HIPAA Compliant Fax and Patient SMS Cost in 2026

Two vendors in this category publish a real rate: SRFax posts a full healthcare fax ladder, and Twilio posts a per-message SMS rate whose products are HIPAA-eligible under a BAA. Almost everything else here, the patient-engagement platforms and the provider secure-messaging tools, is quoted per practice. This page gives you the prices that exist, attributed to the surface that published them and dated, the arithmetic you can do on the published carrier rate, and a plain statement of which vendors publish nothing.

HIPAA Fax, Published

SRFax from $12.60/mo

200 pages; BAA on request

Patient SMS, Carrier Rate

Twilio $0.0083/SMS

HIPAA-eligible under a BAA

Patient / Provider Platforms

Mostly quote-driven

Klara, Solutionreach, TigerConnect

HIPAA-compliant fax: the published ladder and the quoted rest

SRFax publishes a full healthcare plan ladder, priced on monthly page allowance. Every figure below is read off its own site and dated; SRFax states it signs a Business Associate Agreement on request at no additional charge.

SRFax healthcare plan	Per month	Included pages
Healthcare Lite	$12.60	200
Healthcare Basic	$16.05	500
Healthcare Basic Plus	$22.95	800
Healthcare Standard	$41.35	1,500
Healthcare Standard Plus	$68.95	2,500
Healthcare Professional	$137.90	5,000
Healthcare Professional Plus	$275.75	10,000
Healthcare Professional Premium	$551.55	20,000

SRFax healthcare plans, checked July 2026. Overage is $0.05 per page, falling to $0.045 and $0.04 on the two top tiers. Annual billing is discounted; the figures above are the monthly rates the page shows. eFax also publishes a HIPAA plan, eFax Protect, at $49.99 per month, checked July 2026; its pricing page renders client-side, so confirm the included page allowance there.

The rest of the cloud-fax field does not publish a HIPAA rate card. Checked July 2026, each of these routes buyers to a sales contact for the healthcare or BAA tier:

Vendor	What is published for the HIPAA tier
eFax Corporate	No enterprise rate. Contact sales for a quote (the consumer eFax Protect plan above is the only published HIPAA figure).
Sfax (Scrypt)	No published rate. Its site routes to “speak to a representative”.
Concord	No published rate. Demo request only.
RingCentral Fax	No standalone HIPAA fax rate; typically bundled into a quoted phone-service contract.
Updox	No published rate. Healthcare communications platform, quoted per practice.

Patient SMS: the carrier rate is published, the platform is quoted

The message itself has a published price. Twilio's Programmable Messaging rate, read off twilio.com and checked July 2026: $0.0083 to send and to receive an SMS segment on a US long code or toll-free number, $0.022 to send an MMS, plus a monthly number fee ($1.15 long code, $2.15 toll-free) and carrier pass-through fees on top. Twilio's SMS and MMS products are HIPAA-eligible under a Business Associate Agreement on its Security or Enterprise Edition, contracted through sales rather than self-service. (Twilio's Programmable Fax product is not on Twilio's HIPAA-eligible list, so it is not a HIPAA fax option.)

Our arithmetic, not a vendor price

At Twilio's published $0.0083 per SMS segment, 10,000 patient texts a month is $83 a month in message fees; 30,000 texts is $249. Add $1.15 a month per long-code number, before carrier pass-through fees. That is the carrier-level message cost only. It does not include the patient-engagement platform that manages TCPA consent, opt-outs and a compliant archive, which is a separate line the platform vendors quote per practice rather than publish. So the message layer prices exactly, and the platform layer needs a quote.

A few patient-engagement platforms do publish a figure. Read each on its own unit; none is summed with the carrier rate above, because they are different purchases.

Vendor	Published figure	Unit and note
Spruce Health	$24 - $49	Per user / month. Communication platform: SMS + voice + video
Weave	from $249	Per month per location, a floor; Pro plan. Rest is quote-driven
OhMD	from $300	Per month, Communicate plan; Automate from $500, Develop custom

Vendor pricing pages, checked July 2026. Quote-driven, no published rate card: Klara, Solutionreach, Rhinogram, TigerConnect and OnPage each route to a demo or sales contact, so no per-practice or per-user band is printed for them here.

