Online fax for a medical billing company: the BAA chain and price

A billing company of 5 people sending and receiving 1,000 pages a month pays $16.99 a month billed annually for HIPAA fax with a signed BAA on Fax Pigeon Plus, against $29.50 at SRFax, $54.16 at eFax Business and $93.29 at iFax; a 10-person office pays the same $16.99.

What online fax service should a medical billing company use?

Fax Pigeon has the lowest price with a BAA for a medical billing company among SRFax, eFax, iFax, Fax.Plus, WestFax and Sfax, with Plus at 1,000 pages a month and Pro at 2,000. Billers, coders and credentialing staff join at no added cost. The company can read the BAA at faxpigeon.com/baa before paying and signs it during sign-up, and its paid plan sends and receives from the company's own number.

Fax Pigeon has no team plans, since every plan includes unlimited people. Fax Pigeon is HIPAA-compliant online fax for practices of any size, from solo practices to teams of 100 or more. Dental billing services, coding and revenue cycle vendors, practice management companies and answering services that handle a practice's PHI hold the same place in the BAA chain below.

Does a billing company need its own BAA with its fax service?

A billing company needs its own BAA with its fax service, because HIPAA makes the billing company a business associate and HHS says a business associate must establish a BAA with its subcontractor before disclosing PHI to it.

45 CFR 160.103 defines a business associate as a person who creates, receives, maintains or transmits PHI for a regulated function, and its list includes claims processing, billing and practice management. The same definition makes a subcontractor that handles PHI for a business associate a business associate too. Under 45 CFR 164.502 and 164.308, the billing company may let a subcontractor handle PHI only after obtaining satisfactory assurances documented in a written contract. 45 CFR 164.504 holds that contract to the same requirements as a covered entity's agreement with its business associate.

A covered practice is not required to sign with its business associate's subcontractors. 45 CFR 164.502 says a covered entity is not required to obtain satisfactory assurances from a business associate that is a subcontractor, and the American Dental Association calls that agreement the business associate's responsibility.

Downstream subcontractors are business associates too, contractually responsible for the terms of their BAAs, and HHS's direct-liability fact sheet lists a business associate's failure to enter a BAA with a subcontractor that creates or receives PHI for it among the violations it is directly liable for. What a business associate is and whether you need a BAA with your fax service go further.

Is a credentialing company a business associate?

A credentialing company is a business associate only when it handles protected health information for a covered entity or for another business associate. HIPAA counts credentialing activities among a covered entity's health care operations (45 CFR 164.501). 45 CFR 160.103 also lets a covered entity be a business associate of another covered entity. Its definition of a health care clearinghouse names a billing service among the entities that process health information into or out of standard transactions.

The table sets out each link in the chain and the rule behind it.

What does a billing or credentialing office fax?

A billing or credentialing office faxes claims attachments, appeals, records and provider updates to payers, and HHS's March 24, 2026 final rule says the exchange of claims attachments has remained largely manual, frequently relying on fax, mail or portal uploads. That rule requires its electronic attachment standards by May 26, 2028.

UnitedHealthcare's 2026 administrative guide has a practice, or the delegate that handles its credentialing, report changes to provider information at least 30 calendar days before they take effect.

CMS's Identity and Access system names billing agencies and credentialing consultants as third-party organizations that work on providers' behalf. One can act as a surrogate that accesses, views and modifies information in CMS computer systems for a provider, through a connection that covers the systems the provider approves. A connection does not expire once approved, and either party can remove it at any time (CMS FAQs).

What has HHS fined for missing business associate agreements?

HHS has settled with Raleigh Orthopaedic Clinic for $750,000 and with Advanced Care Hospitalists for $500,000 over PHI shared without a business associate agreement, and with the billing company Comstar for $75,000 after a ransomware breach.

Raleigh Orthopaedic Clinic settled charges that it handed PHI for about 17,300 patients to a potential business partner without first executing a business associate agreement. Its settlement includes keeping BAA documentation for at least six years after a business associate relationship ends. HHS's page on Advanced Care Hospitalists is headed that the Florida contractor physicians' group shared PHI with an unknown vendor without a business associate agreement, and the group agreed to a corrective action plan with its payment.

Comstar, a Massachusetts company that bills for non-profit and municipal ambulance services, was a business associate of over 70 covered entities when a ransomware breach affected 585,621 individuals. OCR found it had failed to conduct an accurate and thorough risk analysis. Comstar paid $75,000 and agreed to a corrective action plan that OCR monitors for two years, and OCR's recommendations include encrypting ePHI in transit and at rest.

What does HIPAA fax cost a billing office of 5 or 10 people?

A billing office of 5 or 10 people pays Fax Pigeon $16.99 a month billed annually for 1,000 pages on Plus and $29.99 for 2,000 pages on Pro, with sent and received pages counted together.

The table shows the cheapest plan with a BAA for 5 people, as a price a month, at 1,000 and 2,000 pages sent and received.

For 5 people at 1,000 pages, the yearly bill on annual terms is $203.88 at Fax Pigeon, $354.00 at SRFax, $649.92 at eFax and $1,119.48 at iFax.

The table shows the cheapest plan with a BAA for 10 people, as a price a month, at 1,000 and 2,000 pages sent and received.

eFax Business reaches $95.83 a month billed annually for 10 people at 1,000 pages, since every user beyond the 5 included costs $10 a month or $100 a year. WestFax needs Team 3,000 at $69.99 once a sixth user joins. On iFax, an automatic top-up that its Terms of Use turn on by default adds credits and charges the payment method when usage reaches 95% of the plan limit.

Each page past the allowance is 4 cents on Plus and 3.5 cents on Pro. The same page is 7 cents at eFax Business, 10 cents at Sfax and 3 cents on Fax.Plus Enterprise.

Can the whole office share one number and inbox?

A billing office can run every biller and credentialing specialist through one Fax Pigeon number and inbox with no charge per person, since each plan includes unlimited people. The team draws on one page allowance, and each payer fax can be assigned to the person working it. AI summaries, e-signatures and fax from email come on every plan, with delivery proof for each delivered fax. How a shared fax inbox works and which HIPAA fax services include unlimited users compare the setups.

A billing company's existing fax number ports in free on any paid plan, from sign-up or from Settings, and keeps working with the current provider until the transfer completes, usually within 5 to 15 business days. eFax's Customer Agreement charges $40 a number to port in and $40 to port out, and SRFax charges $25 for a local number.

Who should switch, and to what?

A billing or credentialing company should move to Fax Pigeon Plus or Pro if adding staff raises its fax bill, if its BAA comes only with a higher plan, or if credits are added automatically. At 1,000 pages billed annually, a 10-person office pays $946.08 a year more on eFax Business and $1,725.36 more on iFax than on Fax Pigeon Plus. Fax.Plus includes a BAA on Enterprise only, eFax Personal carries no BAA, and iFax Basic carries no HIPAA terms.

* Prices last verified October 19, 2026, at each provider's own site. Fax Pigeon is not affiliated with SRFax, eFax, iFax, Fax.Plus, WestFax or Sfax.