Is Joomla HIPAA Compliant? Joomla 6, Multi-factor Authentication, and the Settings to Switch On (2026)

Last updated: October 22, 2026

Joomla is not HIPAA compliant on its own, and no CMS is. HIPAA regulates the organizations that handle patient data, not the software they run. A Joomla HIPAA compliant site needs a host that signs a Business Associate Agreement (BAA), the right settings, and your own policies. Joomla core ships several controls you need: multi-factor authentication, a User Actions Log, and a 15-minute session default. Most of them ship off or unenforced. No Joomla vendor signs a BAA, so your host is the one that signs. We sell HIPAA compliant hosting, so weigh our advice accordingly.

TL;DR: Quick answer

• A Joomla HIPAA compliant site needs a host that signs a BAA under 45 CFR § 164.308(b). As of October 20, 2026, no Joomla-branded service offers one.

• Joomla Launch, the free hosting at launch.joomla.org, is run by CloudAccess.net. Its page mentioned no HIPAA terms or BAA on October 20, 2026.

• Core MFA supports TOTP, WebAuthn, YubiKey, and email codes. "Enforce Multi-factor Authentication" (forceMFAUserGroups) covers no user group by default, and "IP Logging" (ip_logging) is off.

• In a fresh Joomla 6.2 install, "Force HTTPS" (force_ssl) is None and HSTS (hsts) is off. "Session Lifetime" (lifetime) is 15 minutes, and "Send Password" (sendpassword) is No.

• Joomla 6.2.0 and 5.4.10, released October 13, 2026, are current. Joomla 5.x now gets security fixes only, until October 12, 2027. 2026 brought six High advisories and four MFA bypasses.

Is Joomla HIPAA compliant? The three-layer answer

A Joomla HIPAA compliant system has three layers, and each needs an owner. The first is the contract. Under 45 CFR § 164.308(b), any vendor that stores protected health information (PHI) for you must sign a BAA first. Our HIPAA business associate agreement guide covers what it must say. The second layer is the server: physical safeguards, disk encryption, firewalls, backups, and patching. The third layer is your Joomla site and your team. It covers the technical safeguards in 45 CFR § 164.312, which Joomla meets only in part. It also covers the HIPAA risk analysis under 45 CFR § 164.308(a)(1), policies, and training.

Joomla! is a free PHP content management system (CMS), licensed GPL-2.0-or-later. Its maintainer is Open Source Matters, Inc. (OSM), a nonprofit that holds the project's trademarks. The Joomla Framework is a separate set of PHP packages; HIPAA questions concern the CMS. OSM sells no hosting under a BAA. So the Joomla HIPAA compliant question comes down to your host and your settings.

What Joomla gives you for the HIPAA technical safeguards

Here is how Joomla core maps to 45 CFR § 164.312, per the 6.2 and 5.4 source. The last column is what a Joomla HIPAA compliant site still adds.

Two gaps matter most. First, Joomla core encrypts nothing at rest. Articles, user records, sessions, and action logs sit in plain text in the database. Disk and database encryption at rest and in transit is the host's job. Second, the User Actions Log records back-end changes, logins, and logouts, not who viewed a page. Audit logging for a Joomla HIPAA compliant site means core logs plus web server logs, shipped off the server. ExpressionEngine 7 records less than Joomla. Its six logs include a control panel access log, but none shows which user edited which entry. An ExpressionEngine HIPAA compliant site fills that gap with an add-on such as Logit or Informer.

Where Joomla sites usually get hosted, and which hosts sign a BAA

No official Joomla cloud signs a BAA. We read each host's own pages in September 2026, and again on October 20, 2026.

• Joomla Launch: no BAA. The old joomla.com address now redirects to launch.joomla.org. CloudAccess.net runs it "on behalf of Open Source Matters, Inc.," the page says. It is free, with paid plans from $5 per month, and never mentions HIPAA.

• CloudAccess.net managed hosting: no BAA. One plan at $9.58 per month, with no HIPAA or BAA language.

• SiteGround: no BAA found. Its HIPAA help article covers Google's BAA for Google Workspace email, not SiteGround hosting.

• Rochen and Hosting.com: not confirmed. Neither had a HIPAA page we could read, so we make no claim about either.

