HIPAA compliant infrastructure for health systems and healthtech: 6 decisions before you sign
HIPAA Compliant Hosting · https://hipaacomplianthosting.com/blog/hipaa-compliant-infrastructure
Last updated: November 9, 2026
A health system or healthtech team makes six choices before patient data goes on a hosted server. They are tenancy, availability, recovery, control, the BAA chain and exit. HIPAA sets the floor for each. Your risk analysis and contract set the rest. This guide treats HIPAA compliant infrastructure as a buyer's decision, not a product label. Each section covers what HHS, NIST and health sector guidance say, the trade-off at scale, and what to write into the contract.
It is written for multi-site groups, hospitals, health systems and healthtech teams facing a hospital's vendor review. No agency certifies HIPAA compliant infrastructure. HHS says it does not certify any person or product as HIPAA compliant.
We sell managed hosting. The six decisions stay neutral. One marked section near the end shows how our standard plans answer them. Weigh that section as a disclosure.
TL;DR: Quick answer
Scale. The Security Rule requires each organization to weigh its size, complexity, capabilities and costs. So HIPAA compliant infrastructure for a health system looks different from a clinic's.
Tenancy. HHS allows public, hybrid or private cloud setups with a business associate agreement (BAA). NIST lists broken isolation and incomplete data deletion as multi-tenant cloud threats.
Availability. AWS says that if every instance sits in one failed location, none is available. More than one availability zone is a design you choose and contract for.
Recovery. You set the recovery time and recovery point for your HIPAA compliant infrastructure. HHS's 405(d) guidance says every backup plan must include both.
Control. Under AWS's shared responsibility model, your share depends on the services you choose. Decide in writing who holds root in your HIPAA compliant infrastructure, and who patches each layer.
BAA chain. A cloud host that stores electronic protected health information (ePHI) is a business associate, even without the decryption key. Each company that stores or processes your ePHI for you needs a BAA with the party that hired it.
Notice, return and access. The BAA must provide for return or destruction of PHI when the contract ends, where feasible. HHS says a business associate may not lock a covered entity out of its PHI. Set incident notice detail and any faster breach notice in the contract.
Disclosure. We sell hosting. Our standard plans and their limits are in one section after decision 6.
Why does scale change HIPAA compliant infrastructure decisions?
Scale changes the answers, not the rule. The Security Rule tells each organization to weigh its size, complexity, capabilities and the cost of each measure. It also requires you to weigh how likely and how critical each risk is.
HHS's 405(d) guidance, the Health Industry Cybersecurity Practices (HICP), sketches organizations by size. A medium one has 11 to 50 physicians or 51 to 299 beds. It may have multiple sites across a wide area. A large one has over 300 beds or over 50 physicians. The large sketch also lists integrated delivery networks and a CISO or dedicated security leader with dedicated security staff. These are sketches, not legal thresholds.
On October 29, 2026, HHS's Office for Civil Rights (OCR) announced an $800,000 settlement with Lehigh Valley Health Network (LVHN). Ransomware hit the IT system of a physician group LVHN acquired in 2021. Among other issues, OCR cited the lack of an accurate and thorough risk analysis. Systems inherited through an acquisition carry their own exposure. So the risk analysis for a large system's HIPAA compliant infrastructure must reach any that hold ePHI.
Hosts are regulated too. In January 2025, OCR announced a $90,000 settlement with Virtual Private Network Solutions. OCR describes it as a business associate that provides data hosting and cloud services. OCR said it failed to conduct a compliant risk analysis.
The six decisions below shape HIPAA compliant infrastructure at any size.
Decision | Common options | What the rules and guidance say | Put in the contract |
|---|---|---|---|
1. Tenancy | Shared, single-tenant or dedicated | Any cloud setup can hold ePHI with a BAA; NIST lists multi-tenant threats | Which layers are shared; how customers are separated; how storage is wiped at exit |
2. Availability | One availability zone, a multi-zone design, failover | A contingency plan is required; NIST asks about redundancy and restoration times | The design, and who acts when a zone fails |
3. Recovery | Snapshots, backups, restore tests | A backup plan is required; HHS 405(d) guidance says it needs a recovery time and a recovery point | Your targets, retention and restore testing |
4. Control | The host holds root, or your team does | AWS secures the cloud; on a virtual server, the customer side starts at the guest operating system | Who holds root; who patches each layer |
5. BAA chain | Cloud platform, host, your other vendors | Every business associate and subcontractor that handles ePHI needs a BAA | Which services each BAA covers |
6. Notice, return and access | Notice timing, return format, access terms | Return or destroy PHI at the end if feasible; incident notice detail is set in the BAA; no lockout | Incident notice detail, data return format, written confirmation of deletion, no lockout |
Does HIPAA compliant infrastructure need single-tenant servers?
