Demand These BAA Terms for HIPAA Compliant Hosting for U.S. Practices

Yes, U.S. covered entities can host electronic protected health information in the cloud or in managed environments, but only after signing a Business Associate Agreement and completing a documented risk analysis, as HHS guidance on cloud computing makes clear. Hosting itself never violates HIPAA; hosting without a BAA, weak access controls, or no audit trail does. Before you sign anything, confirm your organization’s risk analysis is current, request a signed BAA from the vendor, and ask for documented proof of encryption, access logging, and breach notification procedures.

---

TL;DR:

• Hosting ePHI in the cloud requires a signed Business Associate Agreement and a current risk analysis; lacking either can lead to HIPAA violations.
• Vendors claiming to be “HIPAA certified” are marketing labels; verification depends on third-party attestations like SOC 2, HITRUST, or NIST alignment, not certifications.
• A comprehensive BAA must specify permitted uses, breach procedures, safeguards, subcontractor obligations, and data destruction terms to be enforceable.
• Technical safeguards should include strong access controls, continuous audit logging, encryption at rest and in transit, network segmentation, and robust backup and disaster recovery plans.
• Shared responsibility means healthcare organizations handle configuration, policies, and staff practices; vendors secure infrastructure and controls, but compliance depends on proper internal management.

---

Table of Contents

• What Does “HIPAA Compliant Hosting” Actually Mean?
• Contractual Must-Haves: BAAs, SLAs, and the Fine Print That Protects You
• What Technical Safeguards Should a HIPAA Hosting Provider Guarantee?
• Shared Responsibility: What the Host Covers vs. What You Must Do
• How Do You Evaluate and Choose a HIPAA Hosting Partner?
• Migration, Costs, and Timeline: What to Actually Expect
• What Small Practices Get Wrong About Hosting Vendors
• How Tatem Web Design Handles HIPAA Hosting for Florida Healthcare Practices
• Sources
• FAQ

What Does “HIPAA Compliant Hosting” Actually Mean?

There’s no government agency that hands out a “HIPAA compliant” seal. That phrase you see on hosting company landing pages is marketing shorthand, not a legal credential. HIPAA is a law that regulates behavior, contracts, and safeguards, not a certification you purchase off a shelf.

The law splits organizations into two roles. A covered entity is the healthcare provider, health plan, or clearinghouse that originally holds the patient data. A business associate is any vendor that creates, receives, maintains, or transmits protected health information on the covered entity’s behalf. The moment a hosting company stores, processes, or even has potential access to ePHI, it becomes a business associate under the law, regardless of how the vendor’s sales page describes itself.

That status triggers a specific contractual obligation. Covered entities and business associates must execute a Business Associate Agreement under 45 CFR § 164.504(e), and the BAA must obligate the host to protect ePHI consistent with the Security Rule. This holds even for providers offering “no-view” encrypted storage. HHS has confirmed that a cloud provider storing only encrypted data, without holding the decryption key, is still a business associate and remains bound by breach notification and safeguard duties.

So what should you trust instead of a “HIPAA certified” claim? Look for third-party attestations that carry real audit weight:

• SOC 2 Type II reports, which verify a provider’s controls held up over a monitored period, not just on the day of a snapshot audit.
• HITRUST CSF certification, which maps to HIPAA and several other frameworks simultaneously.
• NIST 800-53 alignment, referenced by NIST SP 800-66 as a practical way to translate HIPAA’s Security Rule into concrete technical controls.
• FedRAMP-aligned architecture, common among providers who also serve federal agencies and therefore build to a higher baseline by default.

None of these substitute for a signed BAA. They’re evidence a vendor’s controls are real, not proof of legal compliance on their own.

Contractual Must-Haves: BAAs, SLAs, and the Fine Print That Protects You

A BAA that just says “we comply with HIPAA” isn’t worth much in an OCR investigation. The agreement needs specific, enforceable language. Here’s what a defensible BAA actually contains:

1. Permitted uses and disclosures. The document should spell out exactly what the host can do with ePHI, and prohibit anything beyond that scope.
2. Breach notification terms. Define the exact reporting window, the format of the notification, and who at the vendor is accountable for it.
3. Security obligations tied to the Security Rule. The BAA should reference the technical, administrative, and physical safeguards the host commits to maintaining.
4. Subcontractor flow-down clauses. If your host uses a subprocessor (a backup vendor, a monitoring service, a data center operator), that subcontractor needs its own BAA with equivalent terms. Gaps here are one of the most common weaknesses in vendor contracts.
5. Data return and destruction terms. When the relationship ends, the contract must specify how ePHI gets returned or securely destroyed, and within what timeframe.

