They might have not considered this to be a big enough business opportunity when they penned this section.
It isn't the business opportunity that is the problem (that is huge), it is the all of the HIPAA/HITECH regulations which creep into every part of your business that is the limiting factor.
Faxing is a transport service... is the concern around security and privacy while en route from the API to the destination?
If there was a way to facilitate that transfer without compromising privacy or security en route would that address HIPAA concerns?
We've developed a privacy preserving trust relay protocol which might be applicable to use cases like this that's why I am asking: https://www.cipheredtrust.com/
But everyone trusts fax since it goes over "secure" voice lines.... even though in many cases it doesn't.
You would facilitate that transfer by having both parties of business associates/covered entities entering a legally binding business associates agreement to outline how PHI would be protected.
Scrypt is a company that does faxing in the health tech space today and they sign BAAs and went through a HITRUST assessment.
EDIT:
So, maybe let me clarify what I mean about facilitating that transfer of data.
So, let's say there is:
Vendor ----> Health Care Provider
Even if you are sending data over TLS or some other encrypted protocol, the Vendor and the Health Care Provider need to have an agreement to protect patient data and which restrict what can be done with the PHI being transmitted. If you add a new party to this equation, like:
Vendor ----> Twilio ----> Health Care Provider
Even if you encrypt the data to Twilio and Twilio "promises" to not store the data and promises to encrypt the data when sending it down stream, promises aren't good enough in the eyes of HIPAA/HITECH. You need to have an agreement in place like a Business Associates Agreement in which all parties agree to protect PHI. You can read more about what these agreements commonly outline here: https://datica.com/academy/business-associate-agreements/
There are exceptions to this referred to as the "Conduit Exception" of HIPAA which were clarified in 2013. This doesn't really apply to API vendors or someone like cloudflare. It applies more to phone carriers, postal services and ISPs.
It's a complex topic, but I can keep jamming to discuss some of the nuances.
Of course there may be other caveats that I am not aware of, I don't know much about HIPAA.
EDIT:
You don't need to trust twilio (or any intermediary)...You can transmit encrypted information end-to-end without any risk that the intermediary can access it. That is the solution we've created with our API, you can see the full docs here: https://www.cipheredtrust.com/doc/
HIPAA cares deeply about the logistics, which is what the privacy, security, breach notification, etc. rules largely address. The logistics just don't come into play until after the determination that you are a business associate and therefore required to sign a BAA and comply with the rules.
http://www.hitechanswers.net/when-does-the-hipaa-conduit-exc...
Practically though there isn't a 'good enough' standard from an end user perspective. The very things that make FAX a poor security standard make it user friendly.
* Fire and forget
* 'Just works'
* Short, simple destination identifier
* No real crypto or other security.
The next best thing is FTPS, but that has account management issues (since if you were doing client certs, which are an option here as well, you'd just use SFTP).
What makes both of those harder are the lack of integration in to the existing infrastructure (clinics/hospitals don't have, E.G., WinSCP / FileZilla and/or another SFTP client already setup and in their whitelist of allowed software) and having end user accounts.
Ah also, SFTP has the benefit of transferring time-stamps correctly. FTP, even wrapped in a TLS connection, still doesn't have a standards approved way of transmitting file time-stamps.
HIPAA (and a broad swath of other tech legislation) is not necessarily indicative of actual security. For example, HIPAA-compliant hospitals are currently seeing a rash of ransomware attacks; any meaningful definition of computer security would include defenses against these kinds of things. HIPAA is domain-specific policy with a poor understanding of the domain. That's (in no small part) a bilateral educational failure; technology makers don't understand policy and policy makers don't understand technology.
Now you have to store all of these faxes encrypted at rest, log who has accessed any of the files and why they needed access, always transmit over https, safeguards to ensure high availability, the list goes on and on. Surprisingly HIPAA/HITECH does not have an authority or a checklist by which you can guarantee compliance. That designation is solely determined by the covered entity or their business associates since the rules allow for a lot of leeway in implementation. Due to this ambiguity a lot of people will forego the healthcare field entirely which causes crazy prices for what I think are relatively simple services.