Fax or secure messaging: which channel should you choose?

Short answer: there is no universally superior channel, but there is a four-criteria decision framework — is the recipient listed in a directory somewhere? does the document contain sensitive data? do you need to prove sending or receipt? is it urgent? Online fax wins when the recipient can only be reached through a number and you need an immediate time-stamped record. Secure health messaging (MSSanté) wins as soon as both parties are registered healthcare professionals: it is encrypted, authenticated and legally enforceable. Ordinary email almost always loses whenever professional secrecy is at stake. Qualified electronic registered delivery (ERE) wins when proof of receipt by an identified person determines a legal deadline. And the dedicated exchange platform (bank extranet, court registry portal, insurer's customer area) wins whenever it exists: it beats everything else because it bundles identity, encryption and traceability into a single action. The real mistake in 2026 is not still using fax: it is having only one channel and making it carry situations it was never designed for.

The problem isn't fax, it's the single reflex

In most of the practices, law firms, pharmacies and small businesses we come across, the choice of channel is not the result of any decision: it is the result of habit. The front desk faxes because faxing is what has always been done. The junior colleague sends an email because they have never seen a fax machine. Both are wrong one time out of three.

A document transmission channel delivers four distinct services, and it is rare for a single tool to deliver them all:

1. Delivery — the document reaches the right person, legibly.
2. Confidentiality — no one else reads it in transit or on arrival.
3. Proof — you can demonstrate later that, on a given day at a given time, specific content was sent and/or arrived.
4. Usability — the recipient can genuinely work with the file received (selectable text, intact attachments, no photocopy of a photocopy).

Fax excels at 1 and 3, holds its own at 2 when it is dematerialised, and fails fairly clearly at 4. Email excels at 1 and 4, and fails at 2 and 3. There is no moral judgement here: just profiles. The whole point is not to entrust a channel with the service it cannot provide.

The six channels in contention, without wishful thinking

1. Traditional fax (machine + line)

It now runs over voice over IP, since the switched telephone network has been progressively shut down in France. The practical consequence: a machine plugged into a router proves more temperamental than before, with speed negotiation failures and truncated pages. Confidentiality is also poor by design — the document comes out in the clear into a tray, sometimes in a corridor. For those still committed to it, a cross-cut shredder placed next to the device is the bare minimum, because it is the intermediate paper, not the transmission, that leaks most often. We cover this transition scenario in detail in our feature on the end of the PSTN and analogue fax lines.

2. Online fax (fax-to-mail)

The same protocol on the recipient's side, but no document left in a device's memory: sending starts from a browser or an app, and reception lands in an inbox. You gain three things that matter legally — a transmission report stored on the server side, reliable time-stamping, and the disappearance of the paper tray. This is today the most defensible form of fax.

3. Ordinary email

Transport is often encrypted in transit (TLS), but the message is stored in the clear at both ends, copied into drafts, indexed, synchronised onto phones. No proof of receipt. The Commission nationale de l'informatique et des libertés (CNIL) consistently points out that transmitting sensitive data via unprotected messaging exposes the data controller; it recommends, at a minimum, encrypting the attachment and sending the password through a separate channel.

4. Email with an encrypted attachment

The pragmatic compromise: an archive protected by a strong password, with the password communicated by phone or text message. Inelegant, but genuinely effective, and understood by any recipient without prior registration. Limitation: nothing proves who opened what.

5. Sector-specific secure messaging

In healthcare, MSSanté — operated within the framework set by the Agence du numérique en santé — authenticates professionals via their CPS card or an e-CPS, encrypts exchanges and relies on a national directory. When both parties are listed there, there is no reason whatsoever to fax. Equivalents exist elsewhere: professional virtual private networks between lawyers, court registry filing platforms, tax administration portals.

6. Qualified electronic registered delivery

Governed by the European eIDAS Regulation and, under French law, by Article 1126 of the Civil Code and its implementing decree, it is equivalent to paper registered mail when provided by a qualified service provider — the European trusted list allows you to check this. It is the only channel that natively produces proof of receipt attached to a verified identity.

Comparison table: what each channel really guarantees

Read this grid backwards: it explains why fax survives. It is the only row, along with email, where the "recipient must register" column answers no. In an ecosystem where you do not control the other party's equipment — a thirty-bed care home, a rural medical practice, a foreign administration — that "no" is worth more than all the cryptographic guarantees in the world.

The four-question decision framework

Apply it before every sensitive transmission. It takes ten seconds and prevents almost every incident.

Question 1 — Does the recipient have a sector-specific channel I can verify? If so, use it. A professional directory consulted in thirty seconds replaces three rounds of back-and-forth and a potential leak. In healthcare, check the address in the MSSanté directory before assuming it doesn't exist.