An SLA works alongside the BAA rather than replacing it. Where the BAA states legal obligations, the SLA should attach measurable numbers to them: guaranteed uptime percentage, a maximum incident time-to-notify (say, notification of a suspected breach within 24 hours), and a defined backup and restore window. A useful way to frame the split: the BAA says what the vendor must do, and the SLA says how fast and how reliably they’ll do it.

Ask vendors for evidence, not assurances. A current SOC 2 Type II report covering the past 12 months, a summary of the most recent penetration test, and a sample of audit logs from a non-production workload will tell you more in twenty minutes than a sales call will in an hour.

Pro Tip: Ask specifically whether the SOC 2 report covers the exact data center and service tier you’ll be using. Some hosts run multiple environments, and only their enterprise tier carries the audited controls their marketing implies apply everywhere.

The stakes for skipping this step are real. HHS has confirmed that using a cloud service provider to store ePHI without first executing a BAA places the covered entity in violation immediately, independent of whether any breach ever occurs. The contract gap itself is the violation.

What Technical Safeguards Should a HIPAA Hosting Provider Guarantee?

The Security Rule lists specific technical standards at 45 CFR § 164.312, and a hosting provider serving healthcare organizations should be able to map its controls directly to each one. Here’s the checklist worth walking through with any vendor, item by item.

Access control. The host needs unique user IDs for every account touching ePHI systems, multifactor authentication as standard (not an add on), documented emergency access procedures, and automatic session timeouts. If a vendor treats MFA as optional, that’s a signal to move on. The proposed 2025 Security Rule update would make MFA and encryption mandatory rather than merely “addressable,” so treat both as required now rather than waiting for a final rule.

Audit controls and monitoring. Ask whether logging runs continuously, how long logs are retained, and whether logs can be exported in a format your compliance team or an auditor can actually read. A host that can’t produce a clean audit trail on request isn’t ready for ePHI, no matter how good its uptime numbers look.

Encryption, in transit and at rest. Data moving between systems should run over TLS 1.2 or newer, ideally TLS 1.3. Data at rest should use AES-256 or an equivalent standard. Key management matters just as much as the algorithm: ask whether you or the vendor controls the encryption keys, and understand that a “no-view” model where the vendor can’t decrypt your data still requires a full BAA and shared safeguard responsibility.

Network and configuration controls. Look for network segmentation that isolates ePHI systems from general infrastructure, a documented patching cadence, active anti-malware protection, and configuration baselines the vendor can show you rather than describe verbally.

Backups, retention, and disaster recovery. Confirm backup frequency, how backups are encrypted, how long they’re retained, and what the recovery time objective looks like after a validated disaster. Ask, too, how the vendor handles secure deletion when data reaches the end of its retention period.

AWS’s own technical guidance on mapping HIPAA safeguards to cloud services illustrates how granular this shared-responsibility split gets in practice: the cloud platform secures the underlying infrastructure, but configuration, access policy, and monitoring setup fall on the customer. That division applies to any serious hosting provider, not just hyperscale cloud platforms.

How to validate rather than trust. Request a redacted sample audit log, the executive summary of the most recent penetration test, and written confirmation of the encryption standard and key custody model. A vendor confident in its controls will hand these over without friction. One that stalls, deflects, or offers only a compliance “badge” on its website is telling you something important.

Shared Responsibility: What the Host Covers vs. What You Must Do

No hosting provider, no matter how many attestations it holds, can make your organization HIPAA compliant on its own. Compliance splits across a shared responsibility model, and misunderstanding that split is where most healthcare organizations get into trouble.

The host typically owns the infrastructure layer: physical data center security, network hardware, the hypervisor, encryption at the storage layer, and the baseline patching of systems it fully controls. What it can’t own is your configuration choices, your staff’s access habits, or your internal policies. If your team reuses passwords, grants broad admin access by default, or skips workforce training, no amount of vendor-side encryption fixes that.

