HIPAA compliant hosting requirements every buyer gets wrong

HIPAA compliant hosting is server infrastructure set up to meet the HIPAA Security Rule and run under a signed Business Associate Agreement (BAA). However, type “HIPAA compliant hosting” into a search bar and you get a wall of vendor pages, each one pointing at its own product. That is a hard place to make a decision this serious, since getting it wrong carries real legal weight. 

Most buyers arrive already believing three things. 

1. Signing a Business Associate Agreement makes them compliant. 
2. The big clouds like AWS are compliant the moment you sign up. 
3. Every healthcare website needs this kind of hosting. 

Unfortunately, all three are wrong and the confusion gets costly fast. The fix starts with one honest look at your own site, because whether it handles patient data or simply talks about care is the difference that decides everything else in this guide.

What HIPAA compliant hosting means

HIPAA compliant hosting is infrastructure that satisfies the three safeguard categories of the HIPAA Security Rule under 45 CFR Part 164, Subpart C, for any system that creates, receives, maintains or transmits electronic protected health information. Those categories are administrative, physical and technical safeguards. 

💡Read the plain-language version in the HHS HIPAA Security Rule Summary.

The rule kicks in the moment your servers store, process or send electronic protected health information, known as ePHI, and that data shows up in more places than people expect. Patient intake forms collect it, portal logins carry it and appointment records tied to a diagnosis hold it. Billing data counts too. It also turns up in places people miss. An insurance ID number counts, and so does an IP address logged next to a patient's activity on a portal.

It comes down to a single test. A site that handles ePHI needs HIPAA-compliant hosting and a signed agreement, while a site that does not is free of both.

Cloud and dedicated servers can both qualify, so the architecture matters less than the isolation you build, whether that comes from single-tenant hardware or careful segmentation, and the controls you layer on top. The agreement and those controls come first.

A word of caution here: in December 2024, the HHS Office for Civil Rights issued a proposed rule that would tighten several of these controls once finalized, though it remains a proposal rather than current law for now.

What a BAA does and doesn't cover

A Business Associate Agreement, or BAA, is the legal contract required under 45 CFR 164.502(e) and 164.314 between a covered entity and any vendor that creates, receives, maintains, or transmits protected health information on its behalf. HHS publishes sample provisions you can compare against. Without one, storing a single record of PHI is a violation, no matter how secure the server is.

A complete BAA spells out a specific set of terms. The list below covers what to expect inside it.

• Permitted uses and disclosures of PHI.
• The security safeguards the vendor will maintain.
• The breach notification timeline the vendor must meet.
• How subprocessors are handled and held to the same terms.
• What happens to PHI when the contract ends.
• The vendor's cooperation during audits.

The part buyers miss most often is that a BAA does not hand your compliance to the vendor. It transfers a slice of infrastructure liability and nothing more. This split has a name. It is the shared responsibility model, and it is where buyers get exposed when they treat the BAA as the finish line rather than the starting point. Your organization keeps the rest. That includes workforce training, your documented risk analysis under 45 CFR 164.308(a)(1), breach notification to HHS and affected individuals, and your own access policies.

Let’s look at two examples to understand this more clearly. If the host misconfigures storage and exposes records, that failure is the host’s responsibility. If your staff was never trained to handle PHI and a worker leaks it, that failure is yours.

Regulators are active here. OCR runs a Risk Analysis Initiative that keeps producing settlements against organizations that skipped a thorough risk analysis. In April 2025, a radiology practice paid $350,000 after regulators found it had never completed one, in a breach affecting nearly 300,000 people. The settlement was the sixth under the initiative, and the pattern carried into 2026 with more six-figure resolutions tied to the same gap.

As you work through a shortlist, two things deserve a hard look. If a vendor will not sign a BAA, cross it off for any PHI project right away, because that is a legal fact and not a setting your team can configure around. And if a vendor buries the BAA in its priciest tier, read that as a signal about how seriously it treats compliance before you sink more time into the sales process.

