Healthcare IT Hosting: Which Practice Systems Need a HIPAA Host, and Who Signs Each BAA (2026)
HIPAA Compliant Hosting · https://hipaacomplianthosting.com/blog/healthcare-it-hosting
Last updated: October 19, 2026
Healthcare IT hosting means the servers and services behind a practice's systems: the website, portal, EHR, email and automations. Any outside company that hosts patient data for you must sign a business associate agreement (BAA) first. Your website may sit on one host, your EHR with its vendor and your email in a Google or Microsoft suite. Add the tools a past developer set up, and you may have no single list of who signs what.
This guide maps healthcare IT hosting system by system: where each one usually runs, who signs its BAA and where patient data slips between them. We run self-hosted sites and apps on single-tenant AWS through our healthcare hosting, from $229 a month. We sell this hosting, so weigh our view with that in mind.
TL;DR: Quick answer
In healthcare IT hosting, a vendor that creates, receives, maintains or transmits patient data on your behalf is generally a business associate (160.103). Its BAA must come before the data (164.308(b)).
Each BAA covers only that vendor's services. The Google and Microsoft suite BAAs do not reach a website, form or automation hosted elsewhere.
OCR says its investigations "frequently find" organizations unsure where all their ePHI is. The current rule does not require an IT asset inventory, but OCR says one "could be a useful tool".
Your risk analysis must reach all your ePHI. OCR's 2025 settlements include a PACS imaging server and a discontinued portal pilot.
A January 2025 proposal would require a written asset inventory and network map. It is not final, and the federal agenda lists July 2027.
We host self-run sites and apps on single-tenant AWS, one server per plan, from $229 a month, with a BAA within 24 hours of signup. See current plans and pricing.
What healthcare IT hosting covers in a practice
For healthcare IT hosting, start with what you run, not with who hosts it. A practice's systems fall into four layers.
Patient-facing. The website, forms and booking pages, and any patient portal.
Clinical. The EHR and practice management system, imaging (PACS) and file shares, and links to labs and e-prescribing.
Communication. Email and the office suite, texting and reminders, and telehealth video.
Back office and glue. Billing, automations and AI tools, plus the backups and logs behind them.
A system can keep patient data with a SaaS vendor, on a server run by you, a developer or a host, or nowhere. The test for who signs comes from 45 CFR 160.103. A business associate "creates, receives, maintains, or transmits" protected health information for you. Its subcontractors that handle that data count too.
OCR made the case for this list in its Summer 2020 newsletter on IT asset inventories. "Although the Security Rule does not require it," OCR wrote, an up-to-date inventory can support an enterprise-wide risk analysis.
On April 10, 2025, OCR announced a $350,000 settlement with Northeast Radiology. The company reported that unauthorized people accessed radiology images on its PACS server from April 2019 to January 2020. It notified 298,532 patients. OCR found it "failed to conduct an accurate and thorough risk analysis".
Put your system list at the front of your HIPAA risk analysis, which must reach all the ePHI you hold. That makes the list the backbone of healthcare IT hosting decisions: every system needs an owner, a host and a BAA answer.
How we handle it: We host the systems you run yourself on any of our 17 supported platforms. Examples are a WordPress site, a Laravel portal, n8n automations or a Docker app.
Who hosts each system, and whose BAA covers it
Every system lands on one of four routes.
A SaaS vendor must sign for its own services, or it gets no patient data.
Your own server. In the office, no host signs a BAA and the hosting safeguards are yours. An outside IT or software vendor that accesses the data must still sign. In a cloud account you run, you accept the cloud's BAA, keep patient data in its HIPAA eligible services and run the rest.
A managed host must sign for the servers and services it runs.
No patient data means no BAA for that system.
Here is how that plays out for healthcare IT hosting, system by system.
System | Where it usually runs | Who signs the BAA | What to check |
|---|---|---|---|
Website with no patient data | Any web host | No BAA needed | No form asks for health details; no trackers on login or booking pages |
Website forms and booking pages | Your web host or a form vendor | Whoever stores or sends the entries | Where entries rest; notification emails |
Patient portal | A portal vendor, or your own site | The vendor, or your host | Logins, uploads and audit logs |
EHR and practice management | A cloud EHR vendor, or self-hosted | The vendor; if self-hosted, your outside cloud or managed host, for its layer | Exit terms, restore tests, who patches the EHR, vendor support access |
Email and office suite | Google Workspace or Microsoft 365 | Google or Microsoft, for covered services | Third-party add-ons; the server or relay that sends form email |
Texting, reminders and telehealth | SMS and video vendors | Each vendor that stores or handles patient data, under its own BAA | A signed BAA before data moves |
Imaging (PACS) and file shares | An office server or the cloud | In your office, any vendor with access; in the cloud, its vendor or host | Whether it is reachable from the internet |
Automations, apps and AI tools | n8n, Docker apps, model APIs | Your host for the server; each API provider that gets patient data | Execution history and logs |
Backups and logs | Your host or a backup vendor | Whoever stores the copies | Copies of patient data are ePHI too |
As of October 19, 2026, Google says customers without a signed BAA "must not use PHI" in Workspace, and its BAA leaves out third-party add-ons. Microsoft's BAA covers "in-scope Microsoft services", but using them "doesn't on its own achieve HIPAA compliance".
