Choose a managed HIPAA host if the practice lacks a security team. Choose a major cloud if staff will own shared responsibilities.
Comparative quick
This section gives an at-a-glance decision matrix for procurement comparisons. Each row maps provider type to the controls and predictable costs that matter for clinics.
| Provider |
Type |
Signs BAA |
US Regions |
Key controls |
Typical monthly cost (small/med/large) |
Notes on egress |
| ClearDATA |
Managed HIPAA host |
Yes |
US East/West |
KMS, SIEM, managed backups |
$900 / $3,000 / $12,000+ |
Included in managed plans; verify limits |
| AWS (selected services) |
IaaS / PaaS |
Yes |
All US regions |
KMS, VPC, CloudTrail, Config |
$350 / $2,500 / $10,000+ |
Egress billed per GB (review transfer costs) |
| DigitalOcean / VPS |
VPS / Dedicated |
Depends (ask) |
US East/West |
VM isolation, optional managed backups |
$300 / $1,500 / $6,000+ |
Low fixed egress on VPS, but check limits |
| Atlantic.Net |
Managed HIPAA host |
Yes |
US Central/East/West |
Managed VPS, backups, BAA |
$500 / $2,000 / $8,000+ |
Egress moderate; validate pricing tiers |
This table shows ranges based on tested stacks and typical managed plans. Use it to narrow vendors for procurement calls.
Reading the table
The first sentence explains each column and what procurement teams should verify. Columns list BAA presence and predictable cost drivers.
The second sentence lists red flags: no BAAs, no KMS, or unclear egress pricing. Those are procurement blockers.
Take a brief pause to review the table.
Quick scoring guidance
Score providers on Security, BAA scope, Cost predictability, and Support. Weight security higher for clinics that store ePHI.
Score samples: Security 35, BAA scope 25, Cost 20, Support 20. Adjust weights to match risk appetite.
Managed HIPAA hosts: when to pick
Managed HIPAA hosts suit practices that need compliance controls without deep cloud engineering. They bundle BAAs, managed backups, and compliance reporting.
These providers reduce time to production for clinics lacking internal security staff. Expect predictable scoped costs and white-glove migration offers.
The most common mistake is assuming managed hosts handle application-level PHI controls. Contracts often omit application hardening responsibilities.
Real advantages
Managed hosts simplify evidence collection for audits by centralizing logs and backups. They usually keep SOC 2 and compliance artifacts ready.
Managed support often includes documented runbooks and restore tests. This can speed auditor evidence production by days.
Limitations and tradeoffs
Managed hosts trade flexibility for control over platform design. Custom EMR integrations may require extra engineering time.
An anonymous case: a five-provider clinic used a managed host but skipped plugin review. The subsequent audit required additional remediation.
Major cloud providers under BAA
Major clouds are viable when staffed IT handles shared responsibilities. They provide granular controls and scalability at variable cost.
These platforms require configuration discipline and explicit confirmation of HIPAA-eligible services before use. A signed BAA alone does not make a setup compliant.
This works well in theory. In practice, clinics underbudget for egress, managed support, and compliance tooling on major clouds.
Shared responsibility specifics
Providers typically cover physical data center security and core platform controls. Customers retain application, IAM, and data handling responsibilities.
Procurement must request a written shared-responsibility matrix and attach it to the BAA. That clarifies who manages keys, backups, and user provisioning.
Evidence and attestations
Ask for SOC 2 Type II or ISO 27001 evidence and recent penetration testing summaries. These documents verify operational controls.
For federal guidance, see HHS HIPAA and validate OCR enforcement expectations.
1
Procure: Request BAA, shared-resp matrix, SOC 2
2
Build: Configure VPC, KMS, IAM, logging
3
Test: Pen test, restore tests, E2E app checks
4
Go Live: Cutover, monitor, audit evidence ready
VPS and dedicated options
VPS and dedicated hosting fit clinics that need control and predictable flat egress costs. They require tighter internal operations.
WordPress sites and appointment systems run well on secure VPS when proper controls are applied. The host must sign a BAA when PHI exists.
The practical tradeoff: lower platform automation, higher responsibility for backups, patching, and log aggregation.