Technical safeguards a HIPAA host must deliver 

The technical safeguards for HIPAA hosting are the controls an auditor will ask you to prove with evidence, not the features a sales page lists. The Security Rule sets these out at 45 CFR 164.312 as five standards: access control, audit controls, integrity, person or entity authentication, and transmission security. The list below turns those standards into the evidence an auditor will actually ask for. Work through this list and check off each control as you put it in place.

• Encrypt data at rest with AES-256 across disks, databases, and backups, and turn on key rotation and access logging.
• Encrypt data in transit with TLS 1.2 at a minimum, move to TLS 1.3 where you can, and force HTTPS on every path, including admin logins.
• Require multi-factor authentication (MFA) on every user and admin route to ePHI, and skip SMS as the second factor, which NIST SP 800-63B flags as weak.
• Give every person the least access they need, allow no shared accounts, and remove access the same day someone leaves.
• Keep immutable audit logs of logins, PHI access, configuration changes, and failed attempts, hold compliance records for six years, and tier operational logs with recent data hot for around 90 days and older data cold for about 12 months.
• Put PHI workloads in their own network zone and never run them on shared hosting.
• Encrypt your backups, store them in a separate failure domain, and restore a real test at least once a year to confirm recovery targets.
• Run internal vulnerability scans every quarter and book an independent penetration test once a year.
• Set session timeouts and ask for re-authentication before any sensitive action.
• Put a web application firewall in front of the app, then switch on DDoS protection and rate limiting.
• Confirm the physical safeguards such as biometric access, surveillance, environmental controls and redundant power, which usually come from the underlying cloud or colocation provider.
• Protect data integrity with checksums, version history, and change tracking, so you can prove ePHI has not been altered or destroyed without authorization.

One nuance to flag for anyone reading this in 2026. Under the current rule, encryption at rest, encryption in transit, and automatic logoff are addressable specifications rather than strictly required ones. Addressable does not mean optional. It means you either implement the control or document why a reasonable alternative fits your risk. The proposed 2024 rule matters here because it would remove the addressable versus required distinction and make controls like encryption, MFA, network segmentation, scanning every six months, and an annual penetration test mandatory once finalized, so building to that bar now saves a scramble later.

Three paths to HIPAA-compliant hosting

There are three ways to reach HIPAA-compliant hosting. They differ mainly in who does the configuration work and how much engineering headcount you bring, so the right one depends on the team you already have. 

One point worth clearing up first. A BAA only applies when a separate vendor handles your ePHI. If you own and operate the infrastructure yourself, on-premises or on dedicated hardware you control, there is no business associate and no BAA to sign. You still owe every physical and technical safeguard yourself.

Path 1. Going direct to a hyperscaler

The first option is a hyperscaler such as AWS, Azure, or Google Cloud. AWS publishes a list of more than 200 HIPAA-eligible services and offers a self-service agreement through AWS Artifact at no extra cost, while Azure ships healthcare compliance blueprints and Google Cloud offers the Cloud Healthcare API for the same audience.

The catch lives in one word. Eligible is not the same as compliant. Run a PHI workload on a service that is not on the eligible list, and you have a violation even with an agreement in place. Run it on an eligible service you then misconfigure, say an unencrypted storage bucket holding ePHI, and you have broken the terms of the agreement you signed. AWS Artifact confirms the infrastructure can do the job, but it says nothing about how you set it up.

On this path, your team owns everything above the hardware, which means segmentation, key management, identity and access, logging, backups, and penetration testing. The raw infrastructure can start in the low hundreds of dollars a month, though the real cost is the platform engineers who run it.

This path fits teams that already have a dedicated platform engineering function.

Path 2. Managed HIPAA hosting from a specialist

The second option is managed HIPAA hosting from a specialist such as Atlantic.Net, Liquid Web, HIPAA Vault, ClearDATA or LuxSci. The provider preconfigures the controls, signs the agreement, and handles patching, backups, and monitoring, so most of the heavy lifting sits with them rather than you.

Pricing tends to start in the low-to-mid hundreds of dollars a month. HIPAA Vault lists a managed WordPress plan from around $120 a month, one of the lowest entry points in the category, and some specialists price only by quote, so budget time for a sales call.

This path fits healthcare software teams and clinical organizations that do not run a full platform engineering group.