Question 2 — Does the document contain sensitive data within the meaning of the GDPR? Health, sexual orientation, criminal convictions, trade union membership, biometric data: in these cases, ordinary email is out of the question, full stop. You choose between secure messaging, online fax and an encrypted attachment.

Question 3 — Is a legal deadline at stake? Notice periods, formal demands, withdrawal rights, appeals, insurance claims: if the date of receipt determines a right, only registered delivery — paper or qualified electronic — protects you. A fax transmission report proves that a call went through, not that an identified person became aware of the content. We explore this nuance in our article on the evidential value of fax before a judge.

Question 4 — Is the urgency real? An on-call emergency at 3 a.m., a patient transfer, a document to produce before a hearing that is about to start: the channel that works immediately without creating an account wins. This is typically the online fax scenario.

Four concrete scenarios, and the winning channel

Sending a hospital discharge summary to the patient's GP. MSSanté, without hesitation — national directory, encryption, integration with practice software. Fax only comes into play if the practitioner isn't listed there, which is becoming rare.

Sending a formal demand to a defaulting supplier. Qualified electronic registered delivery, or paper registered mail. Fax won't do: you will not prove receipt. If you also send a fax for psychological effect, keep both pieces of evidence.

Submitting a rental application to a landlord who only accepts fax. Online fax, with one caveat: scan quality determines whether the application is accepted. A badly framed phone photo produces an illegible fax. A portable sheet-fed document scanner solves the problem in two minutes for a dozen pages, and the files remain usable for the next procedure.

Sending a procedural document to a colleague with no equipment. Email with an encrypted archive, password sent by phone. If the volume is regular, a hardware-encrypted USB drive handed over in person at a hearing remains, paradoxically, one of the safest methods in existence.

Build a two-channel setup, not a single-channel one

The right target for an organisation of fewer than fifty people is neither "all fax" nor "zero fax". It is a primary channel (secure messaging or a sector platform) and a universal fallback channel (online fax), with a written rule stating which applies when.

Three conditions for this to hold:

• A single archiving point. Transmission reports, application-level acknowledgements, electronic registered delivery receipts: everything goes to the same place, attached to the relevant case file. A two-channel setup with two separate archives produces, three years later, the impossibility of finding anything at all. See our recommendations on fax archiving and evidential value.
• A one-page procedure note. Who decides, on what criteria, and what happens in the event of failure. A lever arch file with dividers kept next to the sending workstation, with the four-question grid printed on the first page, does more for compliance than any annual training session.
• An annual review. Directories fill up, obligations evolve, operator contracts change. A fallback channel that hasn't been tested for two years is not a fallback channel.

For organisations that want to understand the legal foundations rather than follow recipes, the guides from the Conseil national du numérique en santé and the CNIL's practical fact sheets remain free and up to date; on the doctrinal side, a recent handbook on the law of digital evidence will spare you many misunderstandings about the difference between a copy, an original and a reliable copy.

Frequently asked questions

Will secure messaging make fax disappear?

It marginalises fax, it does not eliminate it. As long as there are recipients outside the directories — medico-social organisations, colleagues abroad, older administrations — a channel requiring no registration will retain some usefulness. The realistic trajectory is a residual, dematerialised fax accounting for a few percent of flows.

Does an email read receipt count as proof of receipt?

No. Read receipts can be disabled by the recipient, are easily falsified and have no standalone evidential value. Only acknowledgements produced by a qualified electronic registered delivery provider, or by an authenticated sector-specific messaging service, carry serious weight before a judge.

Can health data be sent by online fax without breaching the GDPR?

Yes, subject to conditions: certified health data hosting where the provider stores the data, encryption of flows, a processing agreement compliant with Article 28 of the GDPR, a limited retention period and access logging. The channel is not prohibited; it is the provider you must choose carefully.

Should a fax be backed up with an email?

Only if it serves a specific purpose: confirming proper receipt, sending a usable version of the file, or alerting a recipient who doesn't check their tray. In that case, the email must not repeat the sensitive data — it flags the transmission, it does not duplicate it.

Is electronic registered delivery accepted everywhere?

It is legally equivalent to paper registered mail, but some procedures still explicitly require postal delivery, and some recipients refuse to identify themselves online. Check the applicable text before switching, particularly in tenancy and employment law matters.

In summary

• No channel is good in itself: four criteria decide — directory availability, data sensitivity, need for proof of receipt, urgency.
• Online fax remains the best universal fallback channel: no registration required from the recipient, a time-stamped record, and no more paper left waiting.
• Sector-specific secure messaging should become the primary channel as soon as both parties are listed in it.
• For legal deadlines, only qualified electronic registered delivery or paper registered mail offer real protection.
• Ordinary email must be ruled out for any sensitive data; with an encrypted attachment and an out-of-band password, it becomes acceptable again.
• A sound setup combines two channels, a single archive, a one-page written procedure and an annual test.