Originally published at ictfax.org
HHS has pushed final action on its HIPAA Security Rule overhaul to July 2027, more than a year past the May 2026 date it was aiming for. If you run open source fax server software that carries protected health information, that delay buys you planning time and nothing else. The Privacy Rule update is still expected in August, and it lands closer to your fax queue than the security overhaul ever did.
Two rules, two very different clocks. Only one of them slipped.
What actually moved in the federal agenda
The Office for Civil Rights had its proposed Security Rule rewrite sitting in the final rule stage, with final action pencilled in for May 2026. The updated agenda moves it into long-term actions instead. That reclassification is the part worth reading twice. Long-term actions is where rules go when nobody expects them inside the next twelve months, and a Davis Wright Tremaine read of the agenda flagged the same signal.
The proposal itself was not shy. It would have taken a pile of specifications that are currently addressable, meaning you can document why you skipped them, and made them flatly required: encryption of electronic PHI at rest and in transit, multi-factor authentication, a maintained asset inventory, network segmentation, and annual penetration testing. For a lot of small healthcare IT teams that was a genuine budget event. You can see why the comment file got heavy.
So the pressure came off, right? Not really. Here is the part that gets lost in the headlines.
Why the delay changes nothing for open source fax server software today
The Security Rule that exists right now is still enforced exactly as written. OCR did not suspend anything. It postponed replacing one rule with a stricter one, which means the current requirements, including the risk analysis obligation that shows up in a striking share of enforcement actions, are still the standard you get measured against if a breach lands on your desk.
There is a second reason to ignore the new date. Most of what the proposal wanted was already what any competent auditor expects to see. Encrypted disks. Accounts with real authentication in front of them. A list of the machines you own. If your hardening roadmap had July 2027 written at the top of it, that roadmap was wrong before the delay and it is still wrong now.
My honest read: the delay helps organizations that were going to be caught short on pen testing budgets, and it helps almost nobody else. A self-hosted fax server that handles PHI sits in the same risk bucket today that it sat in last month.
August is the deadline that should worry fax teams
While the security overhaul drifted, OCR kept the Privacy Rule update on the calendar for August, along with further rulemaking on health IT interoperability and certification. The stated goals are strengthening a patient's right to access their own records, improving information sharing for care coordination, and widening family and caregiver involvement during emergencies.
Read that through a fax lens and it gets concrete fast. Access rights come with turnaround clocks, and a large share of records requests still move over fax because that is what the requesting clinic or attorney's office can receive. When a request arrives, somebody has to find the document, confirm it went to the right number, and prove all of it later. A records clerk at a mid-sized clinic who needs three days to pull a transmission log is the whole problem in one sentence.
Interoperability rulemaking points the same direction. The agencies want data moving with fewer barriers, and fax keeps being the bridge between systems that were never designed to talk. That is not nostalgia, it is just what the install base looks like. Our take on fax over IP using the T.38 protocol goes deeper on how that bridge holds up on modern networks.
Self-hosting hands you four layers. That is control and liability in the same move.
The four layers you own when you self-host
Run your own fax server and the transport is yours to configure. You choose whether SIP signaling rides TLS, whether media is protected, and which carrier terminates the call. T.38 is worth being precise about here, because it solves reliability for fax over packet networks, not confidentiality. It is an error-correction story, not an encryption story, and teams conflate the two constantly.
Storage is the layer people underestimate. Every received fax becomes an image file and a database row, sitting on a disk you provisioned, under a retention policy you either wrote or forgot to write. Nobody sends you a reminder about the second one.
Access and audit round it out. You decide what sits in front of the login, and you keep the full transmission history rather than filing a support ticket to ask a vendor for it. During an access request or a breach investigation, being able to export your own logs the same afternoon is worth more than most feature comparisons will ever tell you.
A short list worth clearing before August
Put SIP signaling behind TLS and protect the media path. Unencrypted signaling on a network segment that touches PHI is the easiest finding an auditor will ever write up.
Turn on full-disk encryption wherever fax images and the database live, then write down where the keys are held.
Add multi-factor authentication at the reverse proxy or OS layer for anyone who can open a received fax.
Decide your retention period, then actually enforce deletion. Old faxes you never needed are pure breach surface.
Test a log export end to end and time it. If it takes longer than an afternoon, fix that before somebody asks under pressure.
Re-read the BAA with your fax carrier. The delay does not touch business associate obligations at all.
Refresh the risk analysis and date it. This is the single most cited gap in enforcement actions.
None of that requires the 2027 rule to exist. Most of it is a weekend of work for one competent sysadmin, and the ICTFax installation guide covers the base setup those controls layer on top of.
Where the self-hosting pitch deserves pushback
Self-hosting is not automatically the safer choice, and I would rather say that plainly than sell past it. An unpatched fax box in a wiring closet, running a kernel from three years ago, with one shared admin password, is worse than a cloud provider that employs people to think about this full time. Control is only an advantage when somebody exercises it.
The version of this that works looks boring: a documented owner, a patch cadence, monitored logs, and a restore you have actually tested. If your team can commit to that, owning the stack genuinely reduces the number of third parties standing between you and the PHI. If it cannot, be honest about it and buy the service instead. Teams building automated workflows on top usually start with the fax API tutorial, which is also where retention and logging decisions tend to get made by accident.
Frequently asked questions
Does the delay mean HIPAA encryption requirements are cancelled?
No. The proposed overhaul that would have made encryption explicitly required is what slipped. The existing Security Rule still applies, and encryption remains an addressable specification you must either implement or document a defensible alternative for.
When is the HIPAA Security Rule overhaul now expected?
Final action has been pushed to at least July 2027, and the rulemaking was moved from the final rule stage into long-term actions. Treat July 2027 as the earliest plausible date rather than a commitment.
What is changing in the Privacy Rule this August?
OCR still intends to finalize an update strengthening patient access rights, improving information sharing for care coordination, and expanding family and caregiver involvement during emergencies, with separate rulemaking planned on interoperability and certification.
Is open source fax server software HIPAA compliant?
Software by itself is never compliant or non-compliant. Compliance depends on how you deploy it: encryption, access control, audit logging, retention, a current risk analysis, and a signed BAA with any carrier that touches the traffic. Self-hosting gives you the ability to satisfy those, not a guarantee that you have.
Does T.38 encrypt fax transmissions?
It does not. T.38 exists to carry fax reliably across IP networks with error correction. Confidentiality has to come from the layers around it, typically TLS for signaling and a protected media path.
Should we wait for the 2027 rule before hardening?
Waiting is the expensive option. Nearly every control in the proposal is something auditors already look for, and the current rule is enforced today. Doing the work now spreads the cost and removes the deadline scramble later.
Related resources
Own the stack that carries your PHI
ICTFax is an open source fax server you install on your own infrastructure, which keeps the transport, storage, access and audit layers inside your risk analysis instead of somebody else's. Start at the ICTFax project home, or go straight to the download page and stand up a test server before the August rule lands. Questions about a healthcare deployment can go to our team through the support desk.
Top comments (0)