Is Ghost CMS HIPAA Compliant? Ghost(Pro), Mailgun, and the Self-Hosted Path (2026)

Last updated: September 14, 2026

Ghost is not HIPAA compliant as software or as a hosted service. Ghost(Pro) offers no Business Associate Agreement (BAA) on any of its public pages, and its servers are in Amsterdam. Self-hosted Ghost 6 can sit inside a compliant system. It needs a host that signs a BAA and a separate BAA for newsletter email. And patient details must stay out of email bodies. That is the short answer to whether a Ghost CMS HIPAA compliant setup is possible. Yes, with work, and not on Ghost(Pro). Healthcare teams like Ghost for patient newsletters, memberships, and health education. Those uses carry more risk than they look. A clinic's subscriber list can show who its patients are. This guide covers what Ghost 6 gives you, what Ghost(Pro) and Mailgun offer, and the settings that matter. Every fact was checked on September 14, 2026. One note: this page is about Ghost, the open-source publishing platform, not the analytics product Ghost Metrics.

TL;DR: Quick answer

• Ghost(Pro) costs $18, $29, or $199 per month, billed yearly. Its pricing, terms, privacy, and data processing pages mention no HIPAA support or BAA.

• Ghost(Pro) servers are in Amsterdam, the Netherlands. Its data agreement is written for the EU's GDPR, not HIPAA.

• Newsletters need Mailgun. Mailgun publishes a HIPAA Business Associate Addendum, but it warns that email may be intercepted in transit.

• Ghost 6 gives staff email-based two-factor login, a 5-per-hour login limit, bcrypt passwords, and a staff history log. It has no field encryption.

• Ghost 5 reached end of life in January 2026. A Critical flaw fixed on September 3, 2026 let suspended staff reactivate their accounts, so run 6.62.0 or later.

Is Ghost CMS HIPAA compliant? The three-layer answer

A Ghost CMS HIPAA compliant system has three layers, and each one needs an owner. The first is the contract. Any vendor that stores or processes protected health information (PHI) for a covered entity is a business associate under 45 CFR § 160.103. Under 45 CFR § 164.308(b), you need a signed BAA with that vendor first. With Ghost, that means the host, the newsletter email provider, and Stripe if memberships are paid. Our HIPAA business associate agreement guide explains what each contract must cover. The second layer is the server. The host runs the physical safeguards, disk encryption, backups, and patching. The third layer is Ghost's settings and your team. The HIPAA Security Rule lists five technical safeguards in 45 CFR § 164.312. They are access control, audit controls, integrity, person or entity authentication, and transmission security. Ghost handles staff login well and gives you a basic audit log. That covers part of a Ghost CMS HIPAA compliant build. The rest comes from the host and your policies. You also run a risk analysis under 45 CFR § 164.308(a)(1).

Not every Ghost site handles PHI. A practice blog with public articles and no sign-ups holds none. The Ghost CMS HIPAA compliant question gets real when patients join a member list, pay for a program, or reply to a newsletter. Member records hold email addresses, names, notes, labels, and Stripe customer IDs. If those members are a provider's patients, the list itself can reveal who is a patient.

What does Ghost 6 give you for the HIPAA technical safeguards?

Here is how Ghost 6 maps to each rule in 45 CFR § 164.312. The middle column is what ships in Ghost. The last column is what a Ghost CMS HIPAA compliant site still needs from you or your host.

Two limits matter most. First, Ghost's two-factor login sends a six-digit code by email. It has no authenticator app option. If your policy needs app-based codes, add them in front of the admin panel. Second, Ghost's docs say staff users are trusted by default. If any staff user is not fully trusted, run the admin panel and the public site on separate domains. Both limits shape a Ghost CMS HIPAA compliant setup. The two-factor rules are in HIPAA MFA requirements.

Does Ghost(Pro) sign a BAA?

No, not on any page we could find. We checked Ghost(Pro)'s pricing page, terms of service, privacy policy, data processing agreement, and its security and data practices article. None mentions HIPAA, PHI, or a Business Associate Agreement. The data processing agreement is written for the EU's GDPR. It says data outside the EU may be processed anywhere in the world. Ghost's help center says all Ghost(Pro) servers are in Amsterdam, the Netherlands. So Ghost(Pro) is not a Ghost CMS HIPAA compliant route today. Here are its plans as published on September 14, 2026.