Provider-to-provider secure messaging

Clinician secure messaging (not patient-facing) is a separate category from patient SMS. TigerConnect, OnPage, Backline, Halo Communications and Symphony OnCall are the dominant platforms, and all are quote-driven: none publishes a per-user rate card this page could attribute, so no per-user figure and no organisation-wide total is printed here. What a hospital pays is set by user count, modules and integration depth in a quote. The HIPAA-relevant capabilities to evaluate are message-level encryption, audit logging under 45 CFR 164.312(b), message-recall, and automatic message expiration.

The TCPA + HIPAA stack for patient SMS

Patient SMS sits at the intersection of two regulatory regimes: HIPAA (PHI in the message body) and the Telephone Consumer Protection Act (the patient must have consented to receive the message). The HIPAA-compliant SMS platforms handle both:

HIPAA side: the platform executes a BAA, encrypts the message in transit between the platform and the carrier, encrypts at rest in the platform's archive, supports audit logging under 45 CFR 164.312(b), and supports retention under 45 CFR 164.316(b)(2)(i).

TCPA side: the platform tracks the patient's consent (when collected, by what mechanism, with what scope), supports opt-out via the standard STOP keyword, maintains an opt-out registry, and prevents sending to patients who have opted out.

Practices building their own SMS workflow directly on a carrier API (Twilio, Bandwidth, Vonage) pay the published per-message rate but must implement the consent tracking and the HIPAA-compliant archive themselves, which is substantial engineering that no vendor prices. For practices without a dedicated engineering team, a managed platform is usually the more cost-effective path despite the higher headline price. This is an informational cost reference, not legal or compliance advice. Consult a healthcare technology attorney about TCPA + HIPAA stack design for your practice.

HIPAA fax + SMS cost FAQ

Why is fax still so prevalent in healthcare?

Healthcare relies on fax for three interoperability reasons. First, fax pre-dates the EHR transition and remains the lowest-common-denominator interoperability channel across the ambulatory ecosystem; specialty practices, referrals, imaging orders, and prior-authorization requests routinely route via fax because not all parties have FHIR-API integration. Second, the 45 CFR 164.524 right of access workflow for patient-requested records often defaults to fax for medical-records release. Third, the workflow inertia is real: front-office staff have years of practice with the fax-first workflow, and migration to portal-first or API-first requires investment in process change. The result is that even modern healthcare practices in 2026 maintain meaningful fax volume, and HIPAA-compliant fax is therefore a durable budget line.

How much does HIPAA-compliant fax cost, and who actually publishes a rate?

SRFax is the vendor in this category that publishes a full rate card. Its healthcare plans, checked July 2026 on srfax.com, run from Healthcare Lite at $12.60 per month (200 pages included) up through Healthcare Professional Premium at $551.55 per month (20,000 pages), with overage at $0.05 per page falling to $0.04 on the top tiers, and SRFax states it will sign a Business Associate Agreement on request at no extra charge. eFax also publishes a HIPAA consumer plan, eFax Protect, at $49.99 per month on efax.com; its pricing page renders client-side, so confirm the included page allowance there for your volume. Beyond those, the category is quote-driven: eFax Corporate, Sfax (Scrypt), Concord and Updox route buyers to a sales contact and publish no HIPAA rate card, so this page reports them as quote-only rather than printing a band nobody published. The driver of a fax bill is monthly page volume against the included allowance, so pick the tier by pages, not by headcount.

Does sending a fax over a regular phone line count as HIPAA-compliant?

