HIPAA compliant hosting requirements for health systems and healthtech: the checklist to put in your RFP
HIPAA Compliant Hosting · https://hipaacomplianthosting.com/blog/hipaa-compliant-hosting-requirements
Last updated: November 13, 2026
HIPAA sets two hosting requirements: a signed business associate agreement (BAA) and the Security Rule safeguards. Everything else in a hosting request for proposal (RFP) comes from your risk analysis and your contract. This checklist turns HIPAA compliant hosting requirements into questions a host must answer in writing.
It is written for IT, security and procurement leads at multi-site groups, hospitals and health systems. It also serves healthtech teams that host patient data for a hospital customer. We are HIPAA Compliant Hosting, and we sell managed hosting. Weigh the one marked section about our plans as a disclosure.
TL;DR: Quick answer
Two legal requirements. A host that stores electronic protected health information (ePHI) for you needs a BAA, and its systems need the Security Rule safeguards.
Required and addressable. Some safeguards are required. Others are addressable, which means you assess them and document your choice. Addressable does not mean optional.
The rest is yours to set. Many HIPAA compliant hosting requirements in an RFP are your choice, not a rule. Log periods, restore targets and zone count are examples. Write them into the contract.
Written answers only. HHS certifies no host. Score each vendor on its written answers and its BAA scope, not on a badge.
Disclosure. Our standard plans answer the checklist in one marked section near the end.
What does HIPAA actually require of a hosting provider?
HIPAA requires two things of a host that keeps ePHI for you. The first is a written contract. The second is the Security Rule safeguards on the systems that hold the data. All other HIPAA compliant hosting requirements grow out of these two.
The contract comes first. Under 45 CFR 164.308(b), you may let a business associate hold ePHI only after you get satisfactory assurances. Those assurances must be written down in a contract that meets 164.314(a). Our guide to the business associate agreement covers each clause.
The BAA must say the host will comply with the Security Rule. It must also say the host will report any security incident it becomes aware of. And it must make the host get the same promises from any subcontractor that handles ePHI.
The safeguards come second. The Security Rule sorts them into administrative (164.308), physical (164.310) and technical (164.312) groups. Under 164.306(d), each item is either required or addressable. For an addressable item, you assess whether it is reasonable and appropriate. If it is not, you document why and use an equal alternative where one is reasonable.
No agency certifies a host. HHS says OCR does not endorse, certify or recommend specific technology or products. So HIPAA compliant hosting requirements are proven in writing: in the BAA, in the host's answers and in your risk analysis. For definitions, costs and penalties, see our HIPAA compliant hosting guide.
Which HIPAA compliant hosting requirements belong in your RFP?
Twelve items belong in a hosting RFP, from BAA scope to exit terms. Put each one in, and ask for a written answer. Rows marked as rule text come from the Security Rule or the Privacy Rule. The rest are buyer choices that HIPAA leaves to your contract.
Requirement | Source | Question to put in the RFP | Answer to ask for in writing |
|---|---|---|---|
BAA scope and timing | 164.308(b), 164.314(a), required | Will you sign a BAA before ePHI moves, and which services does it cover? | The signed BAA and a list of covered services |
Subcontractors | 164.314(a) | Which subcontractors touch ePHI, and does each have a BAA with you? | A named subcontractor list |
Incident reports | 164.314(a), 164.410 | What detail, timing and format will your incident reports have? | The notice terms, inside the 60-day outer limit for breaches |
Tenancy | Your risk analysis | Which layers are shared with other customers, and how are customers separated? | A tenancy statement by layer |
Unique user IDs | 164.312(a)(2)(i), required | Does every admin use a named account? | The access policy |
Encryption | 164.312(a)(2)(iv) and (e)(2)(ii), addressable | Is ePHI encrypted at rest and in transit by default? | Where encryption applies, and who holds the keys |
Audit logs | 164.312(b) | What is logged, how long is it kept, and can we export it? | Log scope, retention and export method |
Backups | 164.308(a)(7)(ii)(A), required | How are backups made, encrypted and kept? | Backup design and retention |
Restore tests | 164.308(a)(7)(ii)(D), addressable | How often do you test a restore, and who sees the results? | The test schedule and a recent result |
Availability design | 164.308(a)(7) and your targets | Is the design one zone or several, and who decides to fail over? | The design, and your recovery time and recovery point targets |
Patching by layer | 164.308(a)(1) risk management | Who patches the operating system, the runtime and the application? | A layer-by-layer responsibility list |
Exit, return and access | 164.504(e)(2)(ii)(J) | How do we get data back at the end, and when is it deleted? | Return format, written confirmation of deletion, no lockout |
Treat the table as a floor, not a full list. Your risk analysis decides which rows carry the most weight for each workload. Our HIPAA risk analysis guide lists what that analysis must cover.
