Managed vs Self-Managed HIPAA Hosting: Which One Fits Your Practice in 2026

Last updated: October 20, 2026

Managed vs self-managed HIPAA hosting is a question about who runs the safeguards, not about whether they exist. Both can be compliant. Regular hosting cannot, because no Business Associate Agreement (BAA) exists. The right choice comes down to one question: who will do the server's safeguard work every week, your team or your host? That is the whole managed vs self-managed HIPAA hosting decision in one sentence. This guide compares the three options honestly: regular hosting, self-managed HIPAA hosting, and managed HIPAA hosting. It shows what each one leaves on your desk, what listed prices looked like in October 2026, and a five-question test that tells you which fits. We sell managed HIPAA hosting, so the disclosure is up front and the tradeoffs are stated plainly.

TL;DR: Quick answer

• Regular hosting fails the HIPAA test on contract alone: no BAA, so patient data cannot live there (45 CFR § 164.308(b)). Price is irrelevant.

• Self-managed HIPAA hosting gives you a compliant server and a BAA; you run updates, hardening, logs, and backups. There is no single list price: you pay for the server and supply the staff hours.

• Managed HIPAA hosting hands the server safeguards to the host: encryption, firewall, audit logs, and tested backups. Listed managed entry prices at four HIPAA hosting providers, us included, ran from $120 to $605.11 a month when checked on October 20, 2026.

• In managed vs self-managed HIPAA hosting, the deciding factor is ownership. If nobody on staff can patch a server and test a restore this month, self-managed is a risk you cannot staff.

• Either way, the BAA and the Security Rule safeguards are non-negotiable. The tier only decides who does the work.

• Our managed plans start at $229 a month, billed monthly with no long-term contract. Each includes a BAA signed within 24 hours of signup, before patient data moves.

The three options, defined

Start with precise definitions, because vendors blur them and the managed vs self-managed HIPAA hosting question gets lost in the blur. Regular hosting is ordinary shared, VPS, or managed WordPress hosting from a mainstream provider. It may be fast and secure. It signs no BAA, so under 45 CFR § 164.308(b) it cannot hold protected health information (PHI). Self-managed HIPAA hosting is a server from a provider that signs the BAA and pre-configures the compliant base: encryption, isolation, firewall. You administer it: updates, plugins, users, logs, backup tests. The most hands-on version is a cloud account. On Amazon Web Services (AWS), you accept the AWS BAA in AWS Artifact, then configure each service to meet HIPAA yourself. Managed HIPAA hosting is the same compliant base with the provider running the server safeguards for you: encryption, firewall, audit logs, and tested backups. What else "managed" covers, such as updates or migration hours, varies by host, so get it in writing. The host is your business associate either way. The difference is how much of the Security Rule's day-to-day work sits on your side of the shared responsibility model. If you are coming from an ordinary host, see how HIPAA hosting compares to regular hosting.

The managed vs self-managed HIPAA hosting comparison, side by side

Read the middle rows twice. Managed vs self-managed HIPAA hosting is decided there, not in the price row. Every "you" in the self-managed column is a recurring task with a name attached, and under the Security Rule those tasks are not optional. Automatic logoff, audit controls, and tested backups are named safeguards (45 CFR § 164.312(a)(2)(iii), § 164.312(b), § 164.308(a)(7)). On a self-managed plan, you are the one who has to keep them true.

Two notes on the managed column. First, the duty to review logs stays with you on either tier, even if a host helps. The Security Rule requires you to have procedures to "regularly review records of information system activity, such as audit logs" (45 CFR § 164.308(a)(1)(ii)(D)). Our guide to HIPAA audit logs covers who reviews them and how often. Second, "managed" means different things at different hosts. Before you sign, get in writing who applies updates, who keeps the logs, and who tests restores.

Why regular hosting is out, whatever it costs

It is tempting to read the price row and stop. Do not. A $10 plan with no BAA is not a cheaper way to be compliant. It is a violation on contract grounds before any breach happens. Most mainstream hosts refuse the BAA outright, and a few cover a side product only, as our verdicts on GoDaddy and WP Engine show. The contract itself is explained in our HIPAA business associate agreement guide.

The one legitimate use of regular hosting in healthcare is the split-site build. Marketing pages sit on ordinary hosting, and every PHI path runs on a covered environment, with no health questions on the ordinary side. That option is laid out in our HIPAA compliant website guide.