AWS lists EC2, EBS, CloudFront, AWS WAF and CloudWatch Logs as HIPAA eligible (list updated October 15, 2026). Customers "still must configure these services consistent with HIPAA requirements", AWS adds. So healthcare IT hosting on a cloud account still needs someone to configure those services and run the server and apps above them.
Our guides to medical website hosting and HIPAA compliant EHR hosting cover those rows, and our patient portal build guide covers a portal you build.
How we handle it: Our BAA covers the servers and services we run. Your EHR, email, texting and telehealth vendors need their own.
Where patient data slips between systems
One gap runs from an intake form to a staff inbox, through the site database and a notification email. For the suite side, see what the Google Workspace BAA does not cover.
The harder gaps sit between vendors. Intake details get retyped or sent into the EHR. Portal uploads land in storage, then in backups. An automation sends text to a model API, and its execution history can keep copies. In healthcare IT hosting, each handoff is a place where one BAA ends and the next may not start.
Storing patient data for you makes a host a business associate, even if it cannot read it. HHS says so even for a cloud provider without the decryption key.
A business associate may pass ePHI to a subcontractor only with the same satisfactory assurances (164.308(b)(2) and 164.502(e)(1)(ii)). Its BAA must also require it to report "any security incident of which it becomes aware" (164.314(a)(2)(i)(C)). Before you sign any healthcare IT hosting contract, check what a hosting BAA should cover.
The other gap is a system outside daily use: a pilot, a staging copy or an old office server. Two 2025 OCR cases show how long an exposure can last. Part of healthcare IT hosting is shutting down systems you no longer use.
Deer Oaks, The Behavioral Health Solution. The company said a coding error in a discontinued portal pilot let search engines cache ePHI from at least December 2021 until May 19, 2023. OCR found the discharge summaries and initial assessments of 35 people were publicly accessible. Its $225,000 settlement, announced July 7, 2025, also covered a separate 2023 breach.
Health Fitness Corporation. OCR announced a $227,816 settlement with this business associate on March 21, 2025. The company reported that from about August 2015, a software misconfiguration on the server housing ePHI made it discoverable to web crawlers.
How we handle it: Your site runs on single-tenant AWS with encryption at rest and in transit, and every plan includes tested encrypted backups.
What a host should run, and what stays yours
On our plans, shared responsibility for healthcare IT hosting splits like this.
The host runs the server, the edge (CDN and web application firewall), encryption, backups and snapshots, infrastructure audit logging, and its own BAA.
You keep app users and roles, who sees which record, your policies and sanction policy, your risk analysis, other vendors' BAAs and each app's settings.
Who sees which record stays your decision; see real cases of staff who misused patient records.
The contingency plan standard, 164.308(a)(7), requires a data backup plan with "retrievable exact copies" of ePHI, a disaster recovery plan and an emergency mode plan. Testing and revision, and the criticality analysis, are Addressable.
Addressable does not mean optional. Under 164.306(d)(3), you assess each one, then implement it or document why not, with an equivalent measure if reasonable. Encryption, 164.312(a)(2)(iv), works the same way. A host's backups feed your plan, but outsourcing healthcare IT hosting does not outsource the plan itself.
Backups and restore tests are mapped in HIPAA backup and disaster recovery.
How we handle it: Every plan includes CloudFront CDN, a web application firewall and EBS storage with 7-day snapshot retention. It also includes encryption at rest and in transit, six-year audit logging and tested encrypted backups. See what we run and what you run.
How to consolidate healthcare IT hosting in five steps
You do not need the final rule to start consolidating healthcare IT hosting. Steps 1, 2 and 5 rest on current OCR guidance and rule text.
List every system. Record each one's identification, version, person accountable and location. OCR suggested these fields in 2020. The proposed HIPAA Security Rule update would require them, but it is not final.
Draw the data flows. OCR's 2025 settlement releases recommend identifying "how ePHI enters, flows through, and leaves" your information systems. The proposal would call this a network map, including access from outside.
