If you handle protected health information, the fax question isn’t really “which service is best” — it’s “which service will put its name on a signed contract accepting liability for your patients’ data, and what does that cost.” That contract is the Business Associate Agreement (BAA), and it’s the entire ballgame. Everything else is negotiable.
Here’s the quirk worth understanding before you shop: HIPAA compliance costs a fax provider almost nothing to offer. The encryption, the access controls, the audit logs — those already exist in their platform. So the BAA becomes a pricing lever. Some vendors bundle it into an entry plan; others hold it hostage in an enterprise tier and let you assume that’s what “healthcare-grade” costs. The spread is enormous: the identical legal protection runs $13.65/month at one provider and $79.99 at another.
This guide is for anyone buying fax for a clinic, therapy practice, billing office, law firm handling medical files, or any workflow where a leaked page is a reportable breach. The one-line answer: SRFax is the value floor for a real, BAA-backed fax plan, Documo is the pick when you need EHR integration, and iFax is the pick when your staff actually needs decent apps. The comparison page has the HIPAA filter pre-checked so you can see them side by side.
The one rule: no BAA, no deal
A provider is HIPAA-appropriate only if it will sign a BAA covering your account. That’s not a nice-to-have — it’s the legal instrument that makes the vendor a compliant “business associate” under the HIPAA rules. Marketing copy that says “HIPAA-friendly,” “bank-level encryption,” or “secure and private” without a BAA behind it is decoration.
Two things worth saying plainly. First, there is no such thing as “HIPAA-certified.” HHS certifies no one and endorses no product; any vendor claiming a HIPAA certification is telling you something meaningless. Second, self-attested compliance is not compliance. CocoFax, for example, uses HIPAA and GDPR language on its site but offers no signed BAA — which is precisely the piece that carries legal weight. For PHI, that rules it out, cheap as it is.
What each BAA actually costs
Every plan below includes a signed BAA. Prices are annual-billing monthly rates unless noted.
| Provider | Entry HIPAA plan | Price/mo | Pages | Overage | What you also get |
|---|---|---|---|---|---|
| SRFax | Healthcare Basic | $13.65 | 500 | 5¢ | PGP-encrypted storage, audit logs, PHIPA |
| iFax | Plus | $24.99 | 500 | none (hard cap) | Best-in-class apps, e-sign, audit trails |
| Documo | Solo | $25.00 | 300 | 15¢ | EHR integrations, OCR, 99.9% SLA |
| eFax | Business | $39.99 | 500 | 7¢ | HITRUST cert, 5 users, 51-country send |
| Fax.Plus | Enterprise | $79.99 | 1,000 | 3¢ | API, SSO, data residency, 190+ countries |
Note that eFax Business has no published annual discount, so $39.99 is the flat rate. Fax.Plus Enterprise is $79.99 whether you pay monthly or annually.
The pattern is hard to miss. At 500 pages a month, SRFax and eFax deliver the same page allowance and the same signed BAA — eFax just charges nearly three times as much. You’re paying for the brand, the HITRUST certification, and genuinely 24/7 support, all of which are real, but none of which change the compliance floor.
A worked example: a 450-page-a-month practice
Say you run a small clinic that sends and receives about 450 pages a month combined — referrals in, records and prior authorizations out. Here’s what the compliant options actually cost at that volume:
- SRFax Healthcare Basic — $13.65. Fits inside the 500-page pool with room to spare.
- iFax Plus — $24.99. Also fits the 500-page cap. Nicer apps, but the cap is hard: a heavy month forces an upgrade rather than a small overage.
- Documo Solo — $25 buys only 300 pages, so 150 overage pages at 15¢ add $22.50, landing you at $47.50. At this volume you’d really want Documo Professional ($62.50, 800 pages) instead — which tells you Documo isn’t priced for a 450-page clinic that only needs a BAA.
- eFax Business — $39.99, fits the 500-page pool.
- Fax.Plus Enterprise — $79.99, the same job for nearly six times the SRFax price.
The winner at this volume is not close. SRFax does it for $13.65 with encryption and audit logging included. The only reasons to pay more are specific: EHR hooks (Documo), phone-and-tablet workflows (iFax), an existing eFax relationship, or international numbers plus an API (Fax.Plus). If none of those apply, the premium is just a premium.
