Pedantic note: I'm not excusing them for lacking something as critical as a secure way to transmit sensitive information, but it's certainly more involved than "ten dollars worth of PHP."
You're probably looking at setting up a dedicated server to store the images (since you want the server locked down tighter than a normal web server, and you need to think about having different backups in place, etc) and then have one of the engineers spend a few days developing a system to upload the images and allow secured access to their support staff. Sure, writing the code to upload files is easy, but the security and UI take a good bit of effort. You're probably looking closer to $1k excluding the cost of hardware and the SSL cert.
You're probably looking at setting up a dedicated server to store the images (since you want the server locked down tighter than a normal web server, and you need to think about having different backups in place, etc) and then have one of the engineers spend a few days developing a system to upload the images and allow secured access to their support staff. Sure, writing the code to upload files is easy, but the security and UI take a good bit of effort. You're probably looking closer to $1k excluding the cost of hardware and the SSL cert.