SRFax lists healthcare solutions on its site, and Faxage says "All of our fax service plans come with HIPAA compliance standard - No need for a 'special' plan or to pay extra for HIPAA related security features" and you can contact them for a BAA.
Other than that you can do things in-house with Hylafax and either hardware (e.g. Mainpine boards, expensive but they Just Work) or software solutions. My experience with software solutions (IAXModem with Hylafax and Asterisk) has been that speeds and reliability are sometimes poor, at least compared to good hardware solutions or physical fax machines supporting 33.6k.