Blog

Is n8n HIPAA Compliant? n8n Cloud, Self-Hosting, and Where Execution Data Goes (2026)

n8n Cloud does not sign a Business Associate Agreement, and by default n8n saves the full input and output of every workflow run for 14 days. This guide shows where patient data lands inside n8n, the environment variables that control each spot, the 2026 Critical flaws, and who can sign the BAA. Verified September 28, 2026.

Joseph Abear · Sep 27, 2026

Is Payload CMS HIPAA Compliant? Payload Cloud, Figma, and the Self-Hosted Path (2026)

Payload Cloud is paused for new projects since Figma bought Payload, and no Payload page offers a Business Associate Agreement. Self-hosted Payload 3 is a strong base for patient portals and intake forms, but audit logs and SSO are Enterprise features and field encryption is a hook you write. Verified September 14, 2026.

Joseph Abear · Sep 18, 2026

Is Ghost CMS HIPAA Compliant? Ghost(Pro), Mailgun, and the Self-Hosted Path (2026)

Ghost(Pro) offers no Business Associate Agreement and runs its servers in Amsterdam, so it cannot hold patient data. Self-hosted Ghost 6 can sit inside a compliant system, but only with a host that signs, a Mailgun BAA for newsletters, and no PHI in email bodies. Here is the full picture, verified September 14, 2026.

Joseph Abear · Sep 17, 2026

Is Strapi HIPAA Compliant? Strapi Cloud, Enterprise Audit Logs, and Self-Hosting (2026)

Strapi, Inc. holds a SOC 2 Type 2 report, but no Strapi page offers a Business Associate Agreement. This guide shows what Strapi 5 gives you for the HIPAA Security Rule, which controls need the Enterprise plan, what Strapi Cloud and self-hosting cost, and the settings to change first. Verified September 14, 2026.

Joseph Abear · Sep 15, 2026

The HIPAA Business Associate Agreement (BAA), Explained for 2026

The BAA is the most misunderstood document in healthcare IT. It never makes you compliant by itself, its required contents are set by law at 45 CFR § 164.504(e), and operating without one is a violation before any breach happens. The full contract checklist, who signs, who refuses, and how to get one signed in 24 hours instead of an enterprise sales cycle.

Joseph Abear · Aug 12, 2026

Is WP Engine HIPAA Compliant? The BAA Answer for 2026

Practices love WP Engine, so is WP Engine HIPAA compliant? No. Its published terms offer no Business Associate Agreement, and without a BAA no patient data can lawfully live there. Here is what its terms say, when WP Engine is still fine to use, and the two setups that work.

Joseph Abear · Jul 20, 2026

HIPAA Compliant Hosting for Medical Billing and RCM Companies in 2026

If your company processes claims for healthcare providers, you are a Business Associate handling large volumes of ePHI. HIPAA compliant hosting for medical billing means a full BAA chain, encryption, audit logging, and tested backups. Here is what billing and RCM companies need in 2026.

Joseph Abear · Jun 30, 2026

HIPAA Compliant Hosting for Healthcare SaaS and Healthtech Companies in 2026

If your software touches patient data for provider customers, you are a Business Associate with direct HIPAA liability. HIPAA compliant hosting for healthcare SaaS means a full BAA chain, HIPAA-eligible cloud, tenant isolation, and the attestations your buyers will ask for. Here is what 2026 requires.

Joseph Abear · Jun 29, 2026

Is Bluehost HIPAA Compliant? What Healthcare Sites Need to Know in 2026

Bluehost is not HIPAA compliant. It signs no Business Associate Agreement, and its own policy forbids storing protected health information, with account termination as the penalty. Here is what that means for a healthcare website and what to use instead.

Joseph Abear · Jun 18, 2026

Is GoDaddy HIPAA Compliant? What the BAA Does and Doesn't Cover in 2026

GoDaddy is not HIPAA compliant for website hosting. It will sign a Business Associate Agreement for one product, its Microsoft 365 email, but not for shared, WordPress, or VPS hosting. Here is what that means if your site collects patient data, and what to do instead.

Joseph Abear · Jun 16, 2026

Is AWS HIPAA Compliant? What the BAA Covers in 2026

AWS is HIPAA eligible, not HIPAA compliant on its own. Amazon signs a Business Associate Addendum and offers 200+ eligible services, but you configure encryption, access control, and logging. Here is what the BAA covers and what stays your responsibility.

Joseph Abear · Jun 8, 2026

HIPAA Compliance for Marketing Agencies: When You Become a Business Associate

A marketing agency that creates, receives, maintains, or transmits PHI for a healthcare client is a business associate under 45 CFR § 160.103 and is directly liable under HIPAA. Here is when that line gets crossed and what a compliant agency stack looks like.

Joseph Abear · Jun 3, 2026