If your website stores or handles electronic health data (ePHI) for a HIPAA covered entity, the host that keeps that data is a business associate.
You need a signed Business Associate Agreement (BAA) with that host before any ePHI goes there.
A BAA commits the host to protect the data and report problems. It does not cover your forms, plugins, email, user accounts or analytics. Those stay your job.
Some budget hosts refuse to sign one. Bluehost’s HIPAA help article says, “We do not sign Business Associate Agreements.”
HIPAA-ready hosting usually means dedicated servers or private cloud setups sold with a BAA.
Health data is one of the stricter hosting choices for regulated businesses. The focus here is HIPAA in the United States only.
Who HIPAA applies to
HIPAA’s privacy and security rules apply to covered entities and to the business associates that handle their health data.
HHS lists three types of covered entities:
- Health care providers such as doctors, clinics, psychologists, and dentists, “but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard”. Billing insurance electronically is the common example.
- Health plans, such as insurers and HMOs.
- Health care clearinghouses, which convert health data between formats.
A business associate is a person or company that performs work for a covered entity involving protected health information (PHI). It includes subcontractors working for another business associate.
ePHI is PHI held or sent in electronic form. On a website, that can mean a booking request, a symptom field or a patient portal record.
If you are neither a covered entity nor a business associate, HIPAA may not apply to you, though other privacy laws might.
How HIPAA compares with GDPR and PCI is covered in the overview of compliance frameworks side by side.
When a host becomes a business associate
A host becomes a business associate when it creates, receives, maintains or transmits ePHI for a covered entity or another business associate.
HHS’s guidance on HIPAA and cloud computing treats cloud service providers (CSPs) that store ePHI as business associates. A web host that stores your site’s ePHI fits that description.
Three points from that guidance trip people up:
- Encryption doesn’t remove the host’s role. HHS says, “Lacking an encryption key for the encrypted data it receives and maintains does not exempt a CSP from business associate status”. This is the “no-view” service case.
- The conduit exception is narrow. It covers transmission-only services with transient access, not a host that stores data.
- No BAA is a violation. HHS says using a CSP to maintain ePHI without a BAA puts the covered entity or business associate “in violation of the HIPAA Rules”.
HHS also says a covered entity may use a cloud provider for ePHI if it signs a BAA, follows the HIPAA Rules, and runs a risk analysis for that setup.
What a BAA must contain
A BAA is a contract that limits how the host may use health data and requires it to protect, report, and return that data.
HHS publishes sample business associate agreement provisions. The page says the sample language is not required, but its points show what a BAA covers:
- Permitted uses: the host may not use or disclose PHI beyond what the agreement or law allows.
- Safeguards: it must use “appropriate safeguards” to prevent other uses.
- Reporting: it must report misuse, including breaches of unsecured PHI.
- Subcontractors: anyone it hires to handle the PHI must agree to the same terms.
- Patient rights: it must help you meet access, amendment, and accounting-of-disclosure duties.
- HHS access: it must make its records available to HHS for compliance checks.
- End of contract: it must return or destroy PHI when the agreement ends.
- Termination: you can end the contract if it breaks a material term.
Read the fine print: HHS’s cloud guidance says the rules “do not expressly require” a provider to give you documentation or let you audit its security.
If you want audit reports, ask for them in the contract.
HHS also suggests that service level agreements (SLAs) address availability, backup and data recovery, and how data is returned. They should stay consistent with the BAA.
The Security Rule safeguards in brief
The HIPAA Security Rule groups its protections for ePHI into administrative, physical, and technical safeguards. Many technical ones overlap with everyday hosting security controls.
The Security Rule summary describes them this way:
- Administrative: a risk analysis, a security official, workforce training, access management, incident procedures, and contingency plans.
- Physical: limits on access to facilities and machines, plus rules for disposing of devices and media that held ePHI.
- Technical: access controls so “only authorized persons” can reach ePHI, plus audit controls, integrity checks, authentication, and transmission security.
