HIPAA Compliant AI Hosting: Where Your Chatbot, n8n Agents and LLM Calls Can Run (2026)
HIPAA Compliant Hosting · https://hipaacomplianthosting.com/blog/hipaa-compliant-ai-hosting
Last updated: October 14, 2026
An AI feature that touches patient data usually needs two Business Associate Agreements (BAAs): one for the model service and one for the app around it. HIPAA compliant AI hosting means getting both layers covered. The model provider counts only if it signs a BAA for the specific service you call. Your chatbot, n8n agents, vector store and logs run on your hosting, so that host must sign too. This guide shows which AI vendors sign, where patient data leaks, and where each piece can run. We host the app and workflow side of that second layer through our HIPAA compliant n8n hosting and Docker hosting. We sell that service, so weigh our view with that in mind.
TL;DR: Quick answer
Layer 1 is the model. It is covered only when the vendor signs a BAA for that exact service, such as Amazon Bedrock under the AWS BAA.
Layer 2 is everything around the model: the app, n8n workflows, execution history, vector store and logs. That layer needs a host that signs a BAA under 45 CFR § 164.308(b).
As published on October 14, 2026, AWS, Google and Anthropic name AI services under a BAA. Microsoft and OpenAI offer one too, but confirm scope and eligibility with them first.
Standard consumer chatbot accounts are not a PHI route. Anthropic, for example, excludes its Free, Pro and Max plans from HIPAA readiness.
The easiest leaks to miss in HIPAA compliant AI hosting sit in layer 2: prompts in logs, n8n run history, embeddings, plugins and observability tools.
For HIPAA compliant AI hosting, we host the app and workflow servers on single-tenant AWS. n8n and Docker run on our Performance tier from $259 a month, with the BAA signed within 24 hours of signup.
HIPAA compliant AI hosting has two layers
Most teams ask one question: is this AI tool HIPAA compliant? It is the wrong question. HIPAA compliant AI hosting is a chain, and each link that touches protected health information (PHI) needs a BAA. Under § 164.308(b), a covered entity may let a vendor handle electronic PHI only after it obtains "satisfactory assurances", documented in a written contract. Business associates owe the same to their subcontractors.
Layer | What it includes | Who must sign the BAA |
|---|---|---|
1. The model service | The API that receives your prompt and returns text, embeddings or a summary | The model or cloud vendor, for that specific service |
2. The app and workflow layer | Your chatbot or portal, n8n or agent workflows, the vector store, queues, logs and backups | The host that runs those servers, plus any plugin or tool vendor that receives PHI |
A model vendor's BAA covers its model service. It does not cover the n8n server that builds the prompt, the database that stores the answer, or the log that records both. That is why HIPAA compliant AI hosting is mostly a hosting question, not a model question. Think of it as two contracts, one per layer. One BAA can span both layers only when one vendor runs both, such as an all-AWS build in your own account. Our guide to the HIPAA business associate agreement explains what each BAA should cover.
How we handle it: we sign a BAA covering the servers and services we run in layer 2. Your model vendor signs its own BAA for layer 1.
Which AI model vendors sign a BAA, and for what
For layer 1 of HIPAA compliant AI hosting, the answer depends on the exact service, not the brand. We checked each vendor's own pages on October 14, 2026. These are model and cloud providers, not hosts, and their primary documents are listed in Sources.
Vendor and service | BAA route, as published October 14, 2026 | Conditions to check |
|---|---|---|
AWS: Amazon Bedrock and Bedrock AgentCore | Both are on the AWS HIPAA Eligible Services Reference, dated September 3, 2026, with no footnote | Accept the AWS BAA first; check each model's data retention mode |
Microsoft: Foundry Models sold by Azure (includes Azure OpenAI models) | Microsoft offers its HIPAA BAA by default through its Product Terms for in-scope Azure services | Confirm the service is in your BAA scope; preview features may differ |
Google: Gemini Enterprise Agent Platform (formerly Vertex AI) | Listed as a covered product under the Google Cloud BAA | Accept the BAA; disable unsupported services for PHI |
OpenAI: API | A Business Associate and Healthcare Addendum, on an org ID that OpenAI provisions | Only BAA-eligible endpoints; live web search is not covered |
Anthropic: Claude API | A BAA covering its HIPAA-ready services, such as the first-party API | A HIPAA-enabled organization; consumer plans and most beta features are excluded |
Standard consumer chatbot accounts | Not a BAA route | Keep PHI out entirely |
Amazon Bedrock
The AWS HIPAA Eligible Services Reference lists Amazon Bedrock and Amazon Bedrock AgentCore. AWS says model providers cannot reach Bedrock logs or customer prompts. Bedrock now has data retention modes, though. Some newer models require a mode that keeps prompts and outputs inside AWS for up to 30 days for review. Note that in your risk analysis. For HIPAA compliant AI hosting on AWS, Bedrock keeps the model call under the same AWS BAA as your other AWS services. Our guide to AWS HIPAA eligible services covers how to read the list.
