HIPAA-Compliant WordPress Hosting: What the Hosting Layer Must Provide

HIPAA compliant WordPress hosting supplies what WordPress core lacks: a signed BAA, encryption at rest and in transit, audit logging, access controls, and tested backups. WordPress itself is general-purpose publishing software. It has no concept of protected health information and no audit controls aimed at PHI access. It also has no contractual mechanism to bind anyone to the HIPAA Security Rule. So the safeguards are built around WordPress, mostly at the hosting layer. That layer is what separates HIPAA compliant WordPress hosting from an ordinary WordPress host.

Each safeguard has a legal anchor in 45 CFR. The Business Associate Agreement (BAA) requirement is in § 164.308(b). Access controls fall under § 164.312(a)(1). Encryption of ePHI falls under § 164.312(a)(2)(iv) at rest and § 164.312(e)(2)(ii) in transit. Audit logging falls under § 164.312(b), and backups under the contingency plan standard, § 164.308(a)(7). For a side-by-side of what that layer adds, see HIPAA hosting vs regular hosting.

TL;DR: Quick answer

• WordPress core is neither HIPAA compliant nor non-compliant. HIPAA regulates Covered Entities and Business Associates under 45 CFR § 160.103, not software, so the obligations land on whoever hosts and operates the site.
• The hosting layer must provide a signed BAA (§ 164.308(b), § 164.504(e)) and encryption at rest and in transit (§ 164.312(a)(2)(iv), (e)(2)(ii)). It must also provide audit logging (§ 164.312(b)) and backup and recovery under the contingency plan standard (§ 164.308(a)(7)).
• A common WordPress PHI leak is a form plugin emailing submissions in plaintext to an inbox with no BAA. Once a visitor submits health details, that email path counts as a PHI disclosure.
• Standard managed WordPress hosts (and wordpress.com plans) generally will not sign a BAA; a BAA-covered environment on AWS HIPAA Eligible Services is a common foundation.
• No host can sell "HIPAA certified" WordPress hosting; no official HIPAA certification exists, so evaluate the BAA and the named controls instead.
• Our managed plans host WordPress on single-tenant AWS from $229 a month, with the BAA signed within 24 hours of signup.

Why WordPress core cannot be HIPAA compliant on its own

HIPAA applies to Covered Entities and Business Associates, not to software products. A CMS cannot sign a BAA, perform a risk analysis under § 164.308(a)(1)(ii)(A), or retain documentation for six years under § 164.316(b)(2)(i). What WordPress core specifically lacks, measured against the technical safeguards at § 164.312:

• No PHI-aware audit controls. WordPress logs almost nothing by default. There is no built-in record of who viewed a stored form submission. Yet § 164.312(b) requires mechanisms that record and examine activity in systems that contain ePHI. Our guide to HIPAA audit logs covers what to record and how long to keep it.
• No encryption at rest. The MySQL database and uploads directory are plaintext unless the hosting layer encrypts the storage beneath them.
• No automatic logoff. WordPress sessions persist for 48 hours by default, and two weeks with "remember me." That conflicts with the automatic logoff specification at § 164.312(a)(2)(iii) unless shortened.
• Weak default access control. Roles exist, but there is no MFA, no login throttling, and the admin account is enumerable out of the box.
• A plugin trust model. Any plugin can read the entire database, which makes every installed plugin part of your ePHI attack surface.

None of this makes WordPress unusable for healthcare. It means the compliance work happens in the hosting environment and configuration. The same is true of Drupal, static sites with form backends, and most other stacks. Whether your organization needs this at all depends on whether PHI actually flows through the site. Our guide to who needs HIPAA-compliant hosting covers that threshold question.

What must the hosting layer provide? Requirements with CFR citations

Encryption specifications are addressable under § 164.306(d). That means you implement them when reasonable and appropriate, or document why not and adopt an equivalent alternative if reasonable. For a hosted website handling ePHI, there is rarely a defensible alternative. This table is the requirements view. The step-by-step build order, from BAA to hardening to forms, is a separate article: how to make WordPress HIPAA compliant. The plan around those backups is covered in HIPAA backup and disaster recovery.

Why ordinary managed WordPress hosts do not qualify

The disqualifier is usually contractual before it is technical. Mainstream WordPress hosts build for publishing performance, and their terms of service often prohibit storing regulated health data. Most will not sign a BAA. Without one, the arrangement fails § 164.308(b), however good the infrastructure is. WP Engine is the clearest example: its acceptable use policy bars storing PHI, and it says it does not sign BAAs. Our analysis of is WP Engine HIPAA compliant shows how the missing BAA rules out even a premium managed platform. Shared hosting adds technical problems: co-tenant isolation you cannot verify, no per-customer audit trail, and backup systems outside your control.

The workable pattern for HIPAA compliant WordPress hosting is dedicated, BAA-covered infrastructure, often on AWS. In its HIPAA Eligible Services Reference, AWS lists more than 170 HIPAA eligible services (list updated October 15, 2026). Eligible does not mean compliant. AWS says customers must still configure each service to meet HIPAA, and that work falls to you or your managed provider. We compare the realistic options in our roundup of the best HIPAA WordPress hosting providers. The cost differences are covered in how much HIPAA hosting costs in 2026. On a tight budget, our guide to affordable HIPAA hosting compares the lowest-priced WordPress plans that sign a BAA.