• DigitalOcean: BAA on request. "New customers may request a BAA by contacting Sales," its HIPAA page says. Droplets, Droplet Backups, Volumes, and Spaces are covered.

• AWS: BAA in AWS Artifact. You accept AWS's standard BAA in AWS Artifact. You install and harden Joomla on EC2 yourself.

On DigitalOcean or AWS, the cloud signs for its hardware. You own the operating system, PHP, Joomla, TLS, logs, and backups. Cloud providers call this split the shared responsibility model. DigitalOcean's 1-Click Joomla images make HTTPS an opt-in step and do not enforce MFA. One of them, OpenLiteSpeed Joomla, lists Joomla 6.1.1 in its docs, so update to 6.2.0 or later before use. More hosts are compared in our best HIPAA compliant hosting providers ranking. A Joomla HIPAA compliant build on either cloud works, but the hardening is yours.

Which Joomla settings are off by default?

These defaults come from the Joomla 6.2.0 and 5.4.10 source, including the installer, read October 20, 2026. A Joomla HIPAA compliant site changes most of them.

Fresh installs set Send Password to No. Joomla falls back to Yes when the setting is missing, so confirm it. When it is Yes, Joomla emails new users their password at registration. That puts a patient portal login in an inbox you do not control. And all four MFA plugins ship switched on, yet no one is forced to use one. A Joomla HIPAA compliant setup closes both gaps first.

Which Joomla versions are safe to run?

As of October 20, 2026, Joomla 6.2.0 and 5.4.10 are current. Both came out on October 13, 2026. No security advisories have been published since the 6.1.4 and 5.4.9 releases of September 29, 2026. Joomla's roadmap sets the dates that matter:

• Joomla 6.2.0 shipped on October 13, 2026. The next release, 6.2.1, is scheduled for November 24, 2026.

• Joomla 5.4.10 was the last 5.x bug fix release. Since October 13, 2026, Joomla 5.x gets security fixes only, until October 12, 2027.

• Joomla 6.x gets bug fixes to October 17, 2028 and security fixes to October 16, 2029.

• Joomla 4 support ended October 14, 2025. Most 2026 advisories list 4.x as affected, and none has a 4.x fix.

Joomla 6.x needs PHP 8.3 or later, and 5.4 needs PHP 8.1 or later. The Joomla Security Strike Team (JSST) shipped six security rounds in 2026. For a Joomla HIPAA compliant site, these matter most:

The JSST uses its own scale of Critical, High, Moderate, and Low, not CVSS. On that scale, High means site data is compromised. The four MFA bypasses mean MFA protects you only on a patched site. A Joomla HIPAA compliant site runs the newest 6.x release, or 5.4.x until October 12, 2027, and patches within days.

Joomla updates do not fix flaws in PHP itself, so also run PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, or a later patch on the same branch. PHP released those on October 21, 2026, to fix CVE-2026-109618 and CVE-2026-109619, two critical flaws that can allow unauthenticated remote code execution. If your PHP comes from a Linux distribution, check your vendor for an updated package, since vendors received the patches in advance. PHP 8.1 and older no longer receive updates from the PHP project. A Joomla 5.4 site on 8.1 needs a backported fix or one of the fixed releases. PHP 8.2 reaches end of life on December 31, 2026, so a 5.4 site is better on PHP 8.3, which Joomla 5.x recommends.

The 9 settings that make a Joomla site HIPAA-ready

Change these before a Joomla HIPAA compliant site handles patient data.

1. Update, and keep updating. Run 6.2.0 or later, or 5.4.10 while you plan the move to 6. In the Joomla Update options, confirm "Automated Update" (autoupdate) is Yes. Fresh 6.1 and 6.2 installs ship with it on. Apply PHP security releases too, since Joomla updates do not include them.

2. Force HTTPS for the entire site. Once HTTPS works at the server, set Force HTTPS to Entire Site. Then turn on HSTS in the System - HTTP Headers plugin.

3. Enforce MFA. Add Super Users, Administrators, and every group that can see submissions to Enforce Multi-factor Authentication. Set "Onboard new users" (mfaredirectonlogin) to Yes. Set "Multi-factor Authentication after silent login" (mfaonsilent) to Yes, so Remember Me logins also ask for MFA.