Azure OpenAI and Microsoft Foundry
Microsoft offers its HIPAA BAA "as part of the Microsoft Product Terms" to covered entities and business associates. There is no separate contract to sign. Its Product Terms list "Foundry Models sold by Azure" among Azure Core Services. Microsoft says those models include Azure OpenAI models. The HIPAA in-scope service list sits in Microsoft's Service Trust Portal, so confirm your service there before PHI moves. If your team already runs on Azure, this is a natural model route for HIPAA compliant AI hosting.
Google Gemini on Google Cloud
Google's April 22, 2026 release notes say Vertex AI is now part of Gemini Enterprise Agent Platform. Google's HIPAA page, updated October 13, 2026, lists Gemini Enterprise Agent Platform and Generative AI on Agent Platform as covered. It adds that a service you cannot disable is one you "must not use" for PHI. Google AI Studio and the Gemini Developer API do not appear on that list. For HIPAA compliant AI hosting on Google Cloud, check that list before each new model goes live.
OpenAI API
OpenAI's API data controls page refers to customers with an executed "OpenAI Business Associate and Healthcare Addendum" on file. Once OpenAI provisions the org ID with an approved retention setting, BAA-eligible endpoints may process PHI. Zero data retention and modified abuse monitoring need prior approval by OpenAI. Its help center lists the API with Modified Retention among its HIPAA eligible products. It also says eligible organizations can accept the standard BAA in the API Platform. Confirm eligibility with OpenAI before you build HIPAA compliant AI hosting around it.
Anthropic Claude API
Anthropic says it "provides a BAA covering our HIPAA-ready services" and names its first-party API as one. Eligible organizations can accept the standard BAA in the Claude Console; others go through sales. Once enabled, HIPAA readiness is permanent for that organization, and the API returns an error for most features it does not cover. Anthropic says a HIPAA-ready organization does not also need zero data retention. Claude on Bedrock falls under AWS's terms instead.
Consumer chatbot accounts
A standard consumer chatbot account has no place in HIPAA compliant AI hosting, whatever its privacy settings. Anthropic lists "Claude Free, Pro, and Max plans" as outside HIPAA readiness. OpenAI's help center lists its HIPAA eligible products, such as ChatGPT for Healthcare, and says it offers no BAA for ChatGPT Business. One exception: OpenAI says verified US clinicians can sign a BAA in ChatGPT for Clinicians. Staff who paste patient notes into an account with no BAA create a disclosure with nothing behind it.
How we handle it: we host the app and workflow servers. Model hosting and GPU servers are not part of our published plans. Our BAA does not cover any model vendor. Your workflows call the covered model service you choose, under that vendor's BAA.
Where PHI leaks in AI workflows
The model call is the part teams worry about. The leaks that get missed sit around it, in places nobody treats as storage. HIPAA compliant AI hosting has to cover each of these, and each maps to a Security Rule safeguard.
Leak point | What happens | Safeguard it falls under |
|---|---|---|
Prompts and outputs in logs | App, proxy or model logs capture full prompts and answers | § 164.312(b) audit controls; § 164.312(a)(2)(iv) encryption |
n8n execution history | Every run's input and output is saved by default | § 164.312(a)(2)(iv) encryption; § 164.312(a)(1) access control |
Vector databases and embeddings | Chunks of patient records and their embeddings sit in a searchable store | § 164.312(a)(2)(iv) encryption; § 164.312(a)(1) access control |
Third-party plugins and nodes | A node or plugin sends data to a vendor with no BAA | § 164.308(b) BAAs |
Analytics and observability tools | LLM tracing, error tracking or analytics receive prompts | § 164.308(b) BAAs |
The model call itself | PHI travels to the model API | § 164.308(b) BAAs; § 164.312(e)(1) transmission security |
Prompts and outputs in logs
Section 164.312(b) requires mechanisms that "record and examine activity" in systems holding electronic PHI. AI apps often over-deliver here. Debug logging writes the full prompt, including the patient note, to a plain text file. Amazon Bedrock's model invocation logging is off by default. Once on, it stores the full request and response in CloudWatch Logs or S3. In HIPAA compliant AI hosting, log who called the model and when, not the clinical text, unless that store is encrypted and covered.
n8n execution history
By default, n8n saves the data of successful and failed runs for 336 hours, per its docs on October 14, 2026. For an AI workflow, that means every prompt, model answer and patient record can sit in the n8n database for two weeks. Our guide to whether n8n is HIPAA compliant lists the settings that control it. Shorten retention, and keep the database on encrypted disks to meet § 164.312(a)(2)(iv).
