stored in MFP memory or hard disks, and devices disposed of without sanitising storage.
• Malicious inbound fax: Faxploit used the ITU T.30 fax protocol with the colour (JPEG) extension. The printer stored the received data as a JPEG without sanitising it, and parsing bugs in the COM and DHT markers gave the attacker code execution. The researchers then showed the printer reaching a PC on the same network. HP published patched firmware on 1 August 2018 (security bulletin c06097712), and the researchers said they had not seen the attack in the wild but believed similar flaws were likely in other fax implementations. The technique maps to MITRE ATT&CK T1190 Exploit Public-Facing Application in spirit, since the fax number is the exposed interface.
• Fax server compromise: fax servers bridge the phone network to email, file shares and clinical systems through service accounts. A compromised server exposes its archive and those credentials.
• Interception in FoIP: unencrypted SIP and RTP or UDPTL streams on shared networks can be captured and reassembled into pages.
• Cloud fax account takeover and phishing: fax-to-email delivery trains staff to open attachments that look like faxes, which attackers imitate (T1566 Phishing). A taken-over cloud fax account exposes stored history.
• Toll fraud and abuse: fax lines and FoIP trunks can be abused for premium-rate calls when gateways are left with default credentials. See the VoIP and SIP Security Guide.

Controls for fax machines and multifunction printers

For the wider device estate, see the Printer and Print Server Security Guide.

Securing fax servers and fax over IP

• Patch and reduce the server: treat the fax server as an internet-adjacent application. Remove unused connectors, restrict the web console to an administrative network, and enforce multi-factor authentication for administrators.
• Service accounts and integration credentials: fax servers authenticate to mail systems, EHR interfaces and file shares. Give each integration its own least-privilege account, store credentials in a vault and rotate them. See the Secrets Management Guide.
• Transport encryption for FoIP: ITU-T T.38 defines "Procedures for real-time Group 3 facsimile communication over IP networks" (the in-force edition is from November 2015). It does not by itself encrypt anything: protect SIP signalling with TLS and keep trunks on private links or encrypted tunnels to the carrier, and confirm what your carrier supports.
• Gateway hygiene: analogue telephone adapters and session border controllers need unique credentials, firmware updates, management on a separate VLAN and call restrictions that block international and premium-rate destinations from fax trunks.
• Archive governance: fax servers often keep every page indefinitely. Apply retention schedules, encrypt the archive at rest and log every access. See the Data Retention and Secure Deletion Guide.

Cloud fax: what to check before you rely on it

Cloud fax replaces phone lines with a provider that receives faxes, converts them and stores or emails them. That changes the risk from line security to third-party data processing and account security.

For evaluating the provider's assurance reports, see the How to Read a SOC 2 Report Guide.

Regulated sectors: healthcare and legal

• Healthcare (US): HIPAA permits faxing protected health information for treatment with reasonable safeguards, and HHS's examples are confirming unfamiliar numbers and pre-programming frequent ones. Fax servers and cloud fax holding electronic PHI fall under the Security Rule's technical safeguards, and cloud providers need a business associate agreement. A misdirected fax can be a reportable breach under the breach notification rule after a risk assessment. See the HIPAA Security Rule Guide and the HIPAA Breach Notification Rule Guide.
• Healthcare (England): NHS organisations were required to stop buying fax machines from January 2019 and phase them out by 31 March 2020, in favour of secure email and interoperable digital services.
• Legal and courts: firms still fax to courts and opposing counsel. Treat fax confirmation reports as records, use cover sheets with confidentiality notices, and route inbound faxes to matter folders with access control rather than shared trays.
• Downtime planning: clinical teams often keep fax as a fallback when the EHR is down. If fax is part of a downtime procedure, test it and keep numbers current. See the Clinical Downtime and EHR Downtime Procedures Guide.

Migrating off analogue lines

UK government guidance says all PSTN-reliant devices need to be fully upgraded by January 2027 and advises contacting suppliers to check whether equipment will work on a digital line. Fax is notoriously sensitive to this change, so use the migration to reduce fax rather than replicate it.