Plugins and forms: where WordPress sites actually leak PHI

The hosting layer can be perfect and the site still non-compliant, because plugins move PHI along paths the host never sees. The canonical failure: a contact or intake form collects symptoms, medications, or appointment reasons. The form plugin then emails the submission in plaintext to the front desk, through whatever SMTP service is configured. That hands PHI to an email provider with no BAA, on every single submission. Our guide to HIPAA compliant WordPress forms maps the architecture options here. It also explains why self-hosted form plugins make your host the Business Associate for every stored submission.

Three rules contain the risk:

• Inventory every PHI path. Form submissions, notification emails, plugin databases, analytics, chat widgets, and marketing pixels. If a vendor receives PHI, that vendor is a Business Associate and needs a BAA; "popular plugin" is not an exemption.
• Stop plaintext email notifications. Either send a content-free alert ("a new submission is waiting") with the PHI retrievable only from encrypted storage, or use a BAA-covered email service. Our guide to HIPAA-compliant email encryption covers the second option.
• Encrypt stored submissions. Form entries saved to wp_posts or a plugin table inherit whatever encryption the database has. That is why hosting-layer encryption at rest matters even for "just a contact form." The full intake-form pattern is worked through in making therapist contact forms HIPAA compliant.

Frequently asked questions

Is WordPress HIPAA compliant?

The question is category-confused: HIPAA regulates organizations, not software. WordPress can be part of a compliance-ready deployment when hosted on BAA-covered, encrypted, logged infrastructure and configured so PHI never travels an unprotected path. See the full verdict, including WordPress.com and WordPress VIP, in is WordPress HIPAA compliant.

Will wordpress.com or a mainstream host sign a BAA?

Generally no. Most consumer and mainstream managed WordPress hosts decline BAAs and exclude regulated health data in their terms. As checked on October 20, 2026, WP Engine and Kinsta both say they do not sign BAAs. The WordPress.com terms of service do not mention HIPAA or BAAs. Confirm in writing before assuming otherwise.

Are there HIPAA-certified WordPress plugins?

No official HIPAA certification exists for any product. Evaluate whether the plugin vendor signs a BAA when it receives PHI and whether the data flow (storage, notifications, third-party calls) stays encrypted and access-controlled.

Can I keep PHI out of WordPress entirely?

Often yes, and it simplifies everything. Embedding a BAA-covered external form or scheduling tool keeps PHI off the WordPress database, leaving the site itself with a much smaller compliance surface. The marketing pages still need TLS and hardening, but the ePHI safeguards concentrate where the data lives.

Does a HIPAA-ready host make my site compliant automatically?

No. The host covers infrastructure safeguards and the BAA; you remain responsible for plugin choices, user accounts, form configuration, and the risk analysis required by § 164.308(a)(1)(ii)(A).

Where to go from here

For the wider context beyond WordPress, start with our complete guide to HIPAA-compliant hosting. If you want the BAA, encryption, audit logging and backups handled for you, our HIPAA compliant hosting service provides managed HIPAA compliant WordPress hosting. That is our business, so read the recommendation with that in mind.

How we handle it: every plan runs on single-tenant AWS with encryption at rest and in transit, six-year audit logging and tested encrypted backups. Each plan also includes a web application firewall and the CloudFront CDN. We sign the BAA within 24 hours of signup, before patient data moves. Our BAA covers the servers and services we run. Third-party form, email and SMS vendors that receive PHI need their own. Check any BAA, ours included, against our guide to the HIPAA business associate agreement.

Our managed plans start at $229 a month, with no long-term contract. The six sizes, Starter to Network, are on our pricing page. Each plan includes 4 hours of migration and configuration, used in the first month. After that, work is $175 an hour, quoted before work starts. The move itself, step by step, is in our guide to migrating to HIPAA compliant hosting.

This article is general information, not legal advice. Consult qualified counsel and base your safeguards on a documented risk analysis under 45 CFR § 164.308(a)(1)(ii)(A). Reviewed October 2026.

Sources

• 45 CFR § 164.312, Technical safeguards (eCFR)
• 45 CFR § 164.308, Administrative safeguards (eCFR)
• 45 CFR § 164.504, Organizational requirements including BAA contents (eCFR)
• HHS: Business Associate contract provisions
• AWS HIPAA Eligible Services Reference (last updated October 15, 2026)
• 45 CFR § 164.306, Security standards general rules, including addressable specifications (LII)
• HHS FAQ: no HIPAA Security Rule certification is required or recognized
• WordPress Developer Resources: wp_set_auth_cookie() and default session lengths
• WP Engine Acceptable Use Policy
• WP Engine: Is Your Website HIPAA Compliant? 8 Questions to Ask Your Hosting Provider
• Kinsta Technical FAQ (HIPAA and BAAs)
• WordPress.com Terms of Service