HIPAA Hosting for Small Businesses: How Practices and Startups Should Choose (2026)

Last updated: October 20, 2026

HIPAA hosting for small businesses means a host that signs a Business Associate Agreement (BAA) for the servers holding patient data. Choosing one takes three checks: where patient data lives, who signs the BAA, and who does the security work. This guide compares six routes to HIPAA hosting for small businesses by who signs and what you still own. A solo practice with a cloud EHR and a brochure site may need no special hosting. A clinic with intake forms, or a startup with its own app, needs a host that signs a BAA. The rule is 45 CFR § 164.308(b). We sell managed hosting from $229 a month and appear in the comparison, so weigh our view with that in mind.

TL;DR: Quick answer

• HIPAA has no size cutoff. A provider that sends claims electronically is a covered entity (45 CFR § 160.103). Startups that handle patient data for providers are business associates under the same section.

• Any host that stores your patients' data must sign a BAA first (§ 164.308(b)).

• Six routes cover HIPAA hosting for small businesses, from shared hosts that refuse a BAA to AWS, Microsoft Azure or Google Cloud under their own BAAs.

• Starting prices for HIPAA hosting for small businesses, checked October 20, 2026: HIPAA Vault $120 a month, billed monthly, for one WordPress site. HIPAA Compliant Hosting (us) and Liquid Web start at $229, HIPAA Vault Linux at $349 month to month, and Atlantic.Net at $605.11 on a 12-month term.

• No host is "HIPAA certified," and no host makes you compliant. Your risk analysis, policies, training and other vendors' BAAs stay with you.

Start here: which of your systems touch patient data?

A host must sign a BAA only if it runs systems that create, receive, maintain or transmit electronic protected health information (ePHI). That is the business associate test in 45 CFR § 160.103. List yours: site, forms, booking, portal, EHR, text and email reminders, n8n automations, backups and logs. Our guide to who needs HIPAA compliant hosting walks through covered entities and business associates role by role.

A vendor-hosted EHR comes with the vendor's BAA. That BAA does not cover your website or its forms. Picture an intake form that emails symptoms through a host that refuses a BAA. Closing that gap is where most small practices first need a HIPAA host. Our healthcare IT hosting map shows who hosts the EHR, website, forms and other practice systems, and who signs each BAA.

Section 164.306(b)(2) lets you weigh "the size, complexity, and capabilities" of your practice and "the costs of security measures." Scale is allowed; skipping is not. A website that collects no patient data needs no BAA host. Before you buy, check what your website collects.

Who this guide is for, and what each reader needs

A solo provider often needs a BAA host only for health forms. Clinics, startups and practices that self-host an EHR need BAAs covering every system that holds PHI.

If your practice site runs on WordPress without IT support, compare HIPAA hosting for small businesses on who does the work, not just price. Therapists can start with our guide to hosting for therapists and mental health practices. Brochure sites with a form fit our medical website hosting guide. Practices ready to compare can see our plans for solo practices and clinics.

The last row carries a question the others do not: who installs and patches the EHR software itself, which no host does for you. Our guide to HIPAA compliant EHR hosting sets the vendor cloud, self-hosted and managed-server routes side by side, and names who signs each BAA.

Startups face a different test: clinic customers ask for the BAA chain under your app. A cloud BAA covers only the cloud's layer. For a startup, HIPAA hosting for small businesses means a BAA for every environment that touches PHI. The app platforms compared in the next section sign only on qualifying plans. For the server layer, see our infrastructure for healthtech and EHR systems. Container apps run on our HIPAA compliant Docker hosting tiers.

Six routes to HIPAA hosting for small businesses, compared

The six routes: mainstream hosts, website builders, specialist WordPress plans, managed HIPAA servers, app platforms, DIY cloud. Each turns on one question: will the host sign a BAA for the servers it runs? We list only what each vendor's own pages stated when we checked them on October 20, 2026.

You accept the AWS BAA in AWS Artifact and keep PHI in HIPAA-eligible services. Microsoft includes its BAA in its Product Terms by default, and Google Cloud has customers accept one. Our guide on whether AWS is HIPAA compliant explains the split of duties. Hostinger's and GoDaddy's hosting agreements say their services are not intended to provide a HIPAA compliant environment. GoDaddy offers a BAA for the Microsoft 365 email it sells. See our HIPAA compliant website builder guide for Wix and Squarespace. For what the mainstream hosts leave out, compare HIPAA hosting vs regular hosting.