WordPress for PHI: step-by-step
Choose a host that will sign a BAA and deploy within a private VPC with managed firewall rules. Enforce HTTPS only.
Use a HIPAA-aware form plugin or route forms to server-side encrypted storage. Do not store PHI in posts or analytics tools.
Configure DB SSL connections, enable encryption-at-rest for volumes, and restrict DB access to application subnets. Rotate credentials periodically.
A clear deployment sequence improves audit readiness and reduces errors.
Plugins, logging and backups
Disable debug logging and strip PHI from any error messages and logs. Send application logs to a centralized SIEM for retention.
Backups must be encrypted and have documented retention. Test restores at least quarterly and keep retention evidence for audits.
WordPress appointment systems that handle PHI need a concrete, repeatable deployment pattern rather than high-level rules. The following sequence is one such pattern.
Example sequence for a small clinic: provision a private VPC and place WordPress application servers in private subnets behind an internet-facing load balancer. Run the database on a managed encrypted instance with a CMK in KMS that the practice controls or audits.
Route patient-facing forms to server-side handlers that write PHI into a dedicated, access-restricted table. Use field-level encryption at the application layer rather than storing PHI in posts or analytics.
Store uploads in an SSE-KMS encrypted object store with bucket policies restricting app role access. Apply lifecycle rules for retention.
Enforce TLS 1.2+ on all endpoints and enable HSTS. Remove debug output and disable public directory listings.
Forward all application and access logs to a centralized SIEM or immutable object store with object-lock. Retain logs per policy.
Before go-live run an authenticated penetration test and a restore test from backups. Document the restore with timestamps and signed test reports.
For very small clinics the above can use a single-AZ managed DB and two app instances. For telemedicine or image-heavy workflows add multi-AZ DB and capacity planning for egress.
How to choose by practice size
Selection depends on clinicians, traffic, imaging, and integration complexity. Cost, uptime, and audit readiness scale with those factors.
Small clinics benefit from managed VPS or entry cloud VPCs with a clear BAA and limited integrations. Medium to large clinics need HA and SIEM.
Estimate budgets and timelines before procurement. Typical migration timelines span 2 to 12 weeks depending on scope.
Cost breakdown by size
Small practice (1–5 clinicians): budget $300 to $1,200 per month. This covers hosting, backups, and basic monitoring.
Medium practice (6–25 clinicians): budget $1,200 to $6,000 per month. Add managed DB, SIEM, and yearly pen tests.
Large practice (25+ clinicians): expect $6,000+ per month. Add multi-AZ HA, advanced monitoring, and continuous compliance.
Migration timeline and downtime
Discovery and mapping takes 1 to 3 weeks for small sites and 2 to 6 weeks for larger environments. Plan for 2 to 12 weeks total.
Reduce cutover downtime with blue/green deploys and incremental DB syncs. Expect functional cutover under two hours for DNS swap.
Account for final write freeze windows for EMR synchronization when applicable. Telemedicine and imaging increase sync time.
To help procurement, map hosting type to realistic line-item monthly ranges so decision-makers can compare tradeoffs.
- Example comparative cost guidance: Small practice (1–5 clinicians): managed HIPAA host: $700–$1,200/month (includes BAA, basic managed backups, limited SIEM)
- self-managed cloud IaaS: $300–$800/month (compute, managed DB, basic monitoring; excludes third‑party 24/7 support)
- VPS/dedicated: $200–$600/month (flat egress possible, but you manage patches and logging)
- Medium practice (6–25 clinicians): managed HIPAA host: $2,000–$6,000/month (BAA, backups, integrated SIEM, routine compliance reporting)
- self-managed cloud: $1,200–$4,000/month (adds engineered HA, managed DB, paid SIEM and scheduled pen-tests)
- VPS/dedicated: $1,000–$2,500/month plus engineering support
- Large practice (25+ clinicians): managed HIPAA host: $8,000+/month
- cloud IaaS with internal ops: $6,000–$15,000+/month (multi-AZ HA, advanced monitoring, dedicated security engineering)
- dedicated appliances: $5,000+/month plus staff
- These ranges assume typical imaging/telemedicine exposure. Note that egress (often $0.05–$0.12/GB on major clouds) and annual pen tests, SOC 2 readiness, or a 24/7 managed response contract are frequently quoted separately and can add several hundred to several thousand dollars per month depending on volume and SLAs.