No rule requires single-tenant servers. HHS says public, hybrid and private cloud setups can all hold ePHI. The customer must sign a BAA with the provider. HHS also says the buyer should understand the provider's environment. Then it can run its own risk analysis and set up the right BAAs.
Tenancy in HIPAA compliant infrastructure is about who else shares the layers your ePHI sits on. In single-tenant hosting, no other customer shares the server layer.
NIST's HIPAA guide, SP 800-66 Rev. 2, lists three multi-tenant cloud threats. An attacker may exploit multi-tenancy to watch or interfere with processes. It may exploit insecure or incomplete data deletion. Or it may break the isolation between tenants. So put in writing how any host separates customers and wipes storage, whatever the label.
A dedicated or single-tenant setup changes who shares the layer. It does not remove the need to assess the risks. Your risk analysis has to cover every part of your HIPAA compliant infrastructure, shared or not. The Security Rule requires an accurate and thorough risk analysis from business associates too.
Put in the contract: which layers are shared, how your data is separated, and how storage is wiped or returned at the end.
One availability zone, a multi-zone design or failover: what does HIPAA expect?
HIPAA requires a contingency plan, not a design. Backup, disaster recovery and emergency mode plans are required. Testing is addressable. So the number of zones in your HIPAA compliant infrastructure is a design choice. Your recovery targets should drive it. The contract should record it.
NIST says to weigh the redundancy and geographic spread of any storage provider. The aim is to find risks to availability and set restore times.
As of November 9, 2026, AWS describes availability zones as isolated locations within each Region. It says failures are rare. But if every instance sits in one failed location, none is available. With instances in more than one zone, an application can be built so another zone handles requests. So a second zone adds servers. The application must also be able to switch between them.
HHS's cloud guidance says a service level agreement often covers more specific needs, such as system availability and data recovery. HHS says the agreement's terms should be consistent with the BAA and the HIPAA Rules.
HHS proposed in January 2025 that regulated entities set written procedures to restore critical systems and data within 72 hours of a loss. As of November 9, 2026, it is still a proposal. The federal regulatory agenda lists it as a long-term action, with a final rule date of July 2027.
Put in the contract: the design (one zone or several), the restore time you need, and who decides to fail over.
Who sets recovery time and recovery point, and how is restore tested?
You set both. HHS's 405(d) guidance for larger organizations says every backup plan needs a recovery time objective (RTO) and a recovery point objective (RPO). The same guidance, HICP Technical Volume 2, says to understand your restore options with any cloud solution and to always encrypt backup files.
The rule's data backup plan must create "retrievable exact copies" of ePHI, and it is Required. Testing and revision procedures are Addressable. That does not mean optional.
The proposed update would also require test restores at least monthly. Each would use a representative sample of backed-up ePHI, and the results would be documented. It is part of the same proposal, not current law.
The Health Sector Coordinating Council (HSCC) gives sample measures for suppliers. One is the share of critical systems successfully restore-tested from backup in the last 12 months. It is an example metric, not a legal requirement.
How long copies are kept tells you how far back you can restore, not how fast you get back. Snapshots are only one layer of recovery in HIPAA compliant infrastructure.
Put in the contract: your RTO and RPO targets, retention, the restore test schedule, and who sees the results. Set targets for each workload in your HIPAA compliant infrastructure first. Then check any design against them in writing. Our guide to HIPAA backup and disaster recovery covers the planning in depth.
Who holds root access and patches each layer?
Under AWS's shared responsibility model, your share depends on the services you choose. On a virtual server, the customer manages the guest operating system, including updates and security patches. When a host runs the server in your HIPAA compliant infrastructure, the contract decides who holds root and who patches each layer.
As of November 9, 2026, AWS says it is responsible for protecting the hardware, software, networking and facilities that run its cloud services. In its virtual server example, Amazon EC2, the customer also handles installed software and firewall settings. For abstracted services such as Amazon S3, AWS runs the operating system and platforms too.
HSCC's contract template asks suppliers to apply software providers' patches to their end points. It also asks for MFA on administrator access. These are template clauses, not law.
Whoever holds root on a server can change anything on it. So root access moves more of the server's upkeep and risk to that party. Root access is a key control question in HIPAA compliant infrastructure.
Put in the contract: a layer-by-layer list of who patches what, and who holds root.
How does the BAA chain reach every vendor that handles ePHI?
Each company in the chain that handles your ePHI needs a BAA with the party that hired it. That includes every cloud platform, host and outside vendor that stores or processes your ePHI for you. A service that only transmits data, like an internet provider, is a conduit, not a business associate.
