> What's the attack surface of an email vs fax?

I believe the primary concern has been while the message is in transit, unencrypted routing over the internet vs. unencrypted over the phone line.

It's a current requirement. (Source: I'm adjacent to a doctor's office.) Two big advantages of faxes are that 1) they're point-to-point, and 2) there's zero caching between the sender and receiver.

If everyone had a fax machine such that you'd commonly get a working fax receiver if you mis-entered the recipient's number, then #1 wouldn't be such a big deal. But in reality, if you enter a fax number, and the other end actually answers and responds with a screech, it's extremely likely that you're connected to the right party. (Also, I bet 99% of modern faxing is triggered by a nearby computer, or by pressing one of the preprogrammed speed dial buttons on the fax. There aren't that many opportunities to misdial the number in the first place.)

That second is also a big deal. There are no intermediate servers which may be caching and inappropriately storing the data, except maybe the NSA, but what can ya do. The sender may have a cache, in the form of a print spooler. The receiver may have a cache where it temporarily stores inbound faxes and prints them asynchronously. But since both of those devices are owned and controlled by the parties in the communication, that's not a legal issue.

I'm not advocating for faxes. They're a slow, clunky, lossy, pain in the ass. And yet, they do have specific properties that are pretty sweet. I guess the equivalent would be if I could ask you to send a PDF to my specific IPv6 address, and you could peer-to-peer shoot it directly to me. If I typoed the address at all, it's statistically "unlikely" that another person would be listening on that specific IP a that specific time. And if it were truly P2P, then you and I would be the only 2 who ever touched the file, except maybe the NSA, but what can ya do. Alas, I don't see that replacing fax machines any time soon.