Ghost(Pro) does have real security, even though it is not a Ghost CMS HIPAA compliant host. Every plan runs behind Fastly, with DDoS protection, a web application firewall, brute force protection, and rate limiting. That is protection, not a contract. HIPAA needs the contract. If your Ghost site handles no PHI, Ghost(Pro) is a sound and affordable host.

Is Mailgun HIPAA compliant for Ghost newsletters?

Mailgun can sign a BAA, but it cannot make email private. Ghost's docs say Mailgun is optional for transactional email and required for bulk mail. So every Ghost newsletter goes through Mailgun. Mailgun publishes a HIPAA Business Associate Addendum, last revised November 20, 2020. It applies only to the extent Mailgun acts as a business associate. The addendum also warns that email sent through Mailgun may be unsecured and may be intercepted. Mailgun's pricing page lists Free, Basic, Foundation, and Scale plans, from $0 to $90 per month. None of those plans mentions HIPAA. Ask Mailgun in writing which plan your BAA requires. Keep that answer with your Ghost CMS HIPAA compliant records. The safe rule for a Ghost CMS HIPAA compliant newsletter is simple. Sign the Mailgun BAA, and still never put PHI in the email body. Send health education to everyone, and link to a secure portal for anything personal. Our comparison of the best HIPAA compliant email providers covers other options for one-to-one messages.

The 8 settings that make a Ghost site HIPAA-ready

These are the first settings we check in Ghost CMS HIPAA compliant reviews. Each one comes from Ghost's own docs or changelog.

1. Run Ghost 6.62.0 or later. That fixes the Critical flaw that let suspended staff reactivate accounts. Ghost 5 is past end of life.

2. Require two-factor on every staff login. Turn it on under Settings, then Staff users, then Security. Keep staffDeviceVerification at its default, which is on.

3. Split the admin and public domains. Ghost's docs recommend this whenever any staff user is not fully trusted.

4. Remove departed staff the same day. Delete the account, not just suspend it, and confirm access is gone. Ghost CMS HIPAA compliant sites log this step.

5. Sign the Mailgun BAA before the first send. Keep newsletters general, and never place PHI in an email body.

6. Sign a Stripe agreement if members pay. Billing data lives in your own Stripe account, so that vendor needs review too.

7. Keep the history log long term. Export it on a schedule, and pair it with host-level server and database logs.

8. Only install themes you trust. A March 2026 flaw let crafted themes run code on the server until Ghost 6.19.1.

Item 4 matters more than it looks. HIPAA's workforce security standard in 45 CFR § 164.308(a)(3) covers ending access when people leave. Ghost's September 2026 flaw showed that suspension alone was not enough on older versions. With all eight in place, most Ghost CMS HIPAA compliant work inside the platform is done.

Where does Ghost leak PHI?

Mostly through email and add-ons, not the posts. A Ghost CMS HIPAA compliant setup watches all five paths below. These are the leaks we see most in Ghost CMS HIPAA compliant reviews.

• Newsletter bodies. Anything personal in an email can be read in transit, BAA or not.

• Member exports. A CSV of members on a laptop is a list of identifiers outside your safeguards. Names and email addresses are both among the 18 HIPAA identifiers.

• Tracking scripts. Pixels on member-only or appointment pages can send health context to ad platforms. The rules are in HIPAA tracking technologies.

• Themes and integrations. Custom themes run on your server, and webhooks send data to other services.

• Comments. Members sometimes share symptoms in comments on health articles. Moderate them, or turn comments off.

What does HIPAA hosting for Ghost cost in 2026?

A Ghost CMS HIPAA compliant budget starts with a host that signs a BAA. Ghost(Pro) does not, so it cannot carry PHI at any price. Figures are as published on September 14, 2026.

We sell the last row, so weigh it as a disclosure. The DIY row looks cheap, but Ghost published many security advisories in August and September 2026. Someone has to apply those updates within days. Backups need the same attention, as covered in HIPAA backup and disaster recovery. If you are also weighing WordPress, see is WordPress HIPAA compliant for the same test applied there. Headless teams can compare the Strapi HIPAA compliant route as well.