Your organization retains responsibility for the documented risk analysis, workforce access management, internal security policies, incident response planning, and correct configuration of whatever controls the host makes available. A host can hand you MFA as a feature; someone on your team still has to turn it on and enforce it for every account.

How Do You Evaluate and Choose a HIPAA Hosting Partner?

Comparing vendors on price and uptime alone misses the point. A hosting decision for ePHI needs a scoring framework that weighs legal exposure as heavily as technical performance.

1. Security posture (weight it heaviest). Does the vendor hold SOC 2 Type II, HITRUST CSF, or demonstrate clear NIST 800-53 alignment? Ask for the report, not just the logo.
2. Contractual completeness. Will they sign a BAA without resistance, and does that BAA include breach notification timing, subcontractor flow-down, and data return terms?
3. Operational support. What’s the actual incident response time commitment, and is there a named point of contact for security incidents, or just a general support queue?
4. Cost transparency. Does the pricing model separate infrastructure from managed compliance support, so you know exactly what you’re paying for at each tier?
5. Data locality and control. Where physically does the data reside, who can access it, and does the vendor’s subcontractor chain stay inside the United States?

The exact questions to put to any vendor on a discovery call: What’s the scope of your BAA? Who are your subcontractors, and do they each carry their own BAA? What’s your documented incident response time from detection to notification? Who holds the encryption keys, and can we get access to our own audit logs on demand?

Certain answers should end the conversation immediately. A vendor that refuses to sign a BAA, can’t produce any logging evidence, or won’t disclose its subcontractor chain isn’t a maybe. It’s a disqualifier.

Larger health systems often flip the weighting toward operational support and locality given more complex internal IT teams already handling day-to-day security.

Migration, Costs, and Timeline: What to Actually Expect

Moving PHI to a compliant host isn’t a weekend project, and providers who promise same-week cutovers for a full clinical system are usually skipping steps you’ll pay for later.

Cost drivers vary more by service model than by raw storage volume. A fully managed HIPAA hosting arrangement, where the vendor handles configuration, monitoring, and ongoing compliance support, costs more monthly than infrastructure-only hosting where your team manages configuration internally. Key management adds cost when you require customer-held keys rather than vendor-managed encryption. Logging retention length and compliance consulting hours are the other major variables; a vendor charging a flat low rate for “HIPAA hosting” with no mention of these line items is usually bundling far less than it appears.

A realistic phased timeline looks roughly like this, though every organization’s specifics shift these windows:

• Risk analysis and planning: two to four weeks, covering data mapping and a documented risk assessment.
• Contract negotiation: one to six weeks, depending on how much back-and-forth the BAA and SLA require.
• Provisioning and hardening: one to three weeks to configure access controls, encryption, and network segmentation.
• Testing and cutover: one to four weeks for validation, staff training, and a monitored go-live.

Before migration starts, your organization needs a documented risk analysis, workforce training scheduled, an incident response plan on paper, and a clear map of where every piece of PHI currently lives. Skipping data mapping is the most common cause of migration delays, because teams discover mid-project that PHI sits in places nobody accounted for.

Pro Tip: Run a pen test and a policy review within 90 days of cutover, not a year later. Vulnerabilities introduced during migration are easiest to catch, and cheapest to fix, before they’ve been live for months.

Post-migration, compliance isn’t a one-time checkbox. Plan for periodic audits, recurring penetration testing, and policy updates whenever your infrastructure or staff roles change.

What Small Practices Get Wrong About Hosting Vendors

Most guidance on this topic treats HIPAA hosting like a checkbox exercise: get a BAA, buy some encryption, done. That framing undersells how much of the actual risk sits in the gap between what a vendor promises in a sales conversation and what a contract legally obligates them to deliver.

Here’s the part that surprises a lot of practice managers: technical sophistication rarely causes HIPAA violations. Missing paperwork does. HHS enforcement patterns consistently show that organizations get penalized not because their encryption was weak, but because nobody signed a BAA before data moved to a cloud vendor in the first place. A practice can have excellent firewalls and still be in violation on day one of a hosting relationship if the contract paperwork lags behind the migration.

