HIPAA Compliant Website Hosting: What to Look ForWhat a host must sign, what it must let you control, and which providers publish a BAA.

Look for a host that signs a Business Associate Agreement (BAA), names the services the BAA covers, and gives you controls to encrypt, restrict and log access to patient information. No host is HIPAA certified. The practice stays responsible for the setup. We read each vendor page named here on October 10, 2026.

HIPAA website hosting at a glance

• BAA first: HHS says a practice that uses a cloud provider for patient data without a BAA "is in violation of the HIPAA Rules."
• No certificate: HHS says "OCR does not endorse, certify, or recommend specific technology or products."
• Covered services only: a BAA covers named services, not everything the host sells.
• Shared work: the host secures its platform. The practice configures access, logging and encryption.
• Ahrefs shows 300 US searches a month for "hipaa compliant website hosting" (checked October 10, 2026).

When does a medical website need HIPAA compliant hosting?

It needs one when the host stores or processes patient information for the practice. Contact forms that ask about symptoms, booking requests, intake forms and patient portals are common examples. HHS guidance on cloud computing treats the provider as a business associate. It adds: "This is true even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data." CSP means cloud service provider. Encryption does not remove the need for a BAA.

HHS allows a narrow exception for pure carriers. It says "the conduit exception is limited to transmission-only services for PHI." A web host that stores form entries or databases does more than transmit.

Is there a HIPAA certification for web hosts?

No. A badge that says "HIPAA certified hosting" has no official meaning. HHS says "OCR does not endorse, certify, or recommend specific technology or products." The large providers say the same. AWS writes: "There is no HIPAA certification for a cloud service provider (CSP) such as AWS." Google Cloud writes that "there is no certification recognized by the US HHS for HIPAA compliance." Ask for the BAA and the list of covered services instead of a badge.

Which hosting providers sign a BAA?

We read four vendor pages on October 10, 2026. All four publish a BAA path. The table records what each page says. Vercel's guide was last updated on October 2, 2026.

We did not check Netlify, Cloudflare, WP Engine, GoDaddy or other hosts today. This article gives no verdict on them. Website builders are a separate question. See Is Wix, Squarespace or WordPress HIPAA Compliant?

What should the BAA cover?

It should cover every service that touches patient information. A host sells many products. The BAA usually covers some of them. AWS tells customers "they should only process, store, and transmit protected health information (PHI) in the HIPAA-eligible services." Google Cloud tells customers to "Disable or otherwise ensure that you do not use Google Cloud Products that are not explicitly covered by the BAA."

List each part of your site: web server, database, file storage, backups, logs, email sending and form handling. Match each one to a covered service. A form plugin or email service from another vendor needs its own BAA.

What security controls should the host support?

It should let you meet the technical safeguards in the HIPAA Security Rule. HHS says the rule "sets forth the administrative, physical, and technical safeguards" for electronic patient information. HHS also says "the Security Rule is designed to be flexible, scalable, and technology neutral." The rule does not name a product. It names outcomes. HHS last reviewed its summary on August 7, 2026.

• Access control

  Each person has a separate login with the least access needed. Multi-factor sign-in is available for the hosting account.

• Audit logs

  HHS asks for mechanisms "to record and examine activity." The host keeps logs of who signed in and what changed.

• Integrity and backups

  HHS asks that patient data "is not improperly altered or destroyed." Backups are encrypted and sit inside the BAA.

• Transmission security

  HHS asks for measures "to guard against unauthorized access" in transit. The site forces HTTPS on every page and form.

Who is responsible, the host or the practice?

Both. Google Cloud says "complying with HIPAA is a shared responsibility between the customer and Google." Vercel says: "Your side of the shared responsibility model is to configure those controls." Microsoft says: "Your organization is wholly responsible for ensuring compliance with all applicable laws and regulations." A signed BAA on a badly configured server still leaves the practice exposed.

How do you check a host before you sign?

Follow five steps. HHS expects a risk analysis first. It asks a practice "to perform an accurate and thorough assessment of the potential risks and vulnerabilities" to its electronic patient information.

1. 1

   Map the patient data

   List every form, portal, upload and booking tool on the site. Note where each one stores its data.

2. 2

   Ask for the BAA

   Get the BAA and the plan it requires in writing. Walk away from a host that offers only a badge.

3. 3

   Match services to the BAA

   Check that the database, storage, backups and logs you plan to use appear on the covered list.

4. 4

   Configure the controls

   Turn on multi-factor sign-in, separate user accounts, audit logs, encryption and forced HTTPS.

5. 5

   Record and recheck

   File the BAA and your settings with your risk analysis. Recheck when you add a plugin, form or new service.

How Webpatch helps

Webpatch builds and manages websites for healthcare practices. We map where each site collects patient information. We match hosting, forms and storage to vendors that sign a BAA. We set up access, logging and HTTPS, and we keep the list current as the site changes. Our HIPAA website requirements checklist covers the rest of the site.

We are not a law firm. We work alongside your compliance adviser. Contact Webpatch to review where your website stores patient information.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.