If a vendor's servers will store or process your patients' data, what matters is a signed agreement and documented safeguards, not a label on a sales page. The vendor must sign a BAA and maintain the required safeguards. Your practice must still configure and run the service correctly.
What HIPAA-compliant hosting means
HIPAA-compliant hosting is server, cloud or website hosting where the provider signs a business associate agreement (BAA) and maintains the safeguards required to store or process ePHI for a healthcare organization.
The term is industry usage, not a legal category. HIPAA does not define "compliant hosting," and no government program certifies or endorses hosting providers.
The servers and data centers can be the same ones behind regular hosting. The differences are in the contract and the controls:
| Regular hosting | HIPAA-compliant hosting | |
|---|---|---|
| Signed BAA | No | Yes, before any ePHI is stored |
| Business associate obligations | Not accepted | Accepted in writing |
| Access controls and audit logs | Varies | Documented |
| Encryption and backups | Varies | Documented |
In practice at a clinic or small practice
Who needs it. Any practice needs it when ePHI sits on a vendor's servers. That includes website forms that collect symptoms or insurance details, an intake portal, staff tools and cloud file storage. A brochure website with office hours and directions that collects no patient data is generally a lower-risk case, but confirm with your privacy officer before you decide it needs no BAA.
Office managers usually meet the term in situations like these:
- An online intake form vendor that receives new-patient paperwork
- A cloud file share where the front desk saves referral letters or insurance card scans
- A staff chat app where team members mention patients while coordinating schedules
Each of these vendors needs its own signed BAA before any PHI goes in. A BAA with one vendor does not extend to the file-sync or automation tools connected to it. Each of those tools needs its own agreement too.
Shared responsibility. The host secures the infrastructure. That covers the data center, the servers, encryption at rest and backups. The practice is still responsible for:
- Deciding who gets access, and at what level
- Removing access when staff leave
- Securing the phones and laptops staff use
- Training staff on what belongs in which system
A compliant host does not make a practice compliant by itself. A front desk login shared by five people is a practice problem, not a hosting problem.
Not to be confused with
"HIPAA-certified hosting." There is no official HIPAA certification. SOC 2 and ISO 27001 are separate third-party attestations. They can show that a vendor runs security controls well, but they are not HIPAA approval and do not replace a BAA.
HIPAA-compliant workspace or messaging. These terms describe an application, such as chat, files and tasks, that runs on top of hosting. The app vendor needs its own BAA with your practice. That holds even if the vendor's own cloud provider has signed a BAA with the vendor. The cloud provider's agreement does not cover you.
What the rules say
- A business associate is a person or entity that creates, receives, maintains or transmits PHI on behalf of a covered entity.
- A covered entity must have satisfactory written assurances, in the form of a BAA, before a business associate handles PHI.
- The HIPAA Security Rule requires administrative, physical and technical safeguards for ePHI.
- Encryption is an addressable implementation specification, not an automatically required one.
- Under HHS guidance on cloud computing, a cloud provider that stores ePHI is a business associate even if the data is encrypted and the provider holds no decryption key. Encryption alone does not remove the need for a BAA.
- The conduit exception is narrow. It covers transmission-only services and does not apply to a provider that stores data beyond what transmission requires.
Related reading
- Business associate agreement (BAA): what the agreement must contain
- How a staff chat vendor documents hosting, BAA and security: one example of how a vendor states hosting, BAA availability and plan scope
- Healthcare operations glossary: related terms
Where Chanty fits. chanty.health is published by Chanty, a team chat for clinic staff with a signed BAA from the Business plan. If your team still coordinates in personal group chats, see how HIPAA-compliant staff chat works or start free.