For a small billing service, renting a subscription RCM platform makes sense: no infrastructure, no upfront cost, quick start. But somewhere past two dozen billers and a few hundred providers, the math and the risk profile flip. The per-provider fee that was convenient at 20 providers becomes your single largest technology cost at 300, and the platform that holds every client's PHI belongs to someone else.
This article makes the case, with numbers, for why mid-size and large billing companies should run their own internally hosted RCM platform.
Sources: published vendor pricing; HIPAA Journal; IBM Cost of a Data Breach Report 2025.
1. The financial case
Per-provider pricing taxes your growth
Most RCM subscriptions charge per provider per month. Published market ranges run from about $100 to $500 per provider per month, and one leading vendor publishes billing-company pricing of $229 to $1,070 per provider per month. Some vendors charge per claim or a percentage of collections instead, commonly 4% to 9%. Every model has the same flaw for a growing billing company: your software bill rises with every client you sign, so the vendor shares in your growth without sharing your risk.
A 5-year cost comparison
Consider a billing company with 25 billers serving 250 providers, adding 30 providers a year. The table compares two subscription price points with an internally hosted platform.
| Year | Providers | Subscription at $100/provider/mo | Subscription at $229/provider/mo | In-house platform* |
|---|---|---|---|---|
| 1 | 250 | $300,000 | $687,000 | $160,000 |
| 2 | 280 | $336,000 | $769,440 | $120,000 |
| 3 | 310 | $372,000 | $851,880 | $120,000 |
| 4 | 340 | $408,000 | $934,320 | $132,000 |
| 5 | 370 | $444,000 | $1,016,760 | $132,000 |
| 5-year total | $1,860,000 | $4,259,400 | $664,000 |
*In-house figures are illustrative: $40,000 one-time setup plus $120,000 per year for cloud hosting, support and maintenance, rising 10% in year 4 for added capacity. Clearinghouse fees are excluded from all columns. Your actual costs depend on volume, integrations and support level.
Every new client becomes more profitable
Under per-provider pricing, each provider you add costs $1,200 to $2,748 a year in software alone at the price points above. On your own platform, the added software cost of the next provider is small, typically just incremental hosting capacity. That difference goes straight to your margin, or lets you price more competitively and win clients your competitors cannot afford to take.
Predictable costs, and freedom to choose partners
- No surprise renewals. Your platform cost is set by your infrastructure and support plan, not a vendor's annual price increase.
- Your choice of clearinghouse. Negotiate directly, and keep a second connection ready.
- A real asset. A proprietary, branded platform differentiates your company in sales conversations and can strengthen its value.
2. The security and privacy case
Shared platforms concentrate risk
In February 2024, a ransomware attack on Change Healthcare, one of the country's largest claims clearinghouses, disrupted claims processing for weeks and ultimately affected 192.7 million people. UnitedHealth Group advanced roughly $9 billion in interest-free loans to providers whose cash flow had stopped. When thousands of organizations depend on one shared vendor, one incident becomes everyone's incident.
Business associates are a persistent source of exposure: HIPAA Journal's breach data attributes roughly one in six reported healthcare breaches in 2024 and 2025 to business associates, and notes that their role tends to be under-represented.
What an internally hosted platform changes
- Isolation. Your clients' PHI sits in your own dedicated environment, not in a multi-tenant database shared with thousands of other customers.
- Control of access. You set the identity rules, multi-factor authentication, role permissions and who can see which client's data.
- Your audit trail. Complete, exportable logs of every access and change, available whenever a client or auditor asks.
- Your incident response. You decide on containment, backups and failover instead of waiting for a vendor's status page.
- Data residency. You choose where data is stored and who can access it, including meeting client or payer contract terms that restrict offshore access.
3. The compliance case
- A shorter business associate chain. Every vendor that touches PHI needs a BAA and oversight. Fewer parties means fewer agreements to manage and fewer points of failure.
- Ready for a stricter HIPAA Security Rule. HHS has proposed the most significant update to the Security Rule in years, including encryption, multi-factor authentication, network segmentation, annual penetration testing, tested incident response plans and written verification of business associates' safeguards. Final action is currently projected for July 2027. Controls you own are controls you can document.
- Faster client due diligence. When a practice or MSO sends a security questionnaire, you answer it from your own policies and logs instead of waiting on a vendor's attestation.
- Data ownership and a clean exit. Your data is never held hostage to a contract renewal, export fee or vendor acquisition.
4. The operational and competitive case
- Workflows built for multi-client billing. Work claims from many practices in one workbench, with client-level rules, edits and queues.
- Your brand, not the vendor's. White-labeled client portals and reports reinforce your relationship with every practice you serve.
- Client-level reporting. Revenue, trends and collection aging by client, provider and payer, ready to share.
- AI on your terms. Add claim scrubbing, denial prediction and A/R prioritization on your own data, without that data training anyone else's models.
- Integrations on your schedule. Connect to your clients' EHRs and practice systems through HL7, FHIR, EDI and web services without waiting on a vendor's roadmap.
- Specialty flexibility. Configure rules for each specialty and payer mix instead of forcing every client into one template.
When a subscription still makes sense
To be fair, renting is often the right call for small billing services with a handful of billers, no IT capacity and a stable client list. The case for owning your platform gets stronger as you add billers, providers and clients, take on clients with strict security requirements, or want to differentiate on service and reporting.
"Internally hosted" also does not mean doing it alone. A managed, dedicated deployment gives you ownership and isolation while a partner handles setup, updates, monitoring and support.
How Rimage helps
Rimagination is a practice-branded, multi-practice RCM platform built for billing companies. It is available as a dedicated deployment on Microsoft Azure with a HIPAA compliant DMZ, encryption, role-based access, MFA and audit logging, with AI claim scrubbing, denial prediction, automated eligibility and smart posting built in. Our UNIK platform, launched in 2011, was deployed as a SaaS billing application serving multiple practices and specialties across the USA, so we know both sides of this decision.
Run the numbers on your own book of business
We will model your providers, clients and growth plan against your current subscription, and show what an in-house Rimagination platform would cost.
Sources
- HIPAA Journal: Change Healthcare responding to cyberattack (192.7 million individuals; provider loan program)
- HIPAA Journal: Healthcare Data Breach Statistics
- TechTarget: Healthcare remains costliest industry for breaches at $7.42M (IBM Cost of a Data Breach 2025)
- Fierce Healthcare: Feds push back HIPAA Security Rule overhaul to July 2027
This article is for general information and is not legal, coding, billing or compliance advice.