Vector databases and embeddings
Retrieval over records, often called RAG, stores chunks of patient text next to their embeddings. Treat both as PHI. They are derived from patient records and are usually stored together. The vector store needs encryption at rest, scoped access and a HIPAA backup and disaster recovery plan, like any database. If it is a hosted vector service, that vendor needs a BAA too. In HIPAA compliant AI hosting, a vector store counts as a database, even when it feels like a cache.
Third-party plugins, nodes and observability tools
An n8n community node, a chatbot widget or an LLM tracing tool can forward prompts to its own servers. Each of those vendors becomes a business associate, and § 164.308(b) requires a written contract with each one. If one will not sign, keep PHI out of that step. The same applies to analytics on chat pages, covered in our guide to HIPAA tracking technologies.
How we handle it: every plan includes encryption at rest and in transit, six-year audit logging and tested encrypted backups. n8n runs on a single-tenant AWS server, and 4 hours of migration and configuration are included. You set n8n retention and decide which nodes and vendors your workflows call.
Where your chatbot, n8n agents and LLM calls can run
Layer 2 of HIPAA compliant AI hosting has four realistic homes. The deciding question is who signs the BAA and who does the security work. Our comparison of HIPAA hosting vs regular hosting shows what changes once a host signs.
Route | Who signs the BAA for layer 2 | What you still own |
|---|---|---|
n8n Cloud or Zapier | No one. n8n's team has said on its forum that it cannot sign a BAA for n8n Cloud; Zapier says it does not sign one | Not a PHI route |
Your own AWS, Azure or Google Cloud account | The cloud provider, for eligible services | Every server setting, patching, logging, backups and the n8n or app configuration |
A managed host that signs a BAA | The host, for the servers and services it runs | Your workflows, prompts, model vendor BAA and plugin choices |
An AI platform with its own BAA | The platform, under its own terms | Its feature limits, plus everything outside the platform |
The do-it-yourself cloud route works for HIPAA compliant AI hosting if you have a platform engineer. Our guide on whether AWS is HIPAA compliant covers what the AWS BAA leaves to you. Most small teams find the ongoing server work is the hard part. Our comparison of managed vs self-managed HIPAA hosting weighs that trade.
If you want a list of hosts rather than routes, see our roundup of the best HIPAA compliant hosting providers. For HIPAA compliant AI hosting, check one extra item: will the host run n8n or Docker workloads, not just websites?
How we handle it: for HIPAA compliant AI hosting, we are the third route. n8n and Docker run on our Performance tier from $259 a month, with the BAA signed within 24 hours of signup. Your workflows, n8n settings, prompts and model vendor BAA stay yours.
A reference setup for HIPAA compliant AI hosting
Here is a pattern that keeps every link in the chain covered. It fits a patient chatbot, intake summaries or an n8n agent that drafts replies. If the workflow reads from your EHR, see our guide to HIPAA compliant EHR hosting.
Sign the model BAA. Pick one covered model service, such as Amazon Bedrock under your AWS BAA. Record the service and model in your vendor list.
Host the workflow layer under a second BAA. Run n8n, or your app in Docker, on a single-tenant server whose host signs a BAA.
Keep data on covered systems. Store run history, uploads and any vector data on encrypted disks on that server, or in a covered cloud service.
Trim what you keep. Shorten n8n retention, keep clinical text out of logs, and leave model invocation logging off unless its store is covered.
Close side doors. Remove nodes, widgets and tracing tools whose vendors will not sign a BAA.
Write it down. Add the AI workflow to your HIPAA risk analysis, as § 164.308(a)(1)(ii)(A) requires for systems holding electronic PHI.
If your app runs in containers, our guide to whether Docker is HIPAA compliant covers images, secrets and container logs. Already running these workflows on a host with no BAA? Our guide to migrating to HIPAA compliant hosting gives the order of steps. It covers signing the BAA before any data moves.
How we handle it: we provide the server in step 2, with the encrypted disks that step 3 relies on. You keep control of the workflows, the nodes and the model account.
How we provide HIPAA compliant AI hosting for the workflow layer
This is the part we sell, stated plainly. We host the app and workflow servers in layer 2 and leave layer 1 to a model vendor that signs.
Tell us what you run. Send the workflows, the app and the model service you plan to call. We reply with a plan size.
Sign the BAA. We sign within 24 hours of signup, before any patient data moves to us.
