Skip to main content

HIPAA Compliant ExpressionEngine Hosting

We run ExpressionEngine for practices, hospitals and healthcare publishers on a single-tenant AWS environment, with the Business Associate Agreement signed within 24 hours on managed tiers. Managed tiers from $249/mo.

See tiers and pricing Request a quote

Why ExpressionEngine needs a HIPAA host, not a generic one

ExpressionEngine's channel model and member system have run healthcare sites for years. The host underneath decides whether those sites can lawfully hold patient data.

Member channels and forms carry PHI

Member registration, appointment forms and any channel that stores health details make an ExpressionEngine site a system that stores or transmits protected health information.

A BAA before anything else

Under 45 CFR § 164.308(b) the host must be a business associate under a signed agreement. We sign it within 24 hours of signup and before migration begins.

The compliance baseline, configured for you

Single-tenant AWS, encryption at rest and in transit, six-year audit logging, CloudFront and a WAF are set up before handover, not left as an exercise.

Hardened server infrastructure with encryption and monitoring behind an ExpressionEngine site

Every ExpressionEngine tier runs on hardened, single-tenant infrastructure with encryption, logging and monitoring configured before handover.

Where our responsibility ends

Stated plainly, because knowing this before an incident is worth more than discovering it during one.

We run

  • The AWS account, VPC and network isolation
  • The operating system, patching and hardening
  • PHP, the web server, the database and TLS
  • CloudFront, the WAF, encryption, audit logging and backups
  • Monitoring and infrastructure incident response

You run

  • Your ExpressionEngine site, templates and add-ons
  • ExpressionEngine and add-on updates, unless scoped with us
  • Content, members, member groups and permissions
  • The systems your site integrates with and the data you send them

If a problem turns out to be the server, the runtime or the infrastructure, open a ticket and we take it. If it is inside ExpressionEngine, we tell you what we found and hand it back with recommendations.

ExpressionEngine hosting tiers

Five sizes, Solo to Network. Monthly and annual pricing published here; three-year pricing at the store.

ExpressionEngine hosting tiers: capacity, included transfer and monthly price
Tier Instance vCPU RAM Storage + backups Transfer Monthly Annual Buy
Solo m8g.large 2 8 GB 100 GB + 100 GB 150 GB $249/mo $2,839/yr Order Solo
Practice m8g.xlarge 4 16 GB 200 GB + 200 GB 300 GB $399/mo $4,549/yr Order Practice
Clinic m8g.2xlarge 8 32 GB 400 GB + 400 GB 600 GB $749/mo $8,539/yr Order Clinic
Group m8g.4xlarge 16 64 GB 600 GB + 600 GB 1,000 GB $1,399/mo $15,949/yr Order Group
Network m8g.8xlarge 32 128 GB 800 GB + 800 GB 1,500 GB $2,699/mo $30,769/yr Order Network

Managed tiers from $249/mo. Every tier is single-tenant AWS on ARM (Graviton) instances with snapshot retention, encryption and audit logging. Three-year pricing is available at the ExpressionEngine store page.

What every ExpressionEngine tier includes

The same compliance baseline at Solo and at Network. Capacity is the only thing that changes.

  • Single-tenant AWS environment
  • CloudFront CDN in front of every tier
  • Web application firewall
  • EBS storage with 7-day snapshot retention
  • Encryption at rest and in transit
  • Six-year audit logging
  • Tested, encrypted backups
  • Migration included
  • BAA signed within 24 hours of signup
  • 24/7 team, monitoring and infrastructure incident response

HIPAA hosting vs standard hosting

A $10 shared plan is not slightly less compliant; it is categorically different. Most mainstream hosts will not sign a BAA for shared hosting at any price.

Signed BAA before any PHI arrives
Standard Hosting
Not included
HIPAA Compliant
Included
Single-tenant isolation
Standard Hosting
Not included
HIPAA Compliant
Included
Encryption on by default, at rest and in transit
Standard Hosting
Not included
HIPAA Compliant
Included
Audit logs centralized and kept six years
Standard Hosting
Not included
HIPAA Compliant
Included
Encrypted backups with tested restores
Standard Hosting
Not included
HIPAA Compliant
Included
Written responsibility split
Standard Hosting
Not included
HIPAA Compliant
Included

HIPAA ExpressionEngine hosting FAQ

Is ExpressionEngine HIPAA compliant?
ExpressionEngine itself is neither compliant nor non-compliant; software is neutral and the stack it runs on decides. A ExpressionEngine site becomes part of a compliant system when the host signs a Business Associate Agreement (45 CFR § 164.308(b)) and the environment carries the Security Rule safeguards: encryption, access controls, audit logging and tested backups. ExpressionEngine's member groups and template permissions handle the application half; our tiers supply the infrastructure half.
Do you sign a BAA for ExpressionEngine hosting?
Yes, on every managed tier, within 24 hours of signup and always before any patient data moves to us. Coverage begins at signature, not at migration.
Can you migrate our existing ExpressionEngine site?
Yes. Migration is included on every managed tier. We build the new environment in parallel, move your ExpressionEngine site over encrypted channels while your current site stays live, verify it, then cut over, usually with no visible downtime.
Which tier do we need?
Solo suits a single practice or publisher site. Practice adds capacity for multiple sites or higher traffic. Clinic, Group and Network scale to multi-site networks and higher traffic; if you are unsure, tell us what the site does and we will size it with you.

Guides that go with this page

The contract, the hosting layer, and the cloud underneath it.

Running ExpressionEngine for a healthcare site?

Tell us what the site does and we will tell you which tier fits.

Request a Quote Contact Us