You’re a business associate to every client. Prove it on every message.
Billing companies move more PHI by email than anyone — claims questions, EOBs, patient statements, payer correspondence. PXCMail gives you enforced encryption and a complete audit trail, and lets you offer the same protection to the practices you serve.
| Message | Detected | Action |
|---|---|---|
| Claims batch → Aetna | 837P · 212 claims | TLS ✓ |
| EOB → Lakeside Dental | PHI detected | 🔒 Encrypted |
| Statement → patient | Balance + DOB | 🔒 Encrypted |
| Aging report → owner@gmail | 214 rows | Blocked · policy |
Overview
Payer correspondence
Many payers publish S/MIME certificates; PXCMail encrypts to them automatically. Others get one-time-code delivery. Everything is on the record.
Patient statements
Account numbers and balances trigger encrypted delivery; patients open on their phone with a code.
Client practices
Resell or refer Gateway to the practices you bill for. Partner console shows every client’s status; 25% margin.
Why billing companies choose Gateway
You already run Microsoft 365 or Google Workspace with careful mailbox hygiene. Gateway adds the enforcement and the evidence without replacing anything: a connector, a policy, and an audit trail you can hand to any client’s compliance officer.
Volume pricing
Above 50 seats, or when you bring client practices, talk to us — contact sales.
What a business associate owes on every message
A billing company is a business associate of every practice it bills for, and HIPAA applies to it directly. That means the Security Rule’s technical safeguards (45 CFR 164.312) and administrative safeguards (164.308) are your obligations, not your clients’, and your documentation has to survive six years (164.316). The practical test a client’s compliance officer applies is simpler: can you show that the EOB you emailed last Tuesday was encrypted, who opened it, and that nobody could have deleted the record. PXCMail gives you that per message, with one policy across every client, and a BAA that sits correctly in the chain: practice to you, you to PXCMail. It does not replace your clearinghouse or your practice-management connections; claims still go the way they go today.
A week at Coastal Billing
Coastal is a 20-person billing company on Microsoft 365 that bills for 30 practices, including Lakeside Family Dental. The operations lead signs the BAAs and answers the questionnaires.
- Monday. A claims analyst emails Aetna about 212 claims in an 837P batch. Payer correspondence with claim numbers and member IDs is PHI; Aetna publishes S/MIME, so the message is encrypted automatically and the thread is archived.
- Tuesday. An EOB with a patient name and procedure codes goes to Lakeside’s
insurance@mailbox. Lakeside is also on PXCMail, so it is encrypted in transit and both sides hold the record. - Wednesday. Patient statements go out with account numbers and balances. Policy: encrypt. Patients open with a code on their phones; the opens are logged, which settles “I never got the statement” disputes.
- Thursday. The owner asks for the aging report at home and a staff member sends it to his Gmail. Policy: block, with a bounce explaining why. The owner is annoyed for five minutes and then grateful when the next questionnaire asks about it.
- Friday. A new client practice asks for evidence that Coastal encrypts PHI. The quarterly compliance report and the annual safeguards letter go out the same afternoon.
By the numbers
- 60 days to notify after discovering a breach of unsecured PHI; 500 or more affected people adds HHS and the media. As a business associate you notify the covered entity, and your BAA sets how fast. (45 CFR 164, Subpart D)
- Encrypted PHI is not “unsecured” under HHS guidance, so a misdirected encrypted EOB is a logged near miss rather than a notification. (HHS guidance)
- 98% of cyber claims in the NetDiligence 2025 study came from small and mid-sized businesses, which is what most billing companies and their clients are. (NetDiligence Cyber Claims Study 2025)
HHS settlements are a tail risk; the list is on the resolution agreements page. The daily risk is a questionnaire you cannot answer and a client you lose over it.
What the client’s compliance officer asks
“Where is the BAA chain?” Practice to Coastal (yours), Coastal to PXCMail (signed at signup, with a 42 CFR Part 2 QSOA if any client is a Part 2 program). Both documents export from the console.
“Is PHI encrypted to payers?” Yes. TLS is required to everyone; payers with S/MIME certificates get S/MIME automatically; the rest get locked delivery. The message record names the method.
“Can your staff forward our data to personal accounts?” No. The block action applies to every seat the day it is created and the attempt is logged.
“Can you produce every message about our patients for a period?” Archive search by client domain, patient identifier or date range; export EML, MBOX or PST with a sha256 manifest and chain-of-custody statement. Legal hold by matter if a dispute is open.
“Who at PXCMail can see our data?” US-based staff only, logged. Tier-1 support in Southeast Asia sees configuration and metadata, not content. No AI reads mail by default.
Going live
- Sign up with the healthcare profile and sign the BAA
14-day trial; nothing is charged. Add the Part 2 QSOA if you bill for a substance-use program. - Connect Microsoft 365 or Google Workspace
One connector for the whole company. The DNS wizard re-checks every five minutes. - Load client domains and payer lists
Custom keyword lists for each client’s practice name and your payer contacts, so the policy can reason about who is on the other end. - Test mode for a week, then enforce
Review the would-have-encrypted and would-have-blocked counts with the team before switching. - Offer Gateway to client practices
The partner console shows every client’s DNS health, policy and seats; 25 to 35% margin, bill-through or payouts.
What Coastal pays
- Gateway, 20 seats
- $120 per month, billed yearly
- Gateway + 6-year archive
- $180 per month ($9 per seat)
- Hosted, 20 seats
- $240 per month with shared mailboxes and device policies
- Hosted Pro
- $360 per month with immutable archive, legal hold, audit API and SLA
Above 50 seats, or when you bring client practices, pricing is by agreement; invoicing is available on annual plans over 25 seats.
Questions billing companies ask
Do our clients need PXCMail for our messages to them to be compliant?
No. Encryption and the record are on your side. If a client also uses PXCMail, both sides hold the record and S/MIME happens automatically.
Can we keep one archive but let each client see only their own?
Clients do not see your archive. You export per client when asked. If you resell Gateway to a practice, that practice has its own console and archive.
What about patient statements from our billing software?
If the software sends through your Microsoft or Google account, it inherits the policy. If it sends from its own servers, it is outside PXCMail and you should ask that vendor the same questions.
How many recipients can one message have?
100 on Gateway and Hosted, 500 on Hosted Pro. Statement runs larger than that should go in batches or from the billing platform.
Can the audit record be pulled by API?
On Hosted Pro, yes: audit API and webhooks. On Gateway and Hosted it is exported from the console.
Is SOC 2 done?
SOC 2 Type I and the independent pentest letter are ROADMAP. We say so on every questionnaire rather than implying otherwise.