1. Inventory: list every fax number, device, MFP with a fax card, fax server and cloud fax account, with owner, business process and monthly volume (ID.AM-01, ID.AM-02).
2. Classify by need: retire numbers with no traffic; for the rest, record who sends to them and whether a secure digital alternative (structured messaging, secure email, portal) exists.
3. Pick the target: on-premises FoIP through a session border controller, or a cloud fax provider that passes the checks above.
4. Pilot: move one department, test inbound and outbound with frequent partners, check page quality and confirmation reports, and verify logs reach the SIEM.
5. Roll out in waves: keep analogue lines for each wave until two weeks of clean traffic, then port numbers and disconnect.
6. Rollback: keep the porting plan reversible during each wave and retain one tested analogue or alternative path for clinical downtime until the digital path has proven itself.
7. Decommission: disable fax on devices, sanitise storage and update directories so partners stop using old numbers.

Decision guidance

• Low volume, few partners: replace fax with secure email or a portal and keep a single cloud fax number for stragglers.
• High clinical volume with EHR integration: a fax server or cloud fax integrated with the EHR is usually safer than desk machines, because it gives logging, routing and access control.
• Strict data residency or air-gapped sites: on-premises FoIP with encrypted trunks keeps content in-house, at the cost of patching and running the platform yourself.
• Small practices: a reputable cloud fax service with SSO, MFA and a signed agreement often beats an unmanaged machine at reception. See the Cyber Security for Dental and GP Practices Guide.

Detection and measurement

Log fax like email: sender, recipient number, page count, user, time and result, from the fax server, cloud portal or MFP journal, forwarded to the SIEM (AU-2, AU-6).

• New external numbers: alert when a user sends PHI-classified documents to a number never used before.
• Forwarding rule changes: alert on any change to fax-to-email or fax-to-folder routing on MFPs and servers.
• Bulk sending: unusual page counts or out-of-hours volume from a single user.
• Admin access: logins to fax server consoles and gateways from outside the admin network.

Framework mapping

Common failure patterns

• Nobody owns fax: lines sit on facilities budgets, MFPs with IT, and the content with clinical or legal teams, so no one patches, logs or retires them.
• Fax cards left enabled on every MFP: the device that only needed to print now answers calls from anyone with the number.
• Cloud fax bought by a department: no agreement, no SSO, inbound faxes emailed to a shared mailbox with years of history.
• Stale directories: referral and pharmacy fax numbers change and old ones get reassigned, so faxes go to whoever now holds the number.
• Treating FoIP as private by default: T.38 over unencrypted SIP on a flat network is as readable as any other unencrypted traffic.
• Like-for-like migration: moving every analogue line to a digital equivalent during the PSTN switch-off without asking which ones are still needed.

Practitioner checklist

• Inventory every fax number, device, fax server and cloud fax account with an owner and a business purpose.
• Disable fax on every MFP that does not need it and remove unused lines.
• Patch MFP and fax server firmware on the normal vulnerability cycle and isolate them in a printer segment.
• Pre-programme frequent recipients and require confirmation for new numbers.
• Turn on secure receive or route inbound faxes to access-controlled folders or the EHR.
• Sign a business associate or processor agreement with any cloud fax provider and enforce SSO and MFA.
• Put fax server and cloud fax integration credentials in a vault and rotate them.
• Encrypt SIP signalling for FoIP and block premium and international destinations on fax trunks.
• Forward fax logs to the SIEM and alert on new numbers and forwarding rule changes.
• Use the PSTN switch-off to retire fax numbers that have digital alternatives.

Standards and references

• HHS: HIPAA FAQ on sharing patient information by phone, fax and email
• HHS: Guidance on HIPAA and Cloud Computing
• ITU-T: Recommendation T.38, real-time Group 3 facsimile over IP networks
• UK Government: Health and Social Care Secretary bans fax machines in NHS
• UK Government: Transition from analogue to digital landlines
• Check Point Research: Faxploit, sending fax back to the dark ages
• NIST: SP 800-53 Rev. 5
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Unified Communications Security Guide · VoIP and SIP Security Guide · Printer and Print Server Security Guide · HIPAA Security Rule Guide