[nradov]

Allowance for using faxes to send protected health information (PHI) as defined under HIPAA was essentially grandfathered in for practical reasons, not because it is at all a secure enough communications system for sensitive data. If faxing medical records had been banned then the healthcare system would have come to a halt, which would have been worse then the privacy risk. But if fax was invented as something new today it would never be allowed for PHI.

It's only recently that more secure alternatives to faxing have become practical, like DirectTrust Secure Direct Messaging.