We build a single-tenant AWS server. It comes with CloudFront CDN, a web application firewall, encryption at rest and in transit, six-year audit logging and tested encrypted backups.
We set up n8n or your Docker workload. 4 hours of migration and configuration are included in your first month. Extra time is $175 an hour, quoted before work starts.
You connect your covered model service. Your workflows call Bedrock or another covered API under that vendor's BAA.
Our HIPAA compliant Docker hosting and n8n hosting sit on the Performance tier, from $259 a month. Plans come in six sizes, Starter to Network, and managed plans for other platforms start at $229 a month. Monthly plans have no long-term contract. Software teams with a custom app usually start with HIPAA cloud hosting. The scope of support page lists what each plan covers.
When are we the wrong choice? If your workflows never carry patient identifiers, you do not need HIPAA compliant AI hosting at all. Model hosting and GPU servers are not part of our published plans. Our BAA covers the servers and services we run, so your model, email and SMS vendors need their own. Each plan is one server in one AWS availability zone. Root access needs an Enterprise engagement, and a multi-zone design is quoted separately. HIPAA Compliant Hosting does not hold SOC 2 or HITRUST certification.
Frequently asked questions
What is HIPAA compliant AI hosting?
HIPAA compliant AI hosting is hosting for an AI feature where every system that touches PHI is under a BAA. The model service needs its vendor's BAA. The app, workflows, vector store and logs need a host that signs one.
Who are the top providers for HIPAA compliant AI hosting?
For the model layer, AWS, Google and Anthropic name AI services under a BAA, and Microsoft and OpenAI offer one with scope to confirm. For the app and workflow layer, look for a host that signs a BAA and runs n8n or Docker. That is the part we provide.
Is Amazon Bedrock HIPAA eligible?
Yes. Amazon Bedrock and Bedrock AgentCore are on the AWS HIPAA Eligible Services Reference, dated September 3, 2026. You must accept the AWS BAA first and check each model's data retention mode.
Can I use ChatGPT with patient data?
Not with a standard consumer account. As of October 14, 2026, OpenAI's help center lists ChatGPT for Healthcare, regulated Enterprise workspaces and ChatGPT for Clinicians as HIPAA eligible. Any PHI use needs a BAA with OpenAI in place first.
Does Anthropic sign a BAA for the Claude API?
Yes, for its HIPAA-ready services, such as the first-party API in a HIPAA-enabled organization. Claude Free, Pro and Max plans are outside it, and beta features generally are too, per Anthropic's docs on October 14, 2026. Claude Code follows separate rules, so check Anthropic's BAA article before using it with patient data.
What is the best HIPAA compliant n8n alternative?
Usually it is self-hosted n8n, not a different tool. n8n Cloud offers no BAA, and Zapier says it does not sign one. Self-hosted n8n on a host that signs a BAA keeps your workflows and adds the contract that HIPAA compliant AI hosting needs.
Is there a HIPAA compliant Kafka-as-a-service?
Amazon Managed Streaming for Apache Kafka is on the AWS HIPAA Eligible Services Reference as of October 14, 2026. You still accept the AWS BAA and configure encryption and access. Managed Kafka is not part of our published plans.
Recap: HIPAA compliant AI hosting in two layers
HIPAA compliant AI hosting usually needs two BAAs, not one. The model vendor signs for the model service, and your host signs for the app, workflows, vector store and logs. Check the exact service on the vendor's own page, keep PHI out of consumer accounts, and close the leaks around the model call. Want the workflow layer hosted for you? We sign the BAA within 24 hours of signup and host n8n and Docker on single-tenant AWS. Request a quote for your practice, or talk through your AI stack with an engineer. You can also compare our current plans.
This article is general information, not legal advice. It describes our own commercial service. Vendor terms are as published on October 14, 2026, and change often. Confirm coverage in each vendor's signed BAA, and confirm your obligations with qualified counsel.
Sources
AWS Bedrock docs: Data protection, Data retention and Model invocation logging
Microsoft: HIPAA Azure compliance offering, Product Terms, Privacy and Security Terms and Data, privacy and security for Foundry Models sold by Azure
Google Cloud: HIPAA compliance and covered products and Gemini Enterprise Agent Platform release notes
OpenAI: Data controls in the OpenAI platform, Healthcare Addendum, HIPAA eligible products and functionality and Getting a BAA for the OpenAI API
Anthropic: BAAs for commercial customers, Covered Models under a BAA and API and data retention
n8n: forum thread with n8n team replies on BAAs and Executions environment variables
Zapier: Is Zapier HIPAA compliant?
45 CFR § 164.308 (risk analysis, business associate contracts): law.cornell.edu
45 CFR § 164.312 (access control, encryption, audit controls, transmission security): law.cornell.edu