When self-managed is the right call

In the managed vs self-managed HIPAA hosting choice, self-managed is a real, good option for the right team. It fits when you already have a WordPress developer or a systems administrator who will own the server. It also fits when you want full control of the stack, or when the price gap matters more than the hours. The honest requirements come down to four jobs. Someone applies updates within days of release. Someone reviews logs on a schedule. Someone runs a restore test and writes down the result. Someone shortens the default 48-hour WordPress login session to something defensible. If those four jobs have names next to them, self-managed works. The server-side requirements you are taking on are itemized in our guide to a HIPAA compliant server. On a self-managed plan you also move the site yourself, so follow our step-by-step guide on how to migrate to HIPAA compliant hosting.

When managed is the right call

On the other side of the managed vs self-managed HIPAA hosting line, managed fits when those four jobs have no names next to them. Many small practices fit that description. The office manager is not a sysadmin. The web designer built the site and moved on. The IT company that "handles the website" has never read the Security Rule. Compliance work that nobody owns does not get done, and the HHS Office for Civil Rights (OCR) still expects it. OCR announced its 14th Risk Analysis Initiative action on June 18, 2026. It cited a potential failure to conduct an "accurate and thorough" risk analysis (45 CFR § 164.308(a)(1)(ii)(A)). A managed host cannot write that analysis for you, but it can take the server safeguards off your list.

Managed also fits practices that dread the move itself. Ask any managed host how many migration hours its plan includes, and what each extra hour costs. Our terms are in the price section below. What a managed plan actually includes, line by line, is in managed HIPAA hosting.

The five-question test

Answer these honestly and the managed vs self-managed HIPAA hosting decision makes itself.

1. Who applies security updates, and within how many days? No name or no number rules out self-managed.

2. When did someone last restore a backup and check it worked? Never, or not sure, means managed.

3. Who keeps the audit logs, and for how long? No answer means managed. Reviewing them stays your duty either way.

4. Who will move the site to the new server, and has that person done it before? If not, managed.

5. Does your budget value the price gap more than the staff hours self-managed takes every month? If yes, and you answered the first four with names, self-managed.

Four names and a yes on question five: self-managed is right for you. Anything else: managed is the cheaper decision once you price the hours and the risk. If managed is your answer, our comparison of Atlantic.Net alternatives shows how the HIPAA hosting providers differ. For the full field, see our ranking of the best managed HIPAA hosts.

What the price gap actually buys

Listed managed entry prices at four HIPAA hosting providers, us included, ran from $120 to $605.11 a month when checked on October 20, 2026. HIPAA Vault lists managed WordPress from $120 a month ($99 a month billed yearly). Atlantic.Net's HIPAA Developer Linux server lists $605.11 a month, priced on a 12-month term, plus a one-time $150 firewall setup fee. Liquid Web says its HIPAA dedicated servers are billed monthly from $229 a month for Linux. Our managed plans start at $229 a month, billed monthly with no long-term contract.

Self-managed has no single list price. You pay for the server, then supply the labor yourself. In managed vs self-managed HIPAA hosting terms, the gap buys that labor: the host runs the server safeguards instead of your staff. Migration terms differ, too. HIPAA Vault includes migration at no extra fee only with its WordPress Starter plans. Atlantic.Net's migration is free for up to four hours on its HIPAA Business and HIPAA Enterprise plans, then $160 an hour (checked October 20, 2026). Our first month includes 4 hours of migration and configuration, then $175 an hour, quoted before work starts. That hourly rate is higher than Atlantic.Net's.

Then price the downside. HIPAA civil money penalties now run from $145 to $2,190,294 per violation, under the inflation-adjusted table in 45 CFR § 102.3 (last amended January 28, 2026). Our 2026 HIPAA hosting cost guide has the full market math. Our guide to affordable HIPAA hosting covers the lowest-cost hosts that still sign a BAA.

The pain point, and both answers

Here is the honest version. Many practices are not choosing between managed and self-managed. They are stuck on regular hosting, collecting patient data, and afraid the move will be expensive, disruptive, or both. That fear can keep a practice non-compliant for years. We sell managed HIPAA hosting, so weigh what follows as a disclosure. Our current plans start at $229 a month on single-tenant AWS, billed monthly with no long-term contract. We sign the BAA within 24 hours of signup, before patient data moves. Your first month includes 4 hours of migration and configuration; after that, it is $175 an hour, quoted before work starts.

