HIPAA Compliant Fax and Patient SMS Cost in 2026

HIPAA cloud fax is no longer a quote-only purchase. Checked 8 October 2026, five fax vendors publish a price for a plan that comes with a signed Business Associate Agreement, though the terms differ: two put the BAA on every plan, two only on a higher tier, and one signs it on request. Enterprise fax is still quoted per organisation. On the messaging side, Twilio publishes a per-message SMS rate whose products are HIPAA-eligible under a BAA, while most patient-engagement and provider secure-messaging platforms quote per practice. This page gives you the prices that exist, attributed to the vendor page that published them and dated, the arithmetic you can do on the published carrier rate, and a plain statement of which vendors publish nothing.

HIPAA-compliant fax: the published plans and the quoted rest

Every figure in this section was read on the vendor's own pricing or BAA page on 8 October 2026; no vendor's price is taken from a competitor's comparison table. SRFax publishes the longest ladder, priced on monthly page allowance, so it comes first on its own.

SRFax healthcare plans, read 8 October 2026. Pages are sent and received combined. Overage is $0.05 per page, falling to $0.045 and $0.04 on the two top tiers. The figures above are the monthly-billed rates; billed annually, Healthcare Lite is $128.40 a year ($10.70 a month). The healthcare page carries a “Request a BAA” form, so SRFax's BAA is signed on request rather than at sign-up.

Four more vendors publish a price for a plan that includes a signed BAA. Each is shown at its entry plan with a BAA, with the BAA terms the vendor states, in alphabetical order:

Read 8 October 2026 on each vendor's own pages: efax.com/pricing; faxpigeon.com/pricing and faxpigeon.com/baa; fax.plus/pricing; westfax.com/pricing. “Annual” is the per-month rate when billed yearly: eFax Business $399.96 a year, Fax Pigeon Basic $59.88, Fax.Plus Enterprise $959.99. The rows are not normalised, because billing cycle, page allowance and seat count differ by vendor; compare them on your own monthly pages and headcount. What each vendor publishes about its history and security is in a separate table below the quoted vendors.

The rest of the field either publishes a price without stating BAA terms beside it, or quotes:

Read 8 October 2026 on each vendor's own pricing and HIPAA pages.

What each fax vendor publishes about its history and security

These tables compare published prices, BAA terms and what each vendor publishes about its security and history. They are not a recommendation. Before choosing a vendor, check that its BAA covers the subcontractors that handle your faxes, and review its security documentation.

Read 8 October 2026, and taken only from each vendor's own site: its about or company-history page, its security or trust page, and its legal pages (for eFax, a Wayback Machine capture of efax.com taken that day, because the live site blocks reads from outside the US). “Operating since” is the year the vendor states, or the founding date in its site's company data; a copyright line is not counted. “None published” means we found no SOC 2, HITRUST or ISO 27001 claim on the vendor's site. “No” under subprocessors means we found no published list; a vendor may still name subcontractors in its BAA or privacy policy, or supply a list on request.

Patient SMS: the carrier rate is published, the platform is quoted

The message itself has a published price. Twilio's Programmable Messaging rate, read off twilio.com and read 8 October 2026 (unchanged since July): $0.0083 to send and to receive an SMS segment on a US long code or toll-free number, $0.022 to send an MMS, plus a monthly number fee ($1.15 long code, $2.15 toll-free) and carrier pass-through fees on top. Twilio's SMS and MMS products are HIPAA-eligible under a Business Associate Agreement on its Security or Enterprise Edition, contracted through sales rather than self-service. (Twilio's Programmable Fax product is not on Twilio's HIPAA-eligible list, so it is not a HIPAA fax option.)

A few patient-engagement platforms do publish a figure. Read each on its own unit; none is summed with the carrier rate above, because they are different purchases.

Vendor pricing pages, checked July 2026. Quote-driven, no published rate card: Klara, Solutionreach, Rhinogram, TigerConnect and OnPage each route to a demo or sales contact, so no per-practice or per-user band is printed for them here.

Provider-to-provider secure messaging

Clinician secure messaging (not patient-facing) is a separate category from patient SMS. TigerConnect, OnPage, Backline, Halo Communications and Symphony OnCall are the dominant platforms, and all are quote-driven: none publishes a per-user rate card this page could attribute, so no per-user figure and no organisation-wide total is printed here. What a hospital pays is set by user count, modules and integration depth in a quote. The HIPAA-relevant capabilities to evaluate are message-level encryption, audit logging under 45 CFR 164.312(b), message-recall, and automatic message expiration.

The TCPA + HIPAA stack for patient SMS

Patient SMS sits at the intersection of two regulatory regimes: HIPAA (PHI in the message body) and the Telephone Consumer Protection Act (the patient must have consented to receive the message). The HIPAA-compliant SMS platforms handle both:

HIPAA side: the platform executes a BAA, encrypts the message in transit between the platform and the carrier, encrypts at rest in the platform's archive, supports audit logging under 45 CFR 164.312(b), and supports retention under 45 CFR 164.316(b)(2)(i).

TCPA side: the platform tracks the patient's consent (when collected, by what mechanism, with what scope), supports opt-out via the standard STOP keyword, maintains an opt-out registry, and prevents sending to patients who have opted out.

Practices building their own SMS workflow directly on a carrier API (Twilio, Bandwidth, Vonage) pay the published per-message rate but must implement the consent tracking and the HIPAA-compliant archive themselves, which is substantial engineering that no vendor prices. For practices without a dedicated engineering team, a managed platform is usually the more cost-effective path despite the higher headline price. This is an informational cost reference, not legal or compliance advice. Consult a healthcare technology attorney about TCPA + HIPAA stack design for your practice.

HIPAA fax + SMS cost FAQ

Amended 8 October 2026. After a reader correction, the fax section was re-checked against every named vendor's own pricing and BAA pages. The eFax row now shows eFax Business, which carries a signed BAA; the eFax Protect plan this page cited in July is no longer listed on efax.com/pricing. WestFax, Fax.Plus and Fax Pigeon were added because each publishes a price for a plan with a signed BAA. The July statement that the rest of the cloud-fax field publishes no HIPAA rate card did not hold when re-checked and has been replaced. The patient SMS and secure-messaging sections were not changed, apart from re-reading Twilio's rates. Later the same day, a table was added showing, for every fax vendor on the page, the year it says it started operating, the security attestations it publishes and whether it publishes a subprocessor list, read from each vendor's own site.

Related cost guides