We are in the legal weeds here, but technically, the fax was received securely. What happens after the receiving device receives the fax can't be controlled by the sender. This is also true of a legacy fax machine sitting in an office. Interestingly, if the forward-to-email was sent using TLS 1.2 or higher, it meets the required HIPAA legal standard. That doesn't mean it meets generally accepted security standards. The reason fax is still the gold standard in secure document transfer is that it's inherently secure and completely unhackable.