Now scale up. A busier office running ~1,400 pages a month:
- SRFax Healthcare Standard — $35.15 for 1,500 pages. Still the cheapest by a wide margin.
- Documo Professional — $62.50 for 800 pages, plus 600 overage at 9¢ ($54) = $116.50. Documo Business ($125, 2,500 pages) is barely more and unlocks the API — but either way you’re paying 3–4x SRFax for the same compliance.
- eFax Business — $39.99 for 500 pages, plus 900 overage at 7¢ ($63) = $102.99.
SRFax wins again. Its 5¢ flat overage and deep plan ladder — Standard Plus (2,500 pages, $58.61), Professional (5,000, $117.22), all the way to Professional Premium (20,000 pages, $468.82) — mean you rarely get squeezed as you grow. Plug your real volume into the fax price calculator to see exactly where your line lands.
When to pick something other than SRFax
SRFax is the price answer, not the answer to every question. Reasons to spend more, and the honest version of each:
- Documo — if your fax touches an EHR. The integrations (PointClickCare, ModMed, NextGen), OCR, and patient-data extraction are real work the budget providers can’t do, and every Documo plan ships with a BAA at no surcharge. Worth it for a practice moving records daily; overkill for one that faxes a lease twice a year.
- iFax — if staff fax from phones and tablets. It has the best apps in the category, built-in e-signatures, and scanning that feels current. The catch: allowances are hard caps with no overage billing, so a spike forces a mid-cycle upgrade. Know your volume before you commit, and skip the send-only Basic tier ($12.49) — it can’t receive a fax and isn’t a HIPAA plan.
- eFax — if you need a name your compliance officer already recognizes, HITRUST certification on paper, or heavy international sending. The eFax Business plan bundles the BAA without a sales call, which is genuinely convenient. You’ll just pay the most per page.
- Fax.Plus — only if you need a BAA and an API and SSO and numbers in 190+ countries in one account. That’s a real enterprise profile, and Fax.Plus Enterprise serves it. For a domestic clinic it’s the wrong tool at the wrong price.
Edge cases and gotchas
Send/receive splits. Most compliant plans pool sent and received pages, which is what you want. Watch for services that don’t. MyFax, for instance, keeps separate send and receive allowances, and spare receive pages never cover extra sent pages — though MyFax has no HIPAA option anyway, so it’s academic here. The lesson generalizes: count both directions of your traffic, because inbound referrals eat allowance too.
Incoming spam counts. On any plan where received pages draw down a pool, junk faxes count against you. SRFax and the pooled plans absorb this more gracefully than split-allowance products.
Hard caps vs. overages. iFax never bills overages, which sounds great until a busy month hits the ceiling and faxes simply stop until you upgrade or the cycle resets. SRFax’s 5¢ overage is the opposite trade — you’ll never be blocked, you’ll just see a modest line item. Neither is wrong; pick the failure mode you’d rather live with.
“HIPAA available” is not “BAA signed.” Some services list HIPAA as an available option that requires a specific plan, add-on, or request. Dropbox Fax and Nextiva vFax both fall here — Nextiva’s HIPAA-conformant setup needs a custom quote rather than a checkbox. If you can’t get the BAA self-serve, treat it as a sales conversation, and get the signed document in hand before you send a single page of PHI.
Data residency. If you operate in Canada or need PHIPA coverage, SRFax supports Canadian data residency and PHIPA out of the box — a genuinely rare feature at this price. Fax.Plus offers data residency options on Enterprise.
The bottom line
For the overwhelming majority of practices, SRFax Healthcare Basic at $13.65/month is the right starting point — a signed BAA, PGP-encrypted storage, audit logs, and a 60-day money-back window that doubles as a long free trial. Step up to Basic Plus ($19.50, 800 pages) or Standard ($35.15, 1,500 pages) as your volume climbs.
Pay more only for a concrete reason: Documo if you’re integrating with an EHR, iFax if mobile apps are non-negotiable, eFax if brand and HITRUST certification matter to your stakeholders. Everyone else is buying the same signed BAA at a markup. Don’t let a pricing page convince you that compliance is a luxury tier — it’s a contract, and the cheap ones are just as binding as the expensive ones.
If you’re still scoping needs, the business fax pricing guide and small business fax pricing guide cover the non-compliance side of the decision, and our HIPAA-compliant fax guide on the blog walks through the compliance checklist in more depth. When you’re ready to match a plan to your real page count, start at the calculator.