Point of fact, I'm not bobs_monkey, the originator of the rhetorical tone. Fax in healthcare continues to survive well past its prime because there is an inherent loophole: analog data transfer is functionally unsuited to encryption. This allows fax to be operated at a "best effort" level of security. There are handling protocols that are meant to keep traditional fax transmissions as private as possible, but these are layer 8 processes with limited enforceability. Beyond that, traditional fax represents a pathway around requirements on encryption while still meeting HIPAA compliance standards.

FOIP is an improvement, but it still allows for interoperability with a traditional fax machine connected to a POTS line in some GP's office that they're unwilling to part with. That means the FOIP user can only be confident of the transmission being secure on their side. I can't speak to the overall adaptation of FOIP in hospital systems, but I do know that there are non-isolated instances of hospitals still relying on traditional fax as opposed to adopting a cloud-fax solution. Hell, there are still major hospitals using SL-100s as their primary phone switches.

I don't even want to get into codec mismatches, because that falls out of scope when it comes to a privacy discussion.

Long story short, achieving HIPAA compliance is a low bar with regards to fax, and if that were to change I believe we'd see fax disappear (finally!) shortly thereafter.