How should the RFP ask about the BAA chain?
Ask for the BAA itself, not a promise to sign one later. Then ask which services it covers. A BAA covers only the signer's own services, so any vendor outside it needs its own agreement.
The BAA chain is one of the HIPAA compliant hosting requirements that reaches past the host. Under 164.314(a), the host must get the same promises from its own subcontractors. Ask the host to name each one that touches ePHI. That includes the cloud platform under the host.
Also ask how the host reports incidents. The rule says the host must report any security incident it learns of. For a breach, the host must tell you without unreasonable delay. The outer limit is 60 calendar days after discovery, under 164.410. A BAA may set a shorter window. Our glossary entry on the breach notification rule covers the timing.
How should the RFP ask about tenancy, access and encryption?
Ask which layers are shared and how customers are separated. Tenancy is one of the HIPAA compliant hosting requirements you set yourself. No rule says each customer needs its own server. HHS says public, hybrid and private cloud setups can all hold ePHI under a BAA. NIST's HIPAA guide says cloud services can add new risks to ePHI. So ask how tenants are kept apart and how deleted data is wiped.
For access, the rule names one required item: a unique user ID for each person. Ask the host whether every admin uses a named account. Also ask how access is removed when someone leaves.
Encryption is addressable under 164.312(a)(2)(iv) and (e)(2)(ii). In practice, few buyers would accept a host that leaves hosted ePHI unencrypted. So ask where encryption applies at rest and in transit, and who holds the keys. These HIPAA compliant hosting requirements belong in writing, not on a sales slide. Machine-level settings are covered in our guide to a HIPAA compliant server.
How should the RFP ask about logs, backups and recovery?
Ask what is logged, how long logs are kept and how you can export them. Under 164.312(b), the host needs systems that record and examine activity. It sets no retention period for the logs themselves.
Many buyers ask for six years of logs. That lines up with the rule that keeps Security Rule documentation for six years under 164.316(b)(2)(i). Treat the log period as a contract term, one of the HIPAA compliant hosting requirements you set. Our guide to HIPAA audit logs explains the difference.
For recovery, the contingency plan standard in 164.308(a)(7) lists five items. Three are required: a backup plan, a disaster recovery plan and a plan to run in emergency mode. Two items are addressable. One is testing and revising the plan. The other is ranking which apps and data matter most.
A sound backup plan sets two targets: how fast you must be back, and how much data you can lose. You set both, per workload. Then ask the host to show in writing how its design meets them. Our guide to HIPAA backup and disaster recovery covers the planning.
How should the RFP ask about patching, exit and audits?
Ask for a layer-by-layer list of who patches what. Patching is easy to leave out of HIPAA compliant hosting requirements, because HIPAA names no patching item. HHS's Office for Civil Rights (OCR) treats it as part of risk analysis and risk management. So the contract must say who updates the operating system, the runtime, the application and its plugins.
Ask how you get your data back when the contract ends. Under 164.504(e)(2)(ii)(J), the BAA must provide for return or destruction of PHI at termination, if feasible. Ask for the return format and written confirmation of deletion. HHS also says a business associate may not block a covered entity's access to its PHI, even in a payment dispute.
Ask what assurance the host will give you. HHS says the HIPAA Rules do not expressly require a cloud provider to let customers audit it. A customer may still ask for documentation or audit rights in the BAA or another agreement. Put the assurance you need into your HIPAA compliant hosting requirements as a scored item.
Which HIPAA compliant hosting requirements are not in HIPAA?
Availability figures, log periods, cipher choices, zone counts and certification badges are buyer choices, not HIPAA rules. Label them that way, so vendors cannot claim HIPAA requires their version.
Availability figures. HIPAA sets none. HHS says a service level agreement can cover availability and data recovery, and its terms should be consistent with the BAA.
A log retention period. The audit controls standard sets none. Six years is a common choice.
A cipher or TLS version. The rule names no algorithm. Set the standard you need in the contract.
Number of zones. HIPAA requires a contingency plan, not a design. Your recovery targets decide it.
Certification badges. HHS certifies no host, so a "HIPAA certified" claim proves nothing.
Writing these items down still matters. Choices you leave out of the RFP become gaps in the contract. Clear labels keep your HIPAA compliant hosting requirements apart from sales claims.
What would the proposed Security Rule update add?
HHS proposed a Security Rule update on January 6, 2025. As of November 13, 2026, it is still a proposal. The federal agenda lists it as a long-term item, with a final rule estimated for July 2027.
