> My understanding is that there's a thing called the "conduit exception" which basically says that if data is transiently passing through a channel and it's not being looked at, it's ok. But wherever the data lands must be HIPAA-compliant.

Sounds like they needed fax to be compliant, and came up with some moon logic to make that happen.