Skip to main content

HIPAA Compliant Drupal Hosting

We run Drupal for hospitals, health systems and multi-site practice networks on a single-tenant AWS environment, with the Business Associate Agreement signed within 24 hours on managed tiers. Managed tiers from $299/mo.

See tiers and pricing Request a quote

Why Drupal needs a HIPAA host, not a generic one

Drupal is the CMS of choice for large health organizations because of its content model, multilingual support and role-based permissions. None of that matters if the host will not sign a BAA.

Patient-facing content is regulated content

Symptom checkers, appointment requests, patient education with personalisation and portal logins all put Drupal in the path of protected health information. Under 45 CFR § 164.308(b) the host must sign a BAA before that data arrives.

Shared hosting fails at the contract stage

Most mainstream hosts will not sign a BAA for shared plans at any price. Without that signature, placing patient data on their servers violates the rule no matter how secure the stack is.

Memory-optimised tiers for a database-heavy CMS

Drupal runs on our R-class tiers: r8g instances with 16 GB of RAM at Solo, with CloudFront and a WAF in front of every size, so Views, caching layers and search stay fast under load.

Hardened server infrastructure with encryption and monitoring behind a Drupal site

Every Drupal tier runs on hardened, single-tenant infrastructure with encryption, logging and monitoring configured before handover.

Where our responsibility ends

Stated plainly, because knowing this before an incident is worth more than discovering it during one.

We run

  • The AWS account, VPC and network isolation
  • The operating system, patching and hardening
  • PHP, the web server, the database and TLS
  • CloudFront, the WAF, encryption, audit logging and backups
  • Monitoring and infrastructure incident response

You run

  • Your Drupal codebase, modules and themes
  • Drupal core and contributed-module updates, unless scoped with us
  • Content, users, roles and permissions
  • The systems your site integrates with and the data you send them

If a problem turns out to be the server, the runtime or the infrastructure, open a ticket and we take it. If it is inside Drupal, we tell you what we found and hand it back with recommendations.

Drupal hosting tiers

Five sizes, Solo to Network. Monthly and annual pricing published here; three-year pricing at the store.

Drupal hosting tiers: capacity, included transfer and monthly price
Tier Instance vCPU RAM Storage + backups Transfer Monthly Annual Buy
Solo r8g.large 2 16 GB 100 GB + 100 GB 150 GB $299/mo $3,409/yr Order Solo
Practice r8g.xlarge 4 32 GB 200 GB + 200 GB 300 GB $499/mo $5,689/yr Order Practice
Clinic r8g.2xlarge 8 64 GB 400 GB + 400 GB 600 GB $899/mo $10,249/yr Order Clinic
Group r8g.4xlarge 16 128 GB 600 GB + 600 GB 1,000 GB $1,699/mo $19,369/yr Order Group
Network r8g.8xlarge 32 256 GB 800 GB + 800 GB 1,500 GB $3,299/mo $37,609/yr Order Network

Managed tiers from $299/mo. Every tier is single-tenant AWS on ARM (Graviton) instances with snapshot retention, encryption and audit logging. Three-year pricing is available at the Drupal store page.

What every Drupal tier includes

The same compliance baseline at Solo and at Network. Capacity is the only thing that changes.

  • Single-tenant AWS environment
  • CloudFront CDN in front of every tier
  • Web application firewall
  • EBS storage with 7-day snapshot retention
  • Encryption at rest and in transit
  • Six-year audit logging
  • Tested, encrypted backups
  • Migration included
  • BAA signed within 24 hours of signup
  • 24/7 team, monitoring and infrastructure incident response

HIPAA hosting vs standard hosting

A $10 shared plan is not slightly less compliant; it is categorically different. Most mainstream hosts will not sign a BAA for shared hosting at any price.

Signed BAA before any PHI arrives
Standard Hosting
Not included
HIPAA Compliant
Included
Single-tenant isolation
Standard Hosting
Not included
HIPAA Compliant
Included
Encryption on by default, at rest and in transit
Standard Hosting
Not included
HIPAA Compliant
Included
Audit logs centralized and kept six years
Standard Hosting
Not included
HIPAA Compliant
Included
Encrypted backups with tested restores
Standard Hosting
Not included
HIPAA Compliant
Included
Written responsibility split
Standard Hosting
Not included
HIPAA Compliant
Included

HIPAA Drupal hosting FAQ

Is Drupal HIPAA compliant?
Drupal itself is neither compliant nor non-compliant; software is neutral and the stack it runs on decides. A Drupal site becomes part of a compliant system when the host signs a Business Associate Agreement (45 CFR § 164.308(b)) and the environment carries the Security Rule safeguards: encryption, access controls, audit logging and tested backups. Drupal's granular permissions and audit modules help with the application half; our tiers supply the infrastructure half.
Do you sign a BAA for Drupal hosting?
Yes, on every managed tier, within 24 hours of signup and always before any patient data moves to us. Coverage begins at signature, not at migration.
Can you migrate our existing Drupal site?
Yes. Migration is included on every managed tier. We build the new environment in parallel, move your Drupal site over encrypted channels while your current site stays live, verify it, then cut over, usually with no visible downtime.
Why do these tiers start at $299 instead of $249?
Drupal runs on the R-class tiers: memory-optimised r8g instances with 16 GB of RAM at Solo, twice the M-class baseline, because database-heavy workloads perform and scale better with the headroom. M-class platforms such as WordPress and Joomla start at $249.
Which tier do we need?
Solo suits a single practice or department site. Practice adds capacity for multi-site installs, heavier Views and search workloads. Clinic, Group and Network scale to multi-site networks and higher traffic; if you are unsure, tell us what the site does and we will size it with you.

Guides that go with this page

The contract, the hosting layer, and the cloud underneath it.

Running Drupal for a health organization?

Tell us what the site does and how many sites you run, and we will tell you which tier fits.

Request a Quote Contact Us