The other overlooked risk is subcontractor sprawl. A hosting vendor rarely operates in total isolation. It leans on a backup provider, a monitoring service, maybe a separate data center operator. If any link in that chain lacks its own BAA, your organization inherits that exposure even though you never chose that subcontractor directly. Ask every vendor for a subcontractor list before you sign, not after.

Where I’d push back on conventional advice: don’t wait for the 2025 Security Rule proposal to become final before requiring encryption and MFA as non-negotiable. Treat those as baseline requirements today. Vendors who are already building toward that standard are the ones worth trusting with ePHI for the next several years, not just this contract cycle.

Small healthcare practices in particular tend to underinvest in the evaluation step because it feels like overkill for a five-person office. It isn’t. A five-provider practice carries the same BAA obligation and the same OCR exposure as a hospital system. The scale of your organization changes the scoring weights, not the legal requirement itself.

— Matt

How Tatem Web Design Handles HIPAA Hosting for Florida Healthcare Practices

If your practice needs hosting that holds up under an OCR audit without the guesswork, Tatemweb builds that as a direct managed service rather than a bolt-on feature. For a medical practice, dental office, or health-focused nonprofit, that means one point of contact handling the BAA negotiation, the technical provisioning, and the ongoing monitoring, instead of juggling separate vendors for hosting, security, and compliance consulting.

A typical engagement starts with a risk review call: The service walks through your current infrastructure, identifies where PHI actually lives, and maps out what a signed BAA and hardened configuration would look like for your specific systems. From there, engagements generally include BAA support, secure provisioning with encryption and MFA built in from the start, and ongoing HIPAA compliance consulting so your controls keep pace as the Security Rule evolves.

Tatemweb also builds the website and hosting environment together for practices that need a public-facing site and a secure backend handled by the same team, which cuts down on the finger-pointing that happens when a hosting vendor and a web design firm blame each other for a misconfiguration. If you’re ready to see what a risk review looks like for your practice, contact the company directly to schedule that first conversation.

Sources

• Hhs
• NIST SP 800-66 (Introductory Resource Guide for Implementing the HIPAA Security Rule)
• HIPAA Security Rule to strengthen the cybersecurity of electronic protected health information | Federal Register
• Ecfr

FAQ

Which hosting companies are HIPAA compliant?

No hosting company is “HIPAA compliant” by default; compliance depends on the signed BAA, documented risk analysis, and technical safeguards in place for your specific account. Providers offering SOC 2 Type II reports, HITRUST CSF attestation, or NIST 800-53 aligned controls, paired with a willingness to sign a complete BAA, are the strongest candidates. The client offers managed HIPAA hosting with BAA support as part of its service.

Is GoDaddy hosting HIPAA compliant?

Standard consumer hosting plans from general-purpose providers typically don’t include a signed BAA or the audit logging and access controls the Security Rule requires. Before hosting ePHI on any platform, confirm in writing whether the provider will execute a BAA and document its technical safeguards; if they won’t, that platform isn’t a fit regardless of its uptime record.

What is the new HIPAA rule for 2026?

As of 2026, the 2025 Federal Register proposal to strengthen the Security Rule had not yet been finalized. The proposal would make encryption and multifactor authentication mandatory rather than merely “addressable,” so organizations should require both now rather than waiting for the final rule.

How much does it cost to have a HIPAA compliant server?

Costs vary based on whether you choose infrastructure-only hosting or a fully managed service that includes compliance consulting, key management, and extended log retention. Fully managed HIPAA hosting generally costs more per month than infrastructure-only plans, since it bundles configuration, monitoring, and ongoing compliance support rather than leaving those tasks to your internal team.

Do I need a separate SLA if I already have a BAA?

Yes. The BAA establishes legal obligations under HIPAA, while the SLA attaches measurable performance commitments, like uptime percentage, breach notification timing, and backup restore windows, that make those obligations enforceable in practice.

Recommended

• Florida HIPAA Compliance Company - HIPAA Cybersecurity Services
• Healthcare Website Design FL - Medical Web Development
• Why Secure Hosting Matters for Business Owners
• Benefits of Professional Web Hosting for Business Owners