Inbound fax that appears as email is how most offices finally leave the machine. The failure mode is a catch-all mailbox named "fax@" that everyone knows the password to.
Design the workflow on purpose
- Land faxes in a HIPAA inbox, not a consumer account.
- Assign an owner for triage (referrals vs records vs billing).
- File or forward inside the same system so the log stays intact.
- Never auto-forward the catch-all to personal mail.
Outbound should match inbound
If you receive by cloud fax, send by cloud fax. Mixed analog outbound recreates the hallway pile. HIPAA Companion secure fax and healthcare email are meant to be two views of one program: packets still move the way hospitals expect, and the practice still has encryption plus a confirmation.
Review the catch-all account in your user list the same day you review terminated employees. Shared fax inboxes are where access lives forever.