One name comes up often here, and that is WordPress. Managed HIPAA WordPress hosting does exist, though it is not offered by your conventional WordPress hosting companies. For example, while providers like WP Engine and Kinsta earn their reputation on developer experience, performance, and scale, neither signs a Business Associate Agreement for standard plans, which rules them out for PHI no matter how good the platform feels. Read our dedicated WordPress hosting guide to explore the pros and cons of popular hosts.

Path 3. HIPAA-as-a-Service from a platform

The third option is HIPAA-as-a-Service from a platform such as Aptible. The platform hides the infrastructure entirely and folds the agreement into the contract, which keeps setup light.

Production plans start from around $499 a month. You trade some flexibility at large scale for speed and simplicity.

This path fits early-stage healthcare startups that want to ship fast.

Reading across the three, the real variable is engineering hours, not the sticker price. The hyperscaler looks cheapest on paper and costs the most in salaries. Managed hosting flips that balance, and HIPAA-as-a-Service flips it further. The developers who live in these systems tend to land on the same point, which is that compliance depends less on the box you rent and more on how you run it.

How to verify a vendor's BAA

Verifying a vendor's BAA means reading the contract for specific terms, not trusting a compliance badge on the homepage. Work through this list before you sign.

• Check the subprocessor list and confirm each one is bound by the same terms.
• Confirm the breach notification window the host owes you. Your organization then faces a 60-day deadline to notify HHS and affected individuals under the Breach Notification Rule.
• Read the termination terms and confirm PHI is either returned or destroyed with certification.
• Study the indemnification carve-outs. This is where buyers get burned.
• Look for clear audit cooperation language.
• Pin down exactly which services the agreement covers. Hyperscaler agreements trip buyers here, because coverage stops at the eligible-service line.

Certifications help, as long as you read them for what they actually say.

• SOC 2 Type II reports on operational controls tested over 6 to 12 months. It shows a security program in motion, not HIPAA conformance.
• A SOC 2 plus HIPAA report bolts a set of HIPAA Security Rule tests onto the standard SOC 2 Type II audit, so you get SOC 2's rigor with explicit HIPAA control coverage in one document. It still does not replace the BAA.
• HITRUST CSF is the closest thing to third-party HIPAA validation. Ask for the certification letter and its scope.
• No official HIPAA certification for hosts exists. Any vendor claiming to be HIPAA certified is stretching the truth.

Some mainstream hosts remove themselves from the running by contract. GoDaddy and Bluehost do not sign BAAs for their standard products, so they cannot host PHI. WP Engine and Kinsta are in the same bucket, since neither offers a BAA on standard plans. Shared hosting generally lands there too. Any best-HIPAA-host list that features these names is wrong on the facts.

What HIPAA-compliant hosting costs 

HIPAA-compliant hosting starts higher than regular hosting because the provider takes on legal responsibility for your data. Prices move, so treat these as orientation and confirm live figures before you buy.

A few providers post public pricing. Liquid Web and Atlantic.Net both publish plans that start in the low-to-mid hundreds of dollars a month. Aptible lists production plans from around $499 a month. Others, including HIPAA Vault, LuxSci, and any hyperscaler-direct build, tend to require a quote, so budget time for a sales call.

Total monthly spend, once you add supporting tools, tends to fall into three bands.

• A small practice or single-app startup usually lands in the low hundreds of dollars a month.
• A mid-size healthcare organization or growing software company usually runs into the low-to-mid four figures.
• An enterprise health system usually sits from the mid-four figures into the low five figures.

Free HIPAA hosting is not a real product. No legitimate provider will accept business associate liability for nothing, so any free offer either is not covering PHI or is not telling you the whole story.

While HIPAA-compliant hosting can seem expensive, the cost of getting it wrong dwarfs the hosting bill. A breach affecting 500 or more people starts a 60-day clock for notifying HHS and the individuals involved, counted from the day your organization discovers it. 

In April 2025, Northeast Radiology settled with the HHS Office for Civil Rights for $350,000. Unauthorized users had accessed radiology images on the practice's imaging server, exposing the data of 298,532 patients, and investigators found the practice had never run a thorough risk analysis of where that data was stored. A two-year corrective action plan came with the payment.

