I suppose it has more to do with the opportunity for a significant breach. The healthcare provider's email system is a big target full of exploits. Fax is also HIPPAHIPAA compliant, email is not.

Probably a case of legislative inertia and tried-and-true practices. It's also a thing that's mostly limited to the US, I feel like. I want to say many other Western countries have digital systems in place (maybe not the BEST digital systems, but something better than fax).

Fax is not end-to-end encrypted. Not even sure it's encrypted in transit. But it is also something that doesn't rely on a third party provider storing all your data indefinitely and then losing it all in a data breach. Of course, that doesn't stop people from hooking up to a virtual fax service that might store info on a server... but still...