If finalized as proposed, the update would remove most of the addressable label. You would have to encrypt ePHI and use multi-factor authentication (MFA) to log in. You would need written steps to restore key systems within 72 hours. You would also need separate technical controls for backup and recovery. A host would have to tell you within 24 hours when it starts its emergency plan.
None of that is law yet. Still, many buyers already ask for these items as HIPAA compliant hosting requirements in their RFPs. If you do, label them as your terms, not current rule text.
How should you score the answers?
Score only what the host puts in writing. A spoken promise is not an answer to HIPAA compliant hosting requirements.
Ask for a responsibility list by layer. It should show who runs the facilities, the server, the runtime, the application and the data.
Read the BAA scope against your list of services. Any service outside it needs its own BAA, or no ePHI.
Flag a "HIPAA certified" claim. HHS offers no such certification.
Flag a BAA that covers "everything". Ask for the named services instead.
Flag a missing subcontractor list. The host must pass its BAA terms down the chain.
Architecture choices such as tenancy, zones and root access sit one step earlier. Our guide to HIPAA compliant infrastructure covers those six decisions for health systems and healthtech teams.
How do our standard plans answer the checklist?
Here is how our standard plans answer the main rows of these HIPAA compliant hosting requirements. We sell this, so weigh it as a disclosure.
BAA. We sign the BAA within 24 hours of signup, before patient data moves. Our BAA covers the servers and services we run. Email, SMS, EHR, form and AI model vendors need their own BAA.
Tenancy. Single-tenant AWS. Each plan is one server in one AWS availability zone.
Safeguards. Every plan includes CloudFront CDN, a web application firewall (WAF), encryption at rest and in transit, six-year audit logging and tested encrypted backups.
Recovery. Point-in-time recovery from EBS snapshots, kept for 7 days. A multi-zone design is quoted separately. Failover is available as an add-on, quoted separately.
Patching. Our team applies OS and PHP updates. Your application code, CMS, plugins, themes, modules and extensions, and their updates, stay with you.
Control. Fully managed infrastructure. Root access comes only with an Enterprise engagement.
Six sizes, Starter to Network. Monthly plans have no long-term contract. Managed plans from $229 a month.
When do you not need us?
In three common cases, you may not need us, or not a standard plan.
Your team already runs its workloads on a cloud under an accepted BAA, and patches the operating system itself. Our guide to managed vs self-managed HIPAA hosting sets out the trade-off.
Your HIPAA compliant hosting requirements call for more than one availability zone on day one. Standard plans are one server in one zone, so you need a quoted multi-zone design or another host.
The system is a vendor's SaaS product, such as an EHR. That vendor hosts it and signs its own BAA.
If one managed server fits a workload, send your RFP or requirement list and scope your network's infrastructure with us.
Frequently asked questions
What are the HIPAA compliant hosting requirements?
A signed BAA with the host, and the Security Rule safeguards on the systems that hold ePHI. The BAA must meet 164.314(a) and 164.504(e). The safeguards come from 164.308, 164.310 and 164.312. Log periods and restore targets are terms you set in the contract.
Does HIPAA set a time limit for restoring a hosted system?
No. The Security Rule requires backup, disaster recovery and emergency mode plans, but sets no hour count. You set your own targets in the RFP. HHS proposed a 72-hour restore requirement in January 2025. As of November 13, 2026, it is still a proposal.
How long must a host keep audit logs?
HIPAA sets no log period. The rule asks for systems that record and examine activity. Security Rule records must be kept for six years, so many buyers ask for six years of logs.
Can we require a host to allow audits?
Yes, by contract, as one of your HIPAA compliant hosting requirements. HHS says the HIPAA Rules do not expressly require a cloud provider to allow customer audits. You can still ask for proof or audit rights in the BAA or another contract.
Can a host be HIPAA certified?
No. HHS does not certify hosts or products for HIPAA compliance. Judge a host on its signed BAA and its written answers to your HIPAA compliant hosting requirements.
Recap: HIPAA compliant hosting requirements
HIPAA compliant hosting requirements come down to a signed BAA and the Security Rule safeguards. Everything else in your RFP is a choice you make from your risk analysis. Ask every host the same questions, label which items are rule text and which are yours, and score only written answers.
This article is general information, not legal advice. Rules, guidance and the proposed Security Rule are as read on November 13, 2026, and they can change. Base your requirements on your own risk analysis, and ask counsel about contract terms. We sell HIPAA compliant hosting. Reviewed November 2026.
Sources
HHS: cloud provider endorsements and January 2026 OCR Cybersecurity Newsletter.
HHS FAQs: audits of cloud providers and blocked access.
Proposed Security Rule: Federal Register, January 6, 2025 (90 FR 898), the HHS fact sheet and agenda entry, RIN 0945-AA22.