The pattern is still running. In July 2026, OSF HealthCare System agreed to pay $552,250 after a 2021 ransomware attack exposed the data of 53,907 patients. Regulators again pointed to a missing risk analysis, along with late notice to the affected individuals and to HHS. The recency is the point, since this is current enforcement rather than a story from the early days of the law.

The wider price tag is bigger still. IBM's 2026 Cost of a Data Breach Report puts healthcare as the most expensive sector for the sixteenth year running, at an average of $6.64 million per breach.

These two settlements are a small sample of a much larger trend, since OCR has resolved dozens of similar cases and the numbers climb as the exposed data grows. For any website that stores protected health information, HIPAA compliance is now the highest priority of the entire build rather than a box to tick at the end, because the hosting bill is minor next to what a single lapse can cost.

When you don't need HIPAA hosting

Many healthcare websites never need HIPAA hosting, because they never handle protected health information. Common examples are hospital marketing sites, university health network sites, pharmaceutical product pages, medical device corporate sites, insurer plan comparison tools with no login, provider directories, and departmental or clinic landing pages. Content sites that route every patient interaction to a separate compliant system such as Epic, Cerner, Athenahealth, or a dedicated form vendor belong here too. HIPAA specialists rarely write for this audience, even though it makes up a large share of the healthcare web. 

What decides it is where the sensitive data goes. When every form and every patient-login button on your site hands off to an outside validated service, for example Epic MyChart or a compliant form tool, your platform never stores or processes ePHI. That keeps it outside HIPAA scope, and with no PHI on the web infrastructure, you do not need a BAA from your host. The catch is that a single feature can pull an otherwise public site into scope. A contact form that asks a visitor to describe symptoms, or a scheduling widget that captures a reason for the visit, starts handling ePHI the moment it collects that data. The test is what the site actually does with information, not the industry it sits in.

Staying outside HIPAA scope is not a reason to relax on security. A public healthcare site still needs strong protection, including SOC 2 Type II attestation, AES-256 encryption, TLS 1.3, MFA, tenant isolation, audit logging, and governance across a portfolio of sites.

Pantheon is built for exactly this case. It is a WebOps platform for WordPress, Drupal and Next.js sites, running on Google Cloud. A Pantheon site does not run in a single container but across several coordinated containers that each handle a job, among them the application server, the database and the cache. You can see the platform's controls on the Security and Compliance page.

On compliance, Pantheon's Trust Center documents SOC 2 Type II, FERPA, GDPR, and TX-RAMP Level 1, a mix that suits university health networks and hospital marketing teams working with student or general data rather than PHI. Teams running many sites at once gain the most from three features. Multidev creates parallel environments so changes get tested before they reach the live site. Upstreams pushes one shared configuration across a whole fleet of sites. Autopilot runs updates with visual regression testing so nothing breaks without warning.

Note: Pantheon signs BAAs that commit it to HIPAA-equivalent technical, administrative, and organizational controls.  However, Pantheon is not currently fully compliant with HIPAA.

Making the right hosting decision for your healthcare site

The right hosting decision comes down to one question about your data and a short list of assumptions to double-check first. Before you sign anything, take a quick look at these.

• A signed agreement is not the same as compliance.
• Hyperscalers are HIPAA-eligible, not HIPAA-compliant.
• No official HIPAA certification for hosts exists.
• GoDaddy, Bluehost, WP Engine, and Kinsta do not offer BAAs for standard products.
• Shared hosting with an SSL certificate is not network segmentation.
• Free HIPAA hosting is not a real product.
• Hosting compliance is not the same as your whole organization being compliant.

If your site handles PHI, pick the path that matches the team you have. Then ask each vendor for its BAA template, its SOC 2 Type II report or HITRUST certificate, and its breach notification SLA before you commit.

If your site handles no PHI, confirm that every patient interaction routes to a separate compliant system. Once that is settled, you can evaluate a WebOps platform built for portfolio scale. 

If that describes your situation and you still want enterprise-grade security and governance for a multi-site healthcare presence, see how Pantheon can deliver SOC 2 Type II, FERPA, and container-based isolation on Google Cloud to safeguard your website.