4. Keep sessions short and errors quiet. Keep Session Lifetime at 15 minutes or less, and "Shared Sessions" (shared_session) at No. Set "Error Reporting" (error_reporting) to None, with "Debug System" (debug) at No.

5. Log more, and keep the log. Set IP Logging and "Log API Requests" (loggable_api) to Yes. Core creates no log-deletion task. If you add "Task - Delete Action Logs", its "Days to delete action logs after" (logDeletePeriod) defaults to 7. Set your policy's number, and ship a copy to a log store under a BAA.

6. Tighten passwords and registration. Set "Minimum Numbers" (minimum_integers), "Minimum Symbols" (minimum_symbols), and "Minimum Upper Case" (minimum_uppercase) to at least 1. Confirm Send Password is No.

7. Protect secrets and move logs. configuration.php holds the database password and site secret in plain text, so lock its file permissions. Point "Path to Log Folder" (log_path) and "Path to Temp Folder" (tmp_path) outside the web root, never at /tmp.

8. Treat form extensions as PHI stores. In RSForm! Pro, set "Save data to database", "Save IP to database", and "Delete Submissions Older Than" per form. In Convert Forms, keep submissions off the front end.

9. Move backups out of the web root. Point Akeeba Backup's output folder above the site root. Encrypt the archives, and store them only under a BAA.

Item 3 is covered in HIPAA MFA requirements, and our glossary defines multi-factor authentication (MFA). Item 4 is the automatic logoff rule in 45 CFR § 164.312(a)(2)(iii), explained in HIPAA automatic logoff. With all nine in place, the Joomla HIPAA compliant work inside your site is mostly done.

Where Joomla sites leak PHI

On a Joomla HIPAA compliant site, check these six places where patient data can leak.

• Form extensions. RSForm! Pro stores submissions in its own tables, and its emails still go out when storage is off. Convert Forms can publish submissions on a front-end page.

• The core contact form. It stores nothing, but it emails each message. The default Mailer is PHP mail(), with no TLS option.

• Backups in the web root. Akeeba's warning Q203 says the default output folder is "in a well known, browser accessible location."

• Logs and debug output. The default log folder, administrator/logs, is inside the public tree. Debug System prints queries and session data when on.

• Plain-text tables. Session metadata, action logs, and user profiles sit unencrypted in the database and every backup. The Privacy component emails data exports as attachments.

• The /api web services. Eleven 2026 advisories fixed missing access checks in the API. If you do not use it, block /api/ at the server.

Form settings and debug switches are your layer. The log store, backups, and server rules are the host layer of a Joomla HIPAA compliant site, and you can hand that layer off. The mail relay that sends form emails needs a BAA too. Intake form rules are in HIPAA compliant forms. Backups copy every leak above, so see HIPAA backup and disaster recovery.

Who signs the BAA for a Joomla site, and what does it cost?

A Joomla HIPAA compliant budget starts with the host that signs the BAA. Figures are as published on October 20, 2026.

We sell the last row, so weigh it as a disclosure. On AWS, PHI belongs only in HIPAA-eligible services. AWS lists 174 HIPAA eligible services as of its October 15, 2026 update. Our AWS HIPAA eligible services guide shows how to check EC2, S3, and the rest of your stack against AWS's current list. Whichever route you pick, a Joomla HIPAA compliant site still needs every JSST release applied to Joomla itself.

If you would rather not harden the server yourself

Our HIPAA compliant Joomla hosting runs Joomla on single-tenant AWS servers we manage. Every plan includes CloudFront CDN, a web application firewall, and EBS storage with 7-day snapshot retention. It also includes encryption at rest and in transit, six-year audit logging, and tested encrypted backups. You run Joomla core and extension updates, plus your settings, user groups, and content. That split keeps the Joomla HIPAA compliant duties clear. On any host, confirm in writing who applies OS and PHP updates to your server. Each plan is one server in one AWS availability zone, and a multi-zone design is quoted separately.

