Blog

HIPAA Compliant App Hosting: Which Platforms Sign a BAA, and What They Charge (2026)

Most app platforms will now sign a BAA, but each one hides it behind a plan, an add-on, or a product line. This guide checks Heroku, Vercel, Netlify, Render, Railway, Fly.io, Supabase, Firebase, DigitalOcean, and AWS against their own pages, prices the compliant tier of each, and shows what you still configure. Verified September 11, 2026.

Joseph Abear · Sep 11, 2026

Is AWS Lambda HIPAA Compliant? The BAA, the Traps, and 7 Settings (2026)

AWS Lambda is HIPAA eligible, not HIPAA compliant by itself. AWS covers Lambda under its BAA; your functions become compliant after you accept the BAA, keep every service in the chain eligible, secure secrets, keep PHI out of logs, lock function URLs, and turn on the right audit trail. The verified 2026 checklist.

Joseph Abear · Sep 7, 2026

Is Amazon RDS HIPAA Compliant? The BAA, the Engines, and 6 Settings (2026)

Amazon RDS is HIPAA eligible, not HIPAA compliant by itself. AWS covers six RDS engines under its BAA; the database becomes compliant after you accept the BAA and set encryption, TLS, network isolation, access, logging, and backups. Here is the verified 2026 checklist.

Joseph Abear · Sep 4, 2026

HIPAA Certified Hosting Does Not Exist: What to Ask Instead (2026)

No HIPAA certification exists: HHS issues none and OCR recognizes no private program. So what are all those "HIPAA certified" badges, what do SOC 2 and HITRUST actually prove, and how do you verify a host with no certificate to check? The five questions with checkable answers, including ours.

Joseph Abear · Aug 31, 2026

Accidental HIPAA Violation: What to Do in the First 24 Hours (2026)

An accidental HIPAA violation is not automatically a breach, and almost never a career-ending event when handled fast and honestly. The ordered decision path for the first 24 hours: contain, report, check the three legal exceptions, run the four-factor test with a worked example, and notify only if the test says so. Plus what really happens to the person who made the mistake.

Joseph Abear · Aug 28, 2026

HIPAA MFA Requirements: What Applies Now and What Changes in 2027

HIPAA never names MFA, yet single passwords on patient-data systems are close to indefensible in 2026, and a proposed rule would make MFA explicitly mandatory on a July 2027 timeline. The two-part answer, what counts as MFA, the rollout order that works, and the website logins everyone forgets.

Joseph Abear · Aug 28, 2026

HIPAA Compliant WordPress Plugins: What Exists and What Cannot (2026)

There is no plugin that makes a WordPress site HIPAA compliant, and knowing why saves you the most expensive misunderstanding in healthcare WordPress. The six real plugin categories, the one test that sorts safe plugins from risky ones, why themes are cosmetic to compliance, and the jobs only the hosting layer can do.

Joseph Abear · Aug 26, 2026

Is WooCommerce HIPAA Compliant? The Layer-by-Layer Verdict for 2026

WooCommerce is self-hosted software, so it inherits its HIPAA answer from the stack around it: the hosting, the extensions, and whether what you sell turns order data into PHI. The layer-by-layer verdict, the payment carve-out most guides get wrong, and the build for stores that need it.

Joseph Abear · Aug 25, 2026

How to Make Your Website HIPAA Compliant: 7 Steps in the Right Order (2026)

Most guides start with the SSL certificate. That is backwards. The seven steps in the order that works: map which pages touch patient data, get the BAA, rebuild the forms, strip the trackers, lock down access, verify the ops layer, and write the risk analysis. With the rule behind each step, real costs, and the parts you can do yourself for free.

Joseph Abear · Aug 24, 2026

Managed vs Self-Managed HIPAA Hosting: Which One Fits Your Practice in 2026

Managed, self-managed, or regular hosting? Regular is out for patient data, because no BAA exists. The other two are both compliant; the difference is who owns the server at 2 a.m. The side-by-side table, real 2026 prices, and a five-question test that tells you which tier fits, including when neither does.

Joseph Abear · Aug 19, 2026

HIPAA Risk Analysis: The 9 Elements OCR Looks For in 2026

The risk analysis is the one document OCR asks for first and the one most practices cannot produce. Its nine required elements, why the website is the system most analyses leave out of scope, what OCR's 2024 enforcement initiative is finding, and how a small practice builds a defensible one with HHS's free tool.

Joseph Abear · Aug 18, 2026

HIPAA Compliance Checklist for Websites: The 12 Items That Matter in 2026

Most HIPAA checklists cover the whole practice. This one covers the website alone, the system practices audit last and regulators find first. Twelve items with the rule, the two-minute check, and the fix for each, the three that carry most of the risk, and the one document OCR asks for first.

Joseph Abear · Aug 17, 2026