Yes, generally. The Privacy Rule and Security Rule do not prohibit traditional analog fax transmission, and a fax sent across a phone line is not subject to the Security Rule transmission-security requirements that apply to electronic transmission, because traditional fax is not strictly ePHI in transit (the data is converted to audio tones for the transmission). However, fax misdirection (sending to the wrong number) is a recurring HIPAA incident type even on analog fax, and HHS OCR has resolved cases involving improperly disclosed PHI. Most healthcare practices use IP-fax or cloud-fax services in 2026 because the workflow is better and the audit trail is stronger, both of which reduce the risk of misdirection.

How much does HIPAA-compliant patient SMS cost?

Split the question into the message layer and the platform layer, because only the message layer has a published price. At the carrier level, Twilio publishes a per-message rate for Programmable Messaging: $0.0083 to send and to receive an SMS segment on a US long code or toll-free number, and $0.022 to send an MMS, checked July 2026 on twilio.com, plus a monthly number fee ($1.15 long code, $2.15 toll-free) and carrier pass-through fees on top. Twilio's SMS and MMS products are HIPAA-eligible under a BAA on its Security or Enterprise Edition, which is contracted through sales rather than self-service. The platform layer is the patient-engagement software that adds consent tracking, opt-out management and a compliant archive on top of the messages, and most of those vendors quote per practice rather than publish. The ones that do publish a figure: Spruce Health at $24 to $49 per user per month, Weave from $249 per month per location (a floor, with the rest quote-driven), and OhMD from $300 per month for its Communicate plan. Klara, Solutionreach, Rhinogram and TigerConnect publish no rate card and are quoted per practice.

What is TCPA and how does it interact with HIPAA?

The Telephone Consumer Protection Act (TCPA) regulates the use of automated dialing and text messaging in commercial communication. Healthcare communication has certain exemptions under the TCPA for health-related messages (appointment reminders, prescription notices), but the exemption is narrow and the patient must have provided their phone number for healthcare purposes. The HIPAA-compliant SMS platforms handle the TCPA opt-in tracking and consent management as part of the platform; this is one reason the platform layer costs more than bare carrier SMS. Practices building their own SMS workflow directly on Twilio or Bandwidth must implement TCPA-compliant opt-in tracking and a compliant archive themselves, which adds workflow engineering cost that no vendor prices.

What about HIPAA-compliant secure messaging between providers?

Provider-to-provider secure messaging (not patient-facing) is a separate category. TigerConnect, OnPage, Backline, Halo Communications and Symphony OnCall are the dominant provider-secure-messaging platforms, and their pricing is quote-driven: none publishes a per-user rate card that this page could attribute, so no per-user band is printed here. These platforms support clinician messaging, on-call scheduling, escalation workflows and EHR integration. The HIPAA-relevant features are message-level encryption, audit logging, message-recall capability and automatic message expiration. What a hospital pays depends on user count, modules and integration depth, and is set by a quote rather than by any published figure.

What were the most common fax-related HIPAA incidents?

Three recurring patterns. First, misdirected fax: a fax intended for a referring physician is sent to the wrong number, exposing PHI to an unrelated recipient. OCR has resolved cases involving improper PHI disclosure; the published enforcement record, with named amounts, is on the penalties page rather than summarized here as a band. The fix is automated confirmation of recipient before send, fax-number validation against the practice address book, and double-blind transmission for sensitive results. Second, leaving fax output unattended at the receiving end: PHI sits face-up in the receiving tray accessible to anyone walking by. The fix is receive-to-email or receive-to-portal workflow rather than physical printout. Third, cover-sheet PHI: practices print extensive cover-sheet detail (patient name, DOB, condition) that exposes PHI on the cover before the recipient even reads the body. The fix is minimum-necessary cover sheet design.

Related cost guides

HIPAA Email Cost

Paubox, Virtru, M365, Workspace

HIPAA Video Cost

Doxy.me, Zoom for Healthcare, Teams

Dental Practice HIPAA Cost

Weave, Solutionreach, Rhinogram context

Physician Group HIPAA Cost

Mid-size ambulatory pricing read

Business Associate Guide

BAA execution for communications vendors

Hospital HIPAA Cost

TigerConnect, OnPage at hospital scale