Our servers are single-tenant, Liquid Web sells dedicated servers, and HIPAA Vault's Linux page states no shared resources. Atlantic.Net also sells dedicated and private cloud HIPAA hosting; its priced plans are managed cloud servers. For most small buyers, the choice comes down to a specialist or a big cloud. Our managed vs self-managed HIPAA hosting guide covers who runs the server. For rankings, see how the best HIPAA hosting providers compare.

What to require from any host: a 10-point checklist

Ask these ten questions of any host offering HIPAA hosting for small businesses, including us.

1. A signed BAA before patient data moves. Required by 45 CFR § 164.308(b). Ours is signed within 24 hours of signup. See our HIPAA business associate agreement guide.

2. The required terms. The BAA must bind the host to the Security Rule, flow those terms to subcontractors and require incident reports (§ 164.314(a)(2)(i)). The host returns or destroys data at the end, if feasible (§ 164.504(e)(2)(ii)(J)).

3. A written scope. Which servers the BAA covers, and which vendors need their own: email, SMS, EHR, forms. AI chatbots and automations that handle patient data go on that list too.

4. Unique logins and strong sign-in. See § 164.312(a)(2)(i) and (d). Multi-factor sign-in is common, but the current rule does not require it by name.

5. Encryption at rest and in transit. Addressable under § 164.312(a)(2)(iv) and (e)(2)(ii). Per § 164.306(d)(3), you implement it, or document why not and use an equivalent measure if reasonable. Addressable does not mean optional.

6. Audit logs you can get. Required by § 164.312(b). Reviewing them stays your job (§ 164.308(a)(1)(ii)(D)).

7. Tested backups and a restore plan. See § 164.308(a)(7)(ii) and our guide to HIPAA backup and disaster recovery.

8. A clear patching duty and isolation. Get in writing who patches the server. HIPAA does not name single-tenant hosting; it is a risk choice (§ 164.308(a)(1)(ii)(B)).

9. Evidence for your risk analysis. HHS says customers may require "additional assurances" through the BAA or a service level agreement. The analysis stays yours (§ 164.308(a)(1)(ii)(A)). ONC's SRA Tool, built with the HHS Office for Civil Rights (OCR) for "medium and small providers," stores answers locally.

10. Plain commercial terms. Price, term, setup fees, migration hours, the rate after them and BAA turnaround, in writing.

HHS proposed the first major Security Rule update since 2013 on January 6, 2025 (RIN 0945-AA22). It is still a proposal. The federal regulatory agenda lists it as a long-term action and now targets a final rule in July 2027. Proposed requirements are not law yet; the current Security Rule still applies. Until a final rule takes effect, judge HIPAA hosting for small businesses against today's rule.

Budget reality for small practices and startups

Among the managed HIPAA hosts here, entry prices run from $120 to $605.11 a month. Terms, setup fees and migration hours change the first-year total. We checked each vendor's published figures on October 20, 2026.

• HIPAA Vault Essential: $120 a month, or $99 a month billed yearly, with the Editor role only. Full Admin and custom plugins need its $349 Starter plan.

• HIPAA Vault Linux: $349 month to month, $319 on a one-year contract, $299 on two years.

• Liquid Web: HIPAA dedicated servers from $229 a month (Linux). Its guide says to expect $600 to $1,000+ a month.

• Atlantic.Net: $605.11 a month on a 12-month term, plus a $150 firewall setup fee. Its plan cards list four included migration hours, and a footnote names the Business and Enterprise plans for them; after that, $160 an hour. Our separate comparison covers which Atlantic.Net alternative fits a small practice.

• Us: managed plans from $229 a month, with 4 hours of migration and configuration included in the first month. After that, $175 an hour, quoted before work starts. That rate is higher than Atlantic.Net's. Monthly plans have no long-term contract. Our guide to moving your site to HIPAA compliant hosting walks through the steps.

