Blog

HIPAA Backup and Disaster Recovery: What Healthcare Websites Need in 2026

Most healthcare backup failures are not a missing backup button. They are the gaps around it: an untested restore, a vendor with no BAA, or a recovery key nobody can find. What a HIPAA backup and disaster recovery plan actually needs, the five questions it must answer, and the test that proves it works.

Joseph Abear · Aug 12, 2026

HIPAA Dedicated Server: Do You Need One? The 2026 Answer

HIPAA never requires a dedicated server. What the metal buys is isolation: no neighbors, clean audit scope, steady speed. When that is worth paying for, when single-tenant cloud delivers the same walls with less upkeep, and the honest 2026 options list, shared-hosting traps included.

Joseph Abear · Aug 10, 2026

HIPAA Compliant Patient Portal on WordPress: The 2026 Build Guide

No plugin makes a patient portal HIPAA compliant. The architecture does: BAA-covered hosting, encryption, unique logins with MFA, automatic logoff, and six-year audit logs. The three ways to get a portal, the WordPress build done right, and the four traps that catch most projects.

Joseph Abear · Aug 6, 2026

The Best HIPAA Compliant Email Providers in 2026, Compared

Most rankings of HIPAA compliant email are written by the vendors selling it. This one uses two tests instead: who signs the BAA, and whose encryption works without anyone remembering it. Paubox, Hushmail, Gmail, and Outlook compared honestly, catches included. Verified August 2026.

Joseph Abear · Aug 5, 2026

HIPAA Compliant Telehealth Platforms: The 2026 Comparison

Doxy.me includes a BAA on every plan, even free. SimplePractice bundles it into a practice system. Zoom, Meet, and Teams qualify on the right paid plans. A dated BAA and price table, plus the half of telehealth no platform covers: your booking, intake, and website. Verified October 20, 2026.

Joseph Abear · Aug 3, 2026

Client-Level Isolation: Why Healthcare Hosting Cannot Treat Every Customer Like a Tenant

Most hosting puts many customers on shared systems and calls logical walls enough. Healthcare workloads carry a different risk: blast radius. What client-level isolation actually covers, why HIPAA does not require a dedicated server, and the eight questions that show whether a provider has real walls or a brochure.

Joseph Abear · Aug 2, 2026

Is WordPress HIPAA Compliant? The Real 2026 Answer

WordPress the software can run a fully HIPAA compliant site. WordPress.com the service offers no BAA at any price, and neither does WordPress VIP. The whole question collapses into where the site is hosted. The .org vs .com split, the verdict table, and the setup, verified September 2026.

Joseph Abear · Jul 31, 2026

Microsoft 365 HIPAA Compliance: The BAA and Setup for 2026

Microsoft folds its BAA into the standard terms of paid Microsoft 365 business plans, with one sign-up exception. No signing step, no add-on fee. The real work is knowing which apps are covered and what Copilot can and cannot touch. Then come the gaps the BAA leaves and the settings that make it real. Checked against Microsoft's own pages on October 20, 2026.

Joseph Abear · Jul 30, 2026

HIPAA Compliant Texting: Rules, Consent, and Apps (2026)

Practices text patients every day, lawfully. HIPAA compliant texting runs in three lanes: lean reminders, plain SMS a patient chose after a warning, and secure apps with a BAA for clinical content. Here are the HHS, TCPA and CMS rules, the consent steps, and the apps, checked October 20, 2026.

Joseph Abear · Jul 29, 2026

HIPAA Compliant Video Recording: Consent, Storage, Rules

The platform's BAA covered the live call. The recording is a new object with its own rules. HIPAA compliant video recording takes three steps: the right consent stack before you press record, BAA-covered storage for the file, and a retention schedule that matches state law. Here is the full map, verified July 2026.

Joseph Abear · Jul 28, 2026

HIPAA Compliant WordPress Forms: Plugins and Setup (2026)

Most guides say WordPress form plugins are not HIPAA compliant because they sign no BAA. The truth is sharper: self-hosted plugins never see your data, so your host signs the BAA, not the plugin. Here is how HIPAA compliant WordPress forms actually work, the Gravity Forms and Contact Form 7 verdicts, and the setup checklist.

Joseph Abear · Jul 27, 2026

HIPAA Compliant Email: Gmail, Outlook, and the BAA (2026)

Every guide ranking for HIPAA compliant email sells an email product. We do not, so here is the straight answer: the suite you already pay for can often qualify. When Gmail and Outlook carry PHI lawfully, when a dedicated vendor earns its fee, and the patient opt-out right the encryption vendors rarely mention.

Joseph Abear · Jul 24, 2026