Sort each system. SaaS: collect the BAA. Self-run: move it or secure it. No patient data: write down why. The proposal would add written verification from business associates at least every 12 months.
Move the systems you run to a host that signs for them. Our guide shows how to migrate to HIPAA compliant hosting with no gap in coverage.
Recheck after changes that affect ePHI. The current rule already requires periodic review of your documentation, with updates "in response to environmental or operational changes affecting the security of" ePHI (164.316(b)(2)(iii)). Moving a system that holds ePHI to a new host is one such change. The proposal would add a review of the inventory and map "at least once every 12 months".
How we handle it: Your first month includes 4 hours of migration and configuration, then $175 an hour, quoted before work starts.
How we handle healthcare IT hosting on single-tenant AWS
Our HIPAA compliant healthcare hosting runs your self-hosted sites and apps on our 17 supported platforms. That makes us one piece of your healthcare IT hosting, not all of it: each SaaS vendor that holds patient data needs its own BAA.
One single-tenant AWS server per plan, in one availability zone. A multi-zone design is quoted separately.
Every plan includes CloudFront CDN, a web application firewall, 7-day snapshots, encryption at rest and in transit, six-year audit logging and tested encrypted backups.
A BAA within 24 hours of signup, before patient data moves. Our BAA covers the servers and services we run.
Plans from $229 a month, and from $259 for the Performance tier (n8n, Drupal, Strapi, Docker and Phalcon). Six sizes run from Starter to Network, and monthly plans have no long-term contract.
When are we the wrong choice for healthcare IT hosting? If each system holding patient data is a SaaS tool with its own BAA, and your website collects none, you do not need us. If you need your host's own SOC 2 report, look elsewhere. HIPAA Compliant Hosting does not hold SOC 2 or HITRUST certification. Root access needs an Enterprise engagement, and a platform outside our 17 may not fit a standard plan.
Frequently asked questions
What is healthcare IT hosting?
Healthcare IT hosting means the servers and services behind a practice's systems, from the website and portal to the EHR, email, texting, automations and backups. Any outside company that hosts patient data for you must sign a BAA.
Our hospital needs HIPAA compliant hosting with a BAA for patient data systems. Who should host what?
For healthcare IT hosting at a hospital, list the systems first. Each SaaS vendor must sign for its own services, and an outside host for what it runs. We host self-run sites and apps on our 17 platforms, with a BAA within 24 hours of signup. Each plan is one server in one availability zone; multi-zone is quoted separately.
Does a telehealth platform need its own BAA?
Yes, when it handles patient data for you (45 CFR 160.103). A suite or EHR vendor's BAA covers only its own services, so sign a separate tool's BAA before patient data moves. Platform choices are covered in HIPAA compliant telehealth.
Is a cloud provider a business associate if it cannot see the data?
Yes. HHS says a cloud provider storing only encrypted ePHI, without the key, is still a business associate. The conduit exception is limited to transmission-only services.
Do I need a BAA with every vendor my practice uses?
No. You need one only with vendors that handle patient data on your behalf. Their subcontractors sign with them, and you need not sign with each one (45 CFR 164.308(b)). A website that never collects, stores or sends patient data needs no BAA from its host.
How much does healthcare IT hosting cost?
It depends on which systems you run yourself, since SaaS tools are priced separately. Our plans start at $229 a month, and $259 for the Performance tier. Market ranges for the server side of healthcare IT hosting are in our HIPAA hosting cost guide.
Recap: healthcare IT hosting, system by system
Good healthcare IT hosting starts with a list of every system and who signs for each one. Each vendor or host that handles patient data must sign for its part. We sign our BAA within 24 hours of signup and run single-tenant AWS from $229 a month. Your first month includes 4 hours of migration and configuration, then $175 an hour, quoted before work starts. Request a quote for your practice, or talk through your systems with an engineer. You can also compare current plans.
This article is general information, not legal advice, and we sell HIPAA compliant hosting. Vendor terms and rule status were checked on October 19, 2026, and can change. Base safeguards on a documented risk analysis.
Sources
HHS OCR guidance: HIPAA and cloud computing, risk analysis and IT asset inventories newsletter (Summer 2020).
HHS OCR settlements: Northeast Radiology (April 2025), Deer Oaks (July 2025) and Health Fitness Corporation (March 2025).
Proposed Security Rule: Federal Register, January 6, 2025 (90 FR 898) and Unified Agenda entry, RIN 0945-AA22.
Vendors, as of October 19, 2026: Google Workspace HIPAA compliance, Microsoft HIPAA and HITECH offering and AWS HIPAA eligible services.