Entry plans differ in size. HIPAA Vault's $120 WordPress plan covers one site with 10 GB of storage. HIPAA Vault Linux Starter has 2 vCPU, 16 GB of memory and 40 GB of storage. Atlantic.Net's $605.11 server has 6 vCPU, 16 GB and 200 GB. Our plans come in six sizes, Starter to Network. Compare like for like on size and first-year total, using each host's published specs. Our HIPAA hosting cost guide breaks down each line. Tight budget? See our affordable HIPAA hosting roundup.

Seven mistakes small practices make

OCR enforces the HIPAA Security Rule (45 CFR Part 164, Subpart C). Avoid these seven errors when you buy HIPAA hosting for small businesses.

1. Collecting patient data on a host that refuses a BAA. Bluehost states: "We do not sign Business Associate Agreements."

2. Assuming the EHR's BAA covers the website. It covers the EHR only. Squarespace draws the same line: its BAA "doesn't cover other Squarespace features" outside Acuity. Email, SMS and forms vendors need their own.

3. Thinking encryption avoids the BAA. HHS says a cloud host holding only encrypted ePHI without the key is still a business associate.

4. Using a cloud service outside the BAA. AWS lists more than 170 HIPAA eligible services in its HIPAA Eligible Services Reference (list updated October 15, 2026). Amazon Lightsail is not one of them.

5. Shopping for "HIPAA certified" hosting. No such certification exists, and OCR certifies no products. See HIPAA certified hosting for what to ask instead.

6. Treating the host as the compliance program. On April 25, 2025, OCR announced a $25,000 settlement with Comprehensive Neurology, PC, under its Risk Analysis Initiative. The small New York practice had been hit by ransomware. OCR said it "failed to conduct an accurate and thorough risk analysis." Start your own HIPAA risk analysis.

7. Never testing a restore. Section 164.308(a)(7)(ii)(A) requires "retrievable exact copies" of ePHI, and (D) calls for periodic testing of contingency plans. On April 23, 2026, OCR announced four ransomware settlements totaling $1,165,000. Each cited a failed risk analysis. OCR Director Paula M. Stannard said hacking and ransomware "are the most frequent type of large breach reported to OCR." Test restores on a schedule.

Where we fit, and when you may not need us

Disclosure: we sell HIPAA hosting for small businesses and publish this guide. HIPAA Compliant Hosting (hipaacomplianthosting.com) runs managed, single-tenant AWS environments from $229 a month. Plans come in six sizes, Starter to Network; the Performance tier for n8n, Drupal, Strapi, Docker and Phalcon starts at $259. We sign the BAA within 24 hours of signup, before patient data moves. Among the specialist HIPAA hosts we checked, only HIPAA Vault states a timing: within 48 hours of account activation, for Linux. Every plan includes a web application firewall, encryption at rest and in transit, six-year audit logging and tested encrypted backups. Each plan also has 4 hours of migration and configuration included in the first month, on any of our 17 supported platforms. Our BAA covers only the servers and services we run; email, SMS, EHR and forms vendors need their own. For a practice without IT support, that split matters most. See what we run and what you run, and what HIPAA managed hosting includes.

You may not need us. If your site collects no patient data and your EHR, forms and scheduling vendors sign BAAs, ordinary hosting is fine. For one small WordPress site at the lowest sticker price, HIPAA Vault's $120 plan costs less. Our guide to HIPAA Vault alternatives compares that host with other specialists and DIY cloud. With a cloud engineer, AWS, Azure or Google Cloud gives you full control. Root access comes only through an Enterprise engagement. Each plan is one server in one AWS availability zone; a multi-zone design is quoted separately. Need a host's SOC 2 report? HIPAA Compliant Hosting does not hold SOC 2 or HITRUST certification. Unsure? Take a short check of your setup.

Ready? Compare our current plans. If you run a practice, request a quote for your practice. If you are building an app, request a quote for your app infrastructure. Not every setup needs HIPAA hosting for small businesses, so start with the three checks above.

Frequently asked questions

Which HIPAA hosting is best for a small business?

The best fit signs a BAA for the systems it hosts and does the security work you cannot. For HIPAA hosting for small businesses without an IT person, that usually means a managed specialist such as HIPAA Vault, Liquid Web, Atlantic.Net or us. With a cloud engineer, AWS, Microsoft Azure or Google Cloud can cost less.

Does HIPAA apply to a small practice or solo provider?

