EHR Fax Integration — Using Our REST API and Webhooks
There is no native Send FAX Mail module inside Epic, Cerner, athenahealth, or any other EHR, and we do not claim one. What works is connecting your EHR — or the interface engine in front of it — to our REST API and outbound webhooks. Your system POSTs a document to /v1/faxes when a referral, order, or record needs to go out, and it registers an endpoint to catch our fax.delivered, fax.failed, and fax.received events. Because clinical faxing carries PHI, this pairs with our HIPAA handling: on HIPAA-tier plans inbound fax PDFs are never emailed, and covered entities that transmit PHI sign a BAA before sending.
Plan requirement
The REST API and webhooks this depends on are part of the Business ($79.99/mo) and Enterprise ($169.99/mo) plans, both of which include HIPAA terms. A covered entity that transmits PHI must e-sign a BAA before sending and before provisioning a number; those attesting they do not transmit PHI are exempt. Keys on lower plans are refused at request time with a 403.
How it works
Most EHRs cannot call an arbitrary API directly, but the interface engine or integration layer in front of them (an HL7/FHIR gateway, a middleware bus, or a custom service) can. That layer makes an authenticated POST to /v1/faxes with your bearer key, the recipient number, and either inline base64 or a public document_url pointing at the generated document. The response carries a fax id you write back to the chart or work queue. For status, you register an endpoint at /dashboard/developers and subscribe it to fax.delivered, fax.failed, and fax.received; each event is HMAC-signed so your integration can verify it before updating the record. Sends run the same gated pipeline as the dashboard, so quota, number, and BAA rules all hold — nothing bypasses HIPAA controls.
What you can do
- ✓Send a referral, order, or record to /v1/faxes from your EHR's interface engine
- ✓Write the returned fax id back to the chart or a work queue for tracking
- ✓Receive fax.delivered / fax.failed / fax.received into an endpoint you host
- ✓Keep PHI out of email: HIPAA-tier inbound PDFs are delivered only in the authenticated dashboard
- ✓Gate sending behind a signed BAA for covered entities that transmit PHI
- ✓Verify the X-SFM-Signature HMAC before trusting any inbound status event
Setup steps
- 1Put the account on Business or Enterprise and, if you transmit PHI, e-sign the BAA at /dashboard/compliance
- 2Create an API key at /dashboard/developers with faxes:send (add faxes:read to poll status)
- 3Have your interface engine POST the generated document to /v1/faxes with the recipient number
- 4Store the returned fax id against the chart, order, or referral it came from
- 5Register a status endpoint at /dashboard/developers and subscribe to the fax events
- 6Verify each event's X-SFM-Signature, then reconcile the status back onto the record
Example
POST /v1/faxes (from your interface engine)
Authorization: Bearer sfm_live_xxxxxxxx
Idempotency-Key: referral-778120
Content-Type: application/json
{
"to": "+15551234567",
"document": { "content": "JVBERi0xLjQK...", "content_type": "application/pdf" }
}EHR Fax Integration — FAQ
No. We do not ship a module that installs into Epic, Cerner, athenahealth, or any other EHR, and we will not pretend to. The integration is built by connecting your EHR's interface engine or middleware to our REST API and webhooks — the same way you would wire any external HTTP service into a clinical system.
On HIPAA-tier plans, inbound fax PDFs are never attached to email — the recipient gets a notification with a link and downloads inside their authenticated session. Outbound sends run the gated pipeline, and covered entities that transmit PHI must sign a BAA before sending or provisioning a number. The API path does not weaken any of those controls.
Through whatever component can reach an external endpoint — typically an HL7/FHIR interface engine, an integration bus, or a small service you run alongside the EHR. That component holds the bearer key and POSTs the document to /v1/faxes. The EHR itself does not need to speak HTTP; it just needs a layer in front of it that can.
Register a webhook endpoint at /dashboard/developers and subscribe it to fax.delivered and fax.failed. Each event arrives HMAC-signed with X-SFM-Signature; verify it, match the fax id back to the referral or order you stored, and update the chart or work queue. That closes the loop without polling every fax.
Build with the EHR Fax Integration
API access and webhooks are included on the Business and Enterprise plans. Create a key at /dashboard/developers and start sending.
7-day free trial · No credit card required