HIPAA compliant website hosting: when you need it, what to require

Do you need HIPAA compliant hosting?

Trace a single form submission. Where does it go when the patient clicks Send?

• It's stored on your web server or a database behind it. The host maintains PHI. You need a host that signs a BAA.
• It goes straight to a separate form tool under its own BAA, and nothing is saved on your server. Your host may not need a BAA, provided no patient data reaches it in logs, backups or email relays.
• It's emailed to the front desk from the server. The server and the email service both handle PHI.

Encryption doesn't remove the host from the picture. HIPAA's definition covers anyone who "creates, receives, maintains, or transmits" PHI (45 CFR 160.103 (opens in a new tab)), and the 2013 Omnibus Final Rule preamble says a data storage company "qualifies as a business associate, even if the entity does not view the information" (Federal Register (opens in a new tab)). Microsoft's own page puts it plainly: a cloud provider a covered entity uses "is a business associate under HIPAA" (Microsoft Learn (opens in a new tab)).

For the wider picture of where patient data enters a site, see the HIPAA compliant website guide.

What HIPAA requires of a hosting provider

A host holding PHI must follow the Security Rule as a business associate. In practice that means administrative, physical and technical safeguards sized to the risk. The rule lets each entity weigh its size, technical infrastructure, costs and "the probability and criticality of potential risks" (45 CFR 164.306(b) (opens in a new tab)), so there is no single hardware spec. What you should expect a host to cover, from 45 CFR 164.312 (opens in a new tab):

• Access control: unique user IDs for anyone who can reach the server (required), emergency access procedures (required), automatic logoff and encryption (addressable).
• Audit controls: mechanisms to "record and examine activity" on systems containing ePHI.
• Integrity and authentication: protection against improper alteration, and verification that users are who they claim.
• Transmission security: HTTPS for every page and connection.

"Addressable" means the host implements it or documents why an equivalent works better (45 CFR 164.306(d) (opens in a new tab)). For a host storing patient forms, ask to see that encryption at rest is in place rather than reasoned away.

The BAA: what your host must sign

The host's BAA must meet the same requirements as any other: permitted uses only, Security Rule compliance, reporting of security incidents and breaches, written terms for its own subcontractors, return or destruction of data at the end, and your right to terminate. Our guide to what a BAA must cover lists each clause.

Two hosting-specific points matter most:

1. Scope. Cloud BAAs usually cover named services, not the whole catalog. AWS says PHI should be processed, stored and transmitted only in its HIPAA-eligible services (AWS (opens in a new tab)). Google Cloud says that if you can't disable an unsupported service, "you must not use it for PHI" (Google Cloud (opens in a new tab)).
2. Incident reporting. The BAA must require the host to report security incidents (45 CFR 164.314(a)(2)(i)(C) (opens in a new tab)). The regulation's outer limit for breach notice is 60 calendar days after discovery (45 CFR 164.410 (opens in a new tab)); negotiate shorter.

Large providers sign their own standard BAA, not yours. Microsoft says it "can't use a customer's Business Associate Agreement."

Shared, VPS and managed hosting: the risk differences

Google Cloud's page sums up the cloud model: HIPAA compliance "is a shared responsibility," and you are responsible for an environment "properly configured and secured according to HIPAA requirements." A BAA with a cloud provider doesn't configure anything for you.

Backups, logging and incident response

Three Security Rule requirements land directly on hosting, all from 45 CFR 164.308 (opens in a new tab):

• Backups. A data backup plan is required: procedures to "create and maintain retrievable exact copies" of ePHI. Ask where backups are stored, whether they're encrypted, and how long restores take. If backups go to another provider, that provider is in your BAA chain.
• Logging and review. Information system activity review is required: regularly reviewing audit logs, access reports and security incident tracking. Ask how long logs are kept and who reviews them.
• Incident response. Security incident procedures are required: identify, respond, mitigate and document. Ask for the host's written process and how quickly it would call you.

Logs themselves can contain PHI, for example a URL with a patient's name in a query string. Treat log storage as part of the hosting chain. For every item and who owns it, use the HIPAA website checklist.

What HIPAA hosting costs and why

We don't publish price ranges for HIPAA hosting because quotes vary widely by setup. What drives the number:

• Isolated infrastructure rather than shared servers.
• Logging, monitoring and log retention.
• Encrypted backups and tested restores.
• Support with defined response times, including security incidents.
• The BAA itself. Some vendors include it; others charge for a HIPAA tier or add-on. HighLevel, for example, lists its HIPAA module at "$297 per month (or $2,970 per year)" as of October 2026 (HighLevel (opens in a new tab)).

Compare total cost, not the hosting line alone. Forms, email and chat each need their own BAA if they're separate vendors. For broader budgets, see what a practice website costs.

Questions to ask a HIPAA hosting provider

1. Will you sign a BAA, and which services and plan does it cover?
2. Is our data on infrastructure shared with other customers?
3. Is data encrypted at rest and in transit, including backups?
4. Where are the servers and the backups, by country?
5. Which subcontractors can access our data, and does each have a BAA with you?
6. How long are access and audit logs kept, and who reviews them?
7. How fast will you notify us of a security incident or breach?
8. What happens to our data, including backups, when we leave?

Canadian clinics have a different question: whether patient data must stay in Canada. See Canadian data residency.

Where Medfy fits

Hosting is included in Medfy's $349/month base plan, along with the rebuilt website on your domain and its HIPAA-compliant forms; see Medfy pricing. Patient information from forms, chat and the CRM is stored in separate, encrypted HIPAA databases in the US or Canada. Medfy signs a BAA with each practice before any patient data flows, and ad platforms never receive patient data. Details are on Medfy security and HIPAA.

Start with a free audit — then see a free preview of your rebuilt website. The free marketing audit checks your current site, including privacy risks such as pixels on patient forms.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

Do I need HIPAA compliant hosting for a medical website?

Only if the server stores or processes patient information, such as form submissions, chat transcripts, booking details or portal data. A brochure site whose forms are handled entirely by a separate tool under a BAA can sit on ordinary hosting, as long as no patient data touches it. Map where your submissions land before you pay for anything, and confirm the answer with your compliance officer.

Are AWS, Google Cloud and Azure HIPAA compliant?

None is compliant on its own; each signs a BAA covering specific services. AWS says PHI belongs only in its HIPAA-eligible services, Google Cloud lists covered products and says HHS has no certification program, and Microsoft offers its BAA by default to covered entities. Configuring those services correctly stays your responsibility, or your website vendor's. Confirm the setup with your compliance officer.

What should a hosting BAA include?

Everything HIPAA requires of any BAA: permitted uses only, Security Rule safeguards, reporting of security incidents and breaches, written flow-down to the host's own subcontractors such as backup providers, help with patient rights, HHS access to records, return or destruction of data at the end, and your right to terminate. Ask for a breach-notice window shorter than 60 days and have your attorney review it.

How much does HIPAA compliant hosting cost?

There is no standard price. Cost depends on isolated infrastructure, logging and monitoring, encrypted backups, support response times and whether the BAA is included or sold as an add-on. Get written quotes that name what the BAA covers, and compare the total with forms and email included. Medfy includes hosting in its $349/month base plan, with a BAA signed before patient data flows.