HHS says a cloud service provider (CSP) that stores ePHI is a business associate, even without the decryption key. It is not a mere conduit, HHS says, "even if the CSP does not actually view the information". Using a CSP to maintain ePHI without a BAA puts the customer in violation of the HIPAA Rules.
A subcontractor that handles PHI for a business associate is itself a business associate. The business associate must have it agree to the same terms in a written contract. If your healthtech product handles PHI for a hospital, you are the hospital's business associate. A host that runs your HIPAA compliant infrastructure is then your subcontractor. NIST's sample question asks whether the business associate has identified all subcontractors that handle ePHI. Our guide to the business associate agreement covers what each contract must say.
As of November 9, 2026, AWS says it presents a standard Business Associate Addendum that customers accept in AWS Artifact. It says PHI belongs only in its HIPAA eligible services. Customers "still must configure these services consistent with HIPAA requirements", AWS adds.
HSCC's guide on AI vendors names vendors that will not sign the healthcare organization's own BAA as a risk. Decide early whose BAA paper you need.
Each BAA covers only the signer's own services. So a gap appears wherever a vendor stores or processes ePHI without one.
Put in the contract: which services each BAA covers, and the list of subcontractors that touch ePHI.
What incident notice, data return and access terms belong in the contract?
Incident notice, data return and access terms all belong in writing. HIPAA leaves most of their detail to the contract.
A host that stores your ePHI is a business associate. Its BAA must require it to report security incidents it becomes aware of. HHS says the parties set the detail, frequency and format of those reports in the BAA. For a breach, a business associate has a 60-day outer limit to notify the covered entity. A BAA may require faster reporting.
Under the January 2025 proposal, the BAA would make a business associate report activation of its contingency plan within 24 hours. HHS says this would not change breach reporting duties. It is still a proposal.
At the end of the contract, the BAA must provide for return or destruction of all PHI, with no copies kept, if feasible. Otherwise, the BAA's protections extend to what is kept. That "if feasible" wording leaves the details to the contract. HSCC's contract template asks a host to return data "in readable format", then destroy other copies once the buyer confirms it is readable and accessible.
HHS says a business associate may not block a covered entity's access to the PHI it maintains. That holds even in a payment dispute. Cloud contract terms should not keep the customer from its ePHI either.
HHS says the HIPAA Rules do not require a cloud provider to let its customers audit its security practices. A buyer may still ask for more assurance in the BAA or other documents. HSCC's supplier guide suggests a right to audit, or another way to confirm the security terms are met.
Put in the contract: incident notice detail, frequency and format, and any faster breach notice. Add data return format, written confirmation of deletion and no lockout. Settle these terms before patient data moves. Exit terms are part of HIPAA compliant infrastructure, not an afterthought.
How do our standard plans answer the six decisions?
Here is how our standard plans answer the six decisions. We sell this, so weigh it as a disclosure.
Decision | Our standard plan | Quoted separately | Settle in your contract |
|---|---|---|---|
1. Tenancy | Single-tenant AWS. Each plan is one server in one AWS availability zone. | Not listed | Which layers are shared; how customers are separated; how storage is wiped at exit |
2. Availability | Standard plans are one server in one AWS availability zone, and a multi-zone design is quoted separately. | Failover is available as an add-on, quoted separately. | The design, and who decides to fail over |
3. Recovery | Point-in-time recovery from EBS snapshots, kept for 7 days. Tested, encrypted backups. | Not listed | Your RTO and RPO; retention; the restore test schedule |
4. Control | Our team applies OS and PHP updates. Your application code, CMS, plugins, themes, modules and extensions, and their updates, stay with you. So do the container images you build. Root access comes only with an Enterprise engagement. | Not listed | Who holds root; who patches each layer |
5. BAA chain | We sign the BAA within 24 hours of signup, before patient data moves. Our BAA covers the servers and services we run. Your EHR, email, SMS, form and AI model vendors need their own BAA. | Not listed | Which services each BAA covers; your list of subcontractors |
6. Notice, return and access | Set in your contract | Not listed | Incident notice detail; data return format; written confirmation of deletion; no lockout |
What we run:
Fully managed infrastructure.
Monitoring and infrastructure incident response.
Every plan includes CloudFront CDN, a web application firewall (WAF) and EBS storage with 7-day snapshot retention. It also includes encryption at rest and in transit, six-year audit logging and tested encrypted backups.
Where does a single-tenant managed plan fit in a larger organization?
A standard plan fits a workload when one zone and the recovery above meet your RTO and RPO. If they do not, the workload needs a multi-zone design or another host.
Under the rule's criticality analysis, workloads in the same HIPAA compliant infrastructure can carry different targets. Examples to test against your own targets:
Public and patient-facing websites.
Intake forms and patient portals on platforms such as WordPress, Drupal or Laravel.