Every plan includes CloudFront CDN, a web application firewall, encryption at rest and in transit, six-year audit logging, and tested encrypted backups. Our BAA covers the servers and services we run. HIPAA Compliant Hosting does not hold SOC 2 or HITRUST certification. The tier is the one managed vs self-managed HIPAA hosting decision this guide is about. If your site holds no patient data, neither tier fits, and regular hosting is fine.

Send us your five answers and ask which tier fits. If managed is the answer, request a quote for your site.

Frequently asked questions

What is the difference between managed and self-managed HIPAA hosting?

In managed vs self-managed HIPAA hosting, both provide a BAA and a compliant base. Self-managed means you administer the server: updates, logs, backups, users. Managed means the host runs the server safeguards for you; migration help varies by host and plan. The safeguards are the same; the owner of the work is different.

Is self-managed HIPAA hosting compliant?

Yes, when the provider signs a BAA and you actually perform the safeguards: patching, logging, backup testing, access control. It is compliant infrastructure that depends on your operations. Skip the operations and it is a compliant server running a non-compliant site.

Can regular hosting ever be HIPAA compliant?

Not for patient data. Without a BAA, the arrangement fails 45 CFR § 164.308(b) regardless of security features. Regular hosting is fine for a marketing site with no PHI, which is the split-site build.

How much more does managed HIPAA hosting cost?

Listed managed entry prices at four HIPAA hosting providers, us included, ran from $120 to $605.11 a month when checked on October 20, 2026. Ours start at $229. Self-managed has no single list price: you pay for the server and supply the staff hours. The gap pays the host to run the server safeguards your team would otherwise run.

Which tier do most small practices choose?

We know of no public count, so let the five questions decide. A practice without a server administrator on staff will usually land on managed. Self-managed is the better fit for practices with a WordPress developer or IT team that will own the operations in writing.

Who reviews the audit logs on managed HIPAA hosting?

Your practice stays responsible for log review, on either side of the managed vs self-managed HIPAA hosting choice. A managed host can keep the logs, and our plans include six-year audit logging. The Security Rule still requires you to have procedures to "regularly review records of information system activity" (45 CFR § 164.308(a)(1)(ii)(D)). Write down who reads which logs, and how often.

Does managed HIPAA hosting include migration?

Migration terms are a real cost line in any managed vs self-managed HIPAA hosting comparison. They depend on the host and plan. As listed October 20, 2026, HIPAA Vault includes migration at no extra fee only with its WordPress Starter plans. Atlantic.Net's migration is free for up to four hours on its HIPAA Business and HIPAA Enterprise plans. Ours includes 4 hours of migration and configuration in the first month, then $175 an hour, quoted before work starts.

Recap: managed vs self-managed HIPAA hosting

To recap, managed vs self-managed HIPAA hosting is a question of who runs the safeguards. Regular hosting is out for patient data because no BAA exists. Self-managed gives you the compliant base and hands you the operations, at the server's cost plus your staff hours. Managed runs the server safeguards for you. Listed entry prices ran from $120 to $605.11 a month on October 20, 2026, and ours start at $229. Ask the five questions. If every answer has a name, go self-managed. If any answer is a shrug, managed is the cheaper decision.

This article is general information, not legal advice. Vendor prices are as listed on each vendor's own page on October 20, 2026, and can change. Regulatory citations refer to the HIPAA Security Rule (45 CFR Part 164) and the penalty table in 45 CFR Part 102. We sell managed HIPAA hosting. Confirm your obligations with qualified counsel and base your safeguards on a written risk analysis. Reviewed October 2026.

Sources

• 45 CFR § 164.308 (administrative safeguards, BAA requirement, contingency plan): ecfr.gov

• 45 CFR § 164.312 (technical safeguards, incl. automatic logoff and audit controls): ecfr.gov

• HHS: Guidance on HIPAA and Cloud Computing

• HHS: The HIPAA Security Rule

• 45 CFR § 102.3 (inflation-adjusted HIPAA civil money penalties, last amended January 28, 2026): law.cornell.edu

• HHS OCR: Spencer Gifts health plans settlement, 14th Risk Analysis Initiative action (June 18, 2026)

• AWS: HIPAA compliance FAQ (BAA accepted in AWS Artifact)

• Vendor prices, checked October 20, 2026: HIPAA Vault Managed WordPress, Atlantic.Net HIPAA hosting and Liquid Web HIPAA hosting

• WordPress developer reference: wp_set_auth_cookie() (default login cookie lengths)