A good host handles much of the physical layer and some of the technical layer. On a website, transmission security starts with HTTPS and a valid TLS certificate.
Most administrative safeguards are about your own organization.
HHS has proposed changes to the Security Rule. Its regulatory initiatives page lists the December 27, 2024 proposal as a proposed rule. Check its status before you plan around it.
What the host covers and what you still own
A BAA-backed host protects the infrastructure it runs; you remain responsible for everything you add to the site and how your staff uses it.
| Area | Usually the host, under a BAA | Usually you |
|---|---|---|
| Data center and hardware | Physical security, hardware disposal | Nothing, if fully hosted |
| Network and server | Firewalls, server patching (on managed plans) | Settings you change, apps you install |
| Website access | Server-level logins | WordPress users, strong passwords, two-factor login, removing old staff |
| Forms and plugins | Nothing | Which plugins collect ePHI and where they send it |
| Only if the host’s mail service is in the BAA | Notification emails and the mail provider you use | |
| Backups | Backups the host stores, if covered | Off-site copies, backup plugins, retention |
| Encryption | Disk or transit encryption as stated | Encrypting ePHI your app stores |
The host side usually maps to server features such as firewalls and patching, the kind listed among secure hosting features to compare.
Liquid Web’s HIPAA hosting page says this plainly. HIPAA hosting “does not take care of HIPAA compliance entirely”, and encrypting ePHI on your server is “your responsibility”.
The site side of that work overlaps with general WordPress hardening steps, such as limiting admin accounts and keeping plugins updated.
Which hosting types usually offer a BAA
BAAs are mostly offered on dedicated servers and private or managed cloud products built for regulated data.
| Hosting type | BAA availability | What to check |
|---|---|---|
| Budget shared hosting | Bluehost and Hostinger exclude it in their terms | Treat no written BAA offer as a no |
| Managed WordPress | Varies by provider | Whether the BAA covers your plan, backups and email |
| VPS and cloud servers | Some providers, often on specific products | Which products and data centers the BAA names |
| Dedicated and private cloud | Most common place to find a BAA | The exact server package and add-ons covered |
On shared hosting plans, many customers share one server and one support team. Ask for a BAA in writing rather than assume one exists.
Hostinger’s hosting agreement says its services “are not intended to provide a PCI (Payment Card Industry) or HIPAA (Health Insurance Portability and Accountability Act) compliant environment”.
Liquid Web, for example, says on its HIPAA page that it provides “signed Business Associate Agreements (BAAs) for all HIPAA-ready hosting environments.”
That page lists a standalone HIPAA server, a server with a firewall, and a multi-server package.
Liquid Web’s security and trust page says its managed dedicated and cloud dedicated solutions were independently audited for HIPAA safeguards.
It does not name managed VPS, so confirm the product before you buy.
Common traps on health websites
Most HIPAA problems on small health sites come from add-ons and habits, not from the server itself.
- Contact forms that email submissions. Many WordPress form plugins send the full message by email. If the form collects health details, that email and its mail provider handle ePHI too.
- Email without a BAA. A free mailbox or your host’s basic email may not be covered. Check whether the mail service is named in a BAA.
- Tracking pixels and analytics. Ad pixels and analytics tags can send page and visitor data to third parties.
- Chatbots and widgets. HHS lists AI chatbots on patient portals among its business associate examples.
- Backups and staging copies. A copy of the database on a third-party storage service is ePHI in another place.
On tracking, HHS’s online tracking technologies bulletin now opens with a court notice. On June 20, 2024, a federal court in Texas vacated part of it.
The vacated part concerned tracking that links an IP address to a visit to a public, no-login page about health conditions or providers.
Guidance on logged-in pages, such as patient portals, remains.
That bulletin also says a privacy policy notice alone does not permit sharing PHI with a tracking vendor. A tracking vendor that meets the business associate definition needs a BAA.