Apps run by one department or an innovation team.
Websites and apps that came with an acquired practice, which your risk analysis must cover if they hold ePHI.
One pilot site before a wider rollout.
Six sizes, Starter to Network. Monthly plans have no long-term contract.
When do you not need us?
In three common cases, you may not need us, or at least not a standard plan.
The EHR or portal is a vendor's SaaS product. That vendor hosts it and signs its own BAA.
Your platform team already runs HIPAA compliant infrastructure on AWS under an accepted AWS BAA. It also patches the operating system. A managed host may add little. Our guide to managed vs self-managed HIPAA hosting sets out the trade-off.
You need more than one availability zone on day one. Standard plans are one server in one AWS availability zone. You need a quoted multi-zone design or another host.
To scope a workload with us, start from the route that matches your team.
Health systems, hospital networks and multi-site groups: scope your network's infrastructure. Many rollouts start with one pilot site. For a single-site move, our migration plan covers the steps.
Healthtech and SaaS teams: scope your application's infrastructure. The Performance tier starts at $259 a month, for platforms including Drupal, Strapi, Docker and Phalcon.
Bring your RTO and RPO, availability needs, BAA chain and exit terms.
Managed plans from $229 a month.
Frequently asked questions
What is HIPAA compliant infrastructure?
The term HIPAA compliant infrastructure means the servers, storage, networks and backups that store or move ePHI. Those systems run under the Security Rule's safeguards, with a BAA for each vendor that stores or processes ePHI. No agency certifies them. HHS says it does not certify any person or product as HIPAA compliant.
Does single-tenant hosting remove multi-tenancy risk?
Not on its own. NIST lists broken isolation and incomplete data deletion as multi-tenant cloud threats. In any HIPAA compliant infrastructure, put how customers are separated and how storage is wiped in writing.
Does HIPAA set a recovery time for hosted systems?
Not today. The Security Rule requires backup, disaster recovery and emergency mode plans. It sets no hour count for HIPAA compliant infrastructure. In January 2025, HHS proposed that regulated entities set written procedures to restore critical systems and data within 72 hours of a loss. As of November 9, 2026, it is still a proposal.
Can a host cut off our access to ePHI in a billing dispute?
No, if you are the covered entity. HHS says a business associate may not block a covered entity's access to the PHI it maintains, even in a payment dispute. HHS also says cloud contracts should not block a customer from its ePHI.
Can a BAA require faster breach notice than HIPAA does?
Yes. A business associate must report a breach to the covered entity without unreasonable delay. HIPAA's outer limit is 60 calendar days after discovery. HHS says a BAA may require faster reporting. The parties also set the detail, frequency and format of incident reports.
Why do hospitals review a hosting vendor more closely?
Because hosting touches PHI. The Health Sector Coordinating Council (HSCC) supply chain guide suggests tiering suppliers by criticality and by hosting or access to sensitive data. HSCC's SMART toolkit tiers vendors by business criticality and PHI volume. Vendor risk reviews may cover proposed architecture, plus backup and recovery plans. Choose HIPAA compliant infrastructure you can explain in writing.
Recap: HIPAA compliant infrastructure
For health systems and healthtech teams, HIPAA compliant infrastructure comes down to six written choices, from tenancy to exit. The rules set the floor. Your risk analysis and contract set the rest. That analysis still has to reach every system that holds ePHI.
Whatever you choose, get the same six answers about your HIPAA compliant infrastructure in writing. When your answers are written down, plan your network's hosting with us.
Not legal advice. This article is general information about HIPAA compliant infrastructure for health systems and healthtech companies. It reflects rules, guidance and vendor pages we checked through November 9, 2026. Base your choices on your own risk analysis, and ask counsel about contract terms. We sell HIPAA compliant hosting. Reviewed November 2026.
Sources
45 CFR 164.504.
HHS: HIPAA and cloud computing, cloud provider endorsements and misleading marketing claims.
HHS FAQs: 2075, cloud services, 2076, encrypted ePHI and 2077, conduits.
HHS FAQs: 2079, no BAA, 2080, incident reports and 2084, audits.
HHS FAQ: 2074, blocked access.
OCR: LVHN settlement (October 29, 2026) and VPN Solutions agreement (announced January 2025).
Proposed Security Rule: Federal Register, January 6, 2025 (90 FR 898) and agenda entry, RIN 0945-AA22.
HHS 405(d): HICP Main Document and Technical Volume 2 (both 2023 Edition).
HSCC: supply chain guide (2023), SMART toolkit (October 2025) and third-party AI risk guide (April 2026).
AWS: HIPAA page, HIPAA eligible services (updated October 15, 2026) and shared responsibility model.
AWS: Regions and Zones.