Practice website hosting and HIPAA: BAA questions

Search for website hosting for a medical practice and you will find many offers of “HIPAA compliant hosting” and “HIPAA compliant website builders”. Some practices need hosting that is set up for patient information. Many do not, because their public website never handles it. The difference depends on what your site collects and where that information goes, not on the label.

This guide explains what HHS says about cloud and hosting providers, when a host or website builder becomes your business associate, which Security Rule safeguards to ask about, and how to design a site so that most of it does not touch patient information at all. If you are moving to a new host or a new domain, our guide to changing your website domain or host covers redirects, Search Console and closing the old host.

This is general information, not legal advice. HHS guidance and the HIPAA rules cited were checked on October 27, 2026. HHS’s Office for Civil Rights says it does not endorse, certify or recommend specific technology or products, so no host or builder is HIPAA compliant by itself; compliance depends on the agreement, the setup and how your practice uses it. We do not recommend vendors.

Start with what your website actually does

Most practice websites have two parts, even if they look like one:

The public site: pages about services, team, location, insurance and hours. It shows information to visitors and collects nothing about their health.
Anything that takes information in: contact and appointment forms, online booking, intake forms, payment pages, a patient portal, live chat or an AI chat window, and tracking tools that record what visitors do.

A host that only serves the public pages generally does not create, receive, maintain or transmit protected health information for you. The second group is where patient information enters, and it often runs on a different provider from the host: a form service, a booking system, a portal vendor or an analytics company. Make a list of every tool on the site that takes information in, and who runs it. That list, not the hosting plan, is what this guide is about.

When a host becomes a business associate

HHS’s guidance on HIPAA and cloud computing says that when a covered entity engages a cloud service provider to create, receive, maintain or transmit electronic protected health information on its behalf, such as to process or store it, the provider is a business associate. That includes web hosts and website builders that store form submissions, booking details or portal data.

Two points from the same guidance surprise many practices:

Encryption does not change the status. HHS says a provider that stores only encrypted information and has no decryption key is still a business associate, because it receives and maintains the information.
No agreement is itself a violation. HHS says that using a cloud provider to maintain electronic protected health information without a business associate agreement violates the HIPAA Rules, citing 45 CFR 164.308(b)(1) and 164.502(e).

By contrast, HHS explains that a mere conduit, which only transports information and does not store it beyond what transmission requires, is not a business associate. A host or builder that keeps form entries in a database or dashboard is storing them. Our guide to practice email and fax under HIPAA covers the conduit question for email.

Website builders and form plugins

All-in-one website builders often store every form submission in their own dashboard and email a copy to you. If those forms collect health information, the builder is maintaining it, and you need a business associate agreement with the builder or a different way to collect the information. Some builders offer agreements on certain plans; many do not. Ask in writing, and check that the agreement covers the specific features you use.

Self-hosted sites raise the same question in a different place. A form plugin may save entries in the site database on your host, send them through an email service, and store files in another cloud service. Each one that stores the information is a candidate business associate. Our guide to website contact and appointment forms under HIPAA goes through the options, including not collecting health details in the first place.

Security Rule safeguards to ask about

If a host or builder will hold patient information, your practice’s own risk analysis under the Security Rule decides what is reasonable. The rule requires a risk analysis (45 CFR 164.308(a)(1)(ii)(A)) and a contingency plan with a data backup plan (45 CFR 164.308(a)(7)). The technical safeguards in 45 CFR 164.312 cover access control, audit controls, integrity, authentication and transmission security. Questions to ask a provider:

Will you sign a business associate agreement, and which of your services and plans does it cover?
Which subcontractors store or process our data, and do they have agreements with you?
How is access to our data and the admin area controlled, and is multi-factor sign-in available?
What is logged, and can we see who accessed or exported data?
Is data encrypted in transit and at rest?
How are backups made, how often, and how fast can you restore them?
How do we get all of our data back if we leave, and how is it deleted?

HHS’s cloud guidance notes that service level agreements often address system availability, backup and data recovery, how data is returned when the service ends, security responsibility, and limits on use, retention and disclosure, and that those terms should be consistent with the business associate agreement and not prevent you from accessing your data.

Servers outside the United States

HHS’s cloud guidance says the HIPAA Rules allow a provider to store electronic protected health information on servers outside the United States, provided there is a business associate agreement and the other HIPAA requirements are met. It also notes that storing data abroad can carry different risks, which belong in your risk analysis.

Tracking tools on the public site

A public site can still send information about visitors to third parties through analytics and advertising tags, especially on booking and form pages. HHS has published guidance on online tracking technologies, and a federal court ruling in 2024 affected part of it. Our guide to tracking pixels on practice websites explains where that guidance stands and which pages to be careful with.

Basic security for every practice site

Even a site with no patient information needs to be secure, because a hacked practice site can mislead patients and damage trust. Whatever the plan:

HTTPS on every page, with a valid certificate.
Software, themes and plugins kept up to date, with unused ones removed.
Individual admin accounts with strong passwords and multi-factor sign-in, removed when people leave.
Regular backups that you have tested restoring.
A named person responsible for the site, and a note of who to call if it goes down.

If a security incident does expose patient information, our guide to the HIPAA breach notification letter covers what counts as a breach, the 60 day limit and what the letter to patients must include.

A change to watch

On December 27, 2024, HHS issued a proposed rule to modify the HIPAA Security Rule to strengthen cybersecurity protections. When we checked on October 27, 2026, HHS’s page still described it as a proposed rule. If it is finalized, the safeguards expected of practices and their business associates may change. Check HHS’s Security Rule pages for its current status.

How we approach it

We build practice websites so that the public site handles no patient information, and anything that takes information in is a deliberate choice: a form that asks only for contact details, or a dedicated tool chosen by the practice, with an agreement in place where one is needed. See our practice website design service. We do not sell hosting as HIPAA compliant, and we do not tell practices that any product is.

Frequently asked questions

Does a medical practice website need HIPAA compliant hosting?

Only the parts that create, receive, maintain or transmit patient information need a provider that will sign a business associate agreement. A public site that collects no health information generally does not. OCR does not certify products, so no host is compliant by itself.

Is a website builder a business associate?

If it stores health information you collect through its forms, booking or other features, HHS’s cloud computing guidance says it is a business associate, even if the data is encrypted. You need an agreement with it or a different way to collect that information.

Is encrypted hosting enough?

No. HHS says a provider that stores encrypted health information without the key is still a business associate, and that encryption alone does not protect integrity and availability. You still need an agreement and the other Security Rule safeguards.

Can patient data be hosted outside the United States?

HHS says the HIPAA Rules allow it if there is a business associate agreement and the other requirements are met. Consider the added risks in your risk analysis.

What should we ask a hosting provider?

Whether they will sign a business associate agreement and what it covers, which subcontractors handle data, how access is controlled and logged, how data is encrypted and backed up, and how you get your data back if you leave.

Do website contact forms count as patient information?

They can. A message describing symptoms or a condition from someone seeking care is health information. Our guide to website forms under HIPAA explains when, and how to avoid collecting it.

Sources

More in Practice websites, privacy and tracking

Practice website hosting and HIPAA: when your host needs a business associate agreement