Off-site backup copies have their own risks, described in the guide to backup security gaps that hosts leave.
Confirm your HIPAA obligations with a qualified advisor or attorney before you collect patient data online.
Three scenarios: what you likely need
The hosting and contract you need depends on what your site collects, where it sends it, and who you are.
A therapist’s contact form
You run a solo therapy practice and bill insurance electronically. Your WordPress site has a contact form asking “What brings you to therapy?”
- Likely ePHI: yes, once a prospective client types personal health details.
- Simplest fix: remove health questions from the form. Ask only for a name and a way to reach them, then talk in a covered system.
- If you keep the field: use a form service that signs a BAA and doesn’t email full submissions. Check that no pixel loads on that page.
- Hosting: a brochure site without ePHI can stay on ordinary hosting once the form no longer collects health details.
A clinic booking site
Your clinic lets patients book appointments online. The booking page asks for date of birth, reason for visit, and insurance details.
- Likely ePHI: yes. Appointment details tied to a person are health information when a covered entity holds them.
- Options: use a scheduling vendor that signs a BAA and keep the data on its system, or host the booking app yourself on a BAA-backed server.
- Check: confirmation emails, reminder texts, and analytics on the booking pages. Each one is a place ePHI can leak.
A telehealth app
You are building a telehealth app for clinics. It stores visit notes and messages, so you are a business associate of every clinic you serve.
- Hosting: you need a host or cloud provider that signs a BAA covering the exact servers, databases, storage, and backups you use.
- Your duties: a risk analysis, access controls, audit logs, and encryption for the data your app stores.
- Contracts: you sign BAAs with the clinics, and your own vendors sign with you.
For this kind of build, a dedicated or private cloud setup is the usual starting point. The basics of how a dedicated server works explain why isolation helps here.
Where to start your shortlist
Start with providers that state on their own pages which products come with a signed BAA, then match those products to your setup.
If you need a provider that publishes HIPAA reports and signs BAAs, Liquid Web is one documented option.
Its HIPAA-ready servers and compliance reports are covered in more depth in the review.
For wider options, the roundup of business hosts with compliance paperwork compares support, security, and pricing. Confirm BAA coverage with any host on that list before moving health data.
Frequently asked questions
Is shared hosting HIPAA compliant?
Not for ePHI unless the host signs a BAA that covers that plan.
Bluehost says it does not sign BAAs, and Hostinger’s terms say its services are not intended to provide a HIPAA compliant environment.
Get the host’s answer in writing before any patient data goes there.
Does a contact form on a medical website need to be HIPAA compliant?
It does if a covered entity collects health details through it.
The simplest step is to keep health questions off public forms, or to use a form service that signs a BAA.
Is WordPress HIPAA compliant?
WordPress is software, so it can’t be compliant on its own.
Compliance depends on how you host it, which plugins you use, who can log in, and where form data and emails go.
Do I need a BAA with my email provider?
Usually yes, if messages with ePHI are stored in its mailboxes. HHS limits the conduit exception to transmission-only services, and a mailbox stores messages rather than just passing them on.
Check which of the provider’s plans its BAA names.
Can I use a host that won’t sign a BAA?
Only for parts of your setup that never touch ePHI.
You can split them: keep the public site on ordinary hosting and send bookings or patient messages to a vendor that signs a BAA.
How we researched this
The rules on covered entities, business associates, cloud providers, and BAAs come from HHS.gov. We used its covered entities page, business associate guidance, cloud computing guidance, and sample BAA provisions.
The safeguard summary, proposed rule status, and tracking guidance also come from HHS.gov. We checked all HHS pages on October 4, 2026.
Liquid Web’s statements come from its HIPAA hosting and security and trust pages.
Bluehost’s HIPAA help article and Hostinger’s hosting agreement supplied the shared hosting examples. All were checked the same day.
None of our test accounts handle health data, so no first-party results are used.
The HostingGuider review and sourcing process explains how provider claims are checked and labeled.