Yes, if you send claims or other standard transactions electronically. HIPAA has no size cutoff. Such a provider is a covered entity under 45 CFR § 160.103. Safeguards may scale to size and budget (§ 164.306(b)(2)).

Do I need HIPAA hosting if my EHR is already in the cloud?

Only for systems you run that hold patient data. The EHR vendor's BAA covers the EHR. The usual gaps in HIPAA hosting for small businesses are intake forms, portals, booking pages and self-hosted apps. Each needs a BAA from whoever hosts it.

How much does HIPAA hosting cost a small practice?

Among managed hosts we checked, HIPAA hosting for small businesses starts at $120 a month, billed monthly, for one WordPress site at HIPAA Vault. Our plans and Liquid Web's dedicated servers start at $229, HIPAA Vault Linux at $349 month to month, and Atlantic.Net at $605.11 on a 12-month term. Prices were checked October 20, 2026, and plan sizes differ.

Is HIPAA hosting worth the price for a small business?

HIPAA hosting for small businesses is worth the price when a system you run holds patient data, since that host must sign a BAA. The stakes are real: on April 23, 2026, OCR announced four ransomware settlements totaling $1,165,000. If nothing you run holds patient data, ordinary hosting costs less and is enough.

Can a startup just use AWS and sign the AWS BAA?

Yes, if someone on your team can configure and run it. You accept the AWS BAA in AWS Artifact and keep PHI in HIPAA-eligible services. Patching, firewalls, access, logging and backups stay yours under the shared responsibility model.

Who offers managed HIPAA hosting for startups and clinics?

Specialist hosts that sign a BAA and run the servers include HIPAA Compliant Hosting (us), HIPAA Vault, Liquid Web and Atlantic.Net. Compare BAA scope, plan size and what stays with you. See who runs what in our comparison of managed and self-managed hosting.

Which hosting services sign a BAA?

Specialists such as HIPAA Vault, Liquid Web, Atlantic.Net and us sign for the servers they run. AWS, Microsoft Azure and Google Cloud sign for eligible services, but you run the servers. Wix signs once PHI protection is on; Squarespace signs only for Acuity Scheduling. Bluehost and WP Engine refuse.

Is there HIPAA certified hosting?

No. HHS certifies no host, and AWS states there is no HIPAA certification for a cloud provider. When you compare HIPAA hosting for small businesses, ask for a signed BAA, a written scope and evidence for your risk analysis.

How do I choose HIPAA hosting for an EHR or EMR system?

A vendor-hosted EHR is covered by the vendor's BAA; a self-hosted EHR such as OpenEMR needs a host that signs a BAA. That host should isolate the server, keep audit logs and test restores. Our guide to HIPAA compliant EHR hosting works through all three routes and the vendor exit terms to check before you sign. It also has a 10-point checklist for choosing a host.

Recap: HIPAA hosting for small businesses

HIPAA hosting for small businesses starts with three checks. Find the systems that hold patient data, get a BAA from whoever hosts them, and decide who does the security work. Use the 10-point checklist on every host, including us. Prices change, so confirm terms with each vendor. Then pay for HIPAA hosting only on the systems that need it.

General information, not legal advice. Vendor prices and BAA terms are as checked on October 20, 2026; confirm them with each vendor. Base safeguards on a documented risk analysis and consult counsel. We sell HIPAA compliant hosting. Reviewed October 2026.

Sources

• 45 CFR § 160.103, § 164.306, § 164.308, § 164.312, § 164.314 and § 164.504.

• HHS: Guidance on HIPAA and Cloud Computing; OCR releases of April 25, 2025 and April 23, 2026.

• ONC: Security Risk Assessment Tool. Federal regulatory agenda: RIN 0945-AA22. Federal Register: 90 FR 898.

• AWS: HIPAA compliance, eligible services, shared responsibility.

• Microsoft: Azure HIPAA offering. Google Cloud: HIPAA compliance.

• Hosts: Atlantic.Net, HIPAA Vault WordPress, HIPAA Vault Linux, Liquid Web, Liquid Web guide.

• Platforms: Aptible, Render docs, Render pricing, Vercel.

• Builders and hosts: Wix, Squarespace, Acuity pricing, Bluehost, WP Engine, Hostinger, GoDaddy email BAA, GoDaddy hosting agreement.

• Software: OpenEMR. Our offer: scope of support.