The BAA is signed within 24 hours of signup, before any patient data moves. It covers the servers and services we run. Any outside service that receives patient data, such as a mail relay or an extension's cloud service, needs its own BAA too. Plans start from $229 per month in six sizes, from Starter to Network. They are monthly, with no long-term contract. The first month comes with 4 hours of migration and configuration included. After that, extra work is $175 an hour, quoted before work starts. Our guide to migrating to HIPAA compliant hosting walks through the switch. We sell this, so weigh it as a disclosure.

Here is the honest inverse. A brochure site with a phone number and no forms holds no PHI and needs none of this. If your team runs on AWS under AWS's BAA, with an engineer who manages the server and ships logs, you do not need us. Weighing a move? Read is WordPress HIPAA compliant first. Drupal is the other common choice, but its core ships no MFA. The Drupal HIPAA compliant guide names the module that adds it and the hosts that sign a BAA.

Our HIPAA compliant hosting plans are public. You can request a quote or tell us what your Joomla site collects.

Frequently asked questions

Is Joomla HIPAA compliant?

Not by itself, and no CMS is. A Joomla HIPAA compliant site needs a host that signs a BAA, core settings changed from their defaults, and a risk analysis. Joomla comes from a nonprofit, Open Source Matters, Inc., and no Joomla vendor signs a BAA.

Does Joomla have multi-factor authentication?

Yes. Joomla core supports authenticator app codes, WebAuthn security keys, YubiKey, email codes, and backup codes. In Joomla 6.2.0, no user group is forced to use it by default. A Joomla HIPAA compliant site adds groups under Enforce Multi-factor Authentication.

Is a Joomla contact form HIPAA compliant?

Not on its own. The core contact form emails each message, so PHI passes through your mail server. RSForm! Pro and similar extensions also store submissions in the database. A Joomla HIPAA compliant form needs a host and mail relay under a BAA.

Does Joomla encrypt data at rest?

No. Joomla core hashes passwords with bcrypt but does not encrypt content, user records, sessions, or logs. On a Joomla HIPAA compliant site, disk and database encryption comes from the host.

Is Joomla 4 still supported?

No. Joomla 4 support ended October 14, 2025. Most 2026 advisories list 4.x as affected, and none ships a 4.x fix. Move to the newest Joomla 6.x release, or to 5.4.x, which gets security fixes until October 12, 2027.

Recap: Joomla HIPAA compliant

A Joomla HIPAA compliant site is Joomla on a host that signs a BAA, with core settings changed. No Joomla vendor signs a BAA; DigitalOcean and AWS do. Enforce MFA, force HTTPS, turn on HSTS and IP logging, and keep Send Password off. Keep backups and logs out of the web root. Joomla 5.x gets security fixes only until October 12, 2027.

This article is general information, not legal advice. The details reflect joomla.org, the Joomla source, and vendor pages as last read on October 20, 2026, and php.net as read on October 22, 2026. Joomla 5.x security support ends October 12, 2027. Confirm current terms with each vendor, consult qualified counsel, and base your safeguards on a documented risk analysis. We sell HIPAA compliant hosting. Reviewed October 2026.

Sources

• Joomla! developer network: Roadmap, Security Centre, and Security Strike Team.

• Joomla.org: The project and Joomla 6.0 and 5.4 release.

• Joomla.org release news: Joomla 5.3.4 release and Joomla 6.1.4 and 5.4.9 release.

• Joomla.org, October 2026: Joomla 6.2 release and Joomla 5.4.10 release.

• Joomla manual: Technical requirements and 5.4 technical requirements.

• Joomla source: Releases, Global Configuration, and Users options.

• Joomla 6.2.0 source: User Actions Log options, fresh-install settings, and Global Configuration written at install.

• PHP, October 21, 2026: Security advisory for CVE-2026-109618 and CVE-2026-109619 and PHP 8.2.35 release.

• Hosts: Joomla Launch, CloudAccess.net pricing, and SiteGround Google Workspace HIPAA.

• Extensions: RSForm! Pro form properties, Convert Forms front-end submissions, and Akeeba Q203.

• DigitalOcean: HIPAA at DigitalOcean, Droplet pricing, and OpenLiteSpeed Joomla 1-Click.

• AWS: HIPAA compliance and HIPAA Eligible Services Reference.

• 45 CFR § 164.308 and § 164.312: ecfr.gov.