If you would rather not run the server layer yourself

Most teams choose Ghost to publish, not to run servers. Ghost is one of the 17 platforms we host. If you run Ghost's Docker Compose install, our HIPAA compliant Docker hosting gives it a single-tenant AWS host. We run the host, the Docker engine, CloudFront, the web application firewall, encryption, audit logging, and backups. You run the Ghost containers and their settings. If you run the classic Ghost-CLI stack, our managed HIPAA cloud hosting covers that setup. Tell us which install you use, and we match it. Your Ghost CMS HIPAA compliant setup stays the way you built it. Either way, the BAA is signed within 24 hours. Plans start from $249 per month with migration included. We sell this, so weigh it as a disclosure.

Here is the honest inverse. If your Ghost site is a public blog with no member sign-ups, it holds no PHI. Ghost(Pro) at $18 per month is then a fine choice, and you do not need us. If your team already runs a cloud server under a signed BAA and patches Ghost within days, that works too. For everyone else, our HIPAA compliant hosting plans are public. You can request a quote or tell us what your members sign up for and get a straight answer.

Frequently asked questions

Is Ghost CMS HIPAA compliant?

No, not by itself. Ghost(Pro) offers no BAA and hosts in Amsterdam. A Ghost CMS HIPAA compliant setup needs self-hosted Ghost 6 on a host that signs a BAA. It also needs a Mailgun BAA, required staff two-factor login, and no PHI in newsletters.

Does Ghost(Pro) sign a BAA?

No. Ghost(Pro)'s pricing, terms, privacy policy, and GDPR data processing agreement never mention HIPAA or a BAA, as of September 14, 2026. Its servers are in Amsterdam. Without a signed BAA, Ghost(Pro) cannot store or process PHI.

Is Mailgun HIPAA compliant?

Mailgun publishes a HIPAA Business Associate Addendum, last revised November 20, 2020. It still warns that email may be intercepted in transit. Its pricing page names no HIPAA plan, so confirm eligibility with Mailgun. Keep PHI out of newsletter bodies either way.

Can I self-host Ghost on HIPAA compliant hosting?

Yes. Ghost's official stack is Ubuntu, Node.js 22, and MySQL 8 with at least 1 GB of memory. A Docker Compose install is also available as a preview. Either one can run on a host that signs a BAA and hardens the server.

Is Ghost safer than WordPress for a healthcare newsletter?

Ghost has fewer plugins to manage, which shrinks the attack surface. It still had a Critical staff access flaw in September 2026. Neither platform is compliant on its own. The host, the email BAA, and fast patching decide the outcome.

Recap: Ghost CMS HIPAA compliant

To recap, a Ghost CMS HIPAA compliant setup is self-hosted Ghost 6 on a host that signs a BAA. Ghost(Pro) offers no BAA and runs in Amsterdam, so it is not a PHI route. Newsletters run through Mailgun, which has its own BAA but warns that email can be intercepted. Ghost gives you staff roles, email two-factor, login limits, bcrypt, and a history log. You add long-term logs, same-day staff removal, trusted themes, and fast updates. Keep PHI out of email bodies, and run Ghost 6.62.0 or later.

This article is general information, not legal advice. Plans, prices, BAA terms, and support dates change often. The details here reflect Ghost's and Mailgun's public pages, docs, and GitHub advisories as read on September 14, 2026. Confirm current terms with each vendor, consult qualified counsel, and base your safeguards on a documented risk analysis. We sell HIPAA compliant hosting and compliance reviews. Reviewed September 2026.

Sources

• Ghost: Ghost(Pro) pricing, Terms of service, and GDPR data processing agreement.

• Ghost help: Security and data practices.

• Ghost docs: Security, Configuration, Staff users, Members.

• Ghost docs: Hosting and Major versions and LTS.

• Ghost changelog: Ghost 6.0 (August 4, 2025) and Two-factor authentication (April 22, 2025).

• GitHub advisories: Suspended staff account reactivation and CVE-2026-29053.

• Mailgun: HIPAA Business Associate Addendum (revised November 20, 2020) and Pricing.

• 45 CFR § 164.312 (technical safeguards): law.cornell.edu.

• 45 CFR § 164.308 (administrative safeguards, BAA requirement): ecfr.gov.

• 45 CFR § 160.103 (definitions): ecfr.gov.