What nobody tells you
Audit and procurement teams often underestimate the time to collect evidence for OCR audits. Compiling a full artifact package can take one to fourteen days.
The data show many audit findings cite lack of documented access controls and missing backup restore tests. These are common weak points.
An example case: a medium clinic migrated to a major cloud and assumed compliance. The audit flagged missing MFA logs for admin accounts.
Evidence production times
BAA and policy documents are available immediately. Config snapshots and IAM exports take 1 to 3 days to compile.
Full pen test reports or remediation histories may require 1 to 2 weeks to assemble and validate for auditors.
Hidden cost drivers
Network egress can dominate bills for imaging and telemedicine. Expect $0.05 to $0.12 per GB on major clouds without discounts.
Managed support premiums range 15 to 40 percent for 24/7 white-glove support and expedited incident handling.
Synthesis and procurement actions
Choose a managed HIPAA host if the practice lacks an IT security team. Choose a major cloud if internal staff can own shared responsibilities.
Negotiate BAAs that explicitly list covered services and subcontractors. Attach a shared-responsibility table to the contract.
Below is a practical BAA template and clause explanations to copy into procurement documents.
BAA template
Business Associate Agreement (BAA) - [Provider Name]
This Business Associate Agreement is entered into as of [Date], by and between [Covered Entity] and [Business Associate].
- Definitions: Terms in 45 CFR Part 160 and Part 164 apply.
- Permitted Uses: BA will access ePHI solely to perform services as described in the Master Services Agreement.
- Safeguards: BA will implement administrative, physical, and technical safeguards reasonably and appropriately to protect ePHI.
- Subcontractors: BA will require subcontractors to agree to guard ePHI under equivalent terms.
- Breach Notification: BA will notify Covered Entity within 72 hours of discovery of a breach involving ePHI.
- Data Residency: ePHI will be stored only in US-based data centers unless written consent is provided.
- Access and Audit: BA will provide logs, KMS audit trails, and configuration snapshots within 5 business days on request.
- Key Management: Clarify whether provider or covered entity manages encryption keys and key rotation schedule.
- Termination: Upon termination BA will return or destroy ePHI per security policy and provide destruction attestations.
- Indemnification and Liability: [negotiated terms]
Signed:
[Covered Entity Representative] Date
[Business Associate Representative] Date
Clause explanations
The most critical clauses define breach notification timelines, key custody, and scope of subcontractors. Require logs within five days.
Specify KMS ownership: if the practice retains keys, request KMS audit logs and key rotation records in the BAA.
Include this BAA template in the RFP and ask shortlisted vendors for signed sample BAAs and SOC 2 reports before awarding a contract.
Exceptions: If the site or service never creates, receives, transmits, or stores ePHI, HIPAA hosting procurement is not required. Also, if using a SaaS vendor that signs a BAA and fully hosts PHI, separate hosting procurement may not be necessary.
Compact audit-ready technical checklist (evidence-focused):
- enforce MFA for all admin and cloud console accounts
- maintain role-based least-privilege IAM with an exported IAM credential report and change log retained. Encryption: enable encryption-at-rest with provider-managed or customer-managed CMKs (document KMS key ARNs, rotation schedule and access policy)
- enforce TLS 1.2+ and publish certificate rotation dates. Logging & retention: centralize CloudTrail/Cloud Audit logs, VPC flow logs and application logs to an immutable storage location with object-lock
- retain logs per 45 CFR documentation guidance (commonly 6 years) or as your legal counsel directs. Backups & restores: schedule encrypted backups daily, snapshot retention policy documented, and run and sign quarterly restore tests (store signed restore attestations and timestamps). Pen testing & vulnerability management: annual external pentest with remediation tracker, monthly vulnerability scans and ticketed closure evidence. BAAs & attestations: keep signed BAA on file, SOC 2 or ISO reports, and a subcontractor list
- require sample invoices or usage reports to verify quoted pricing
Incident response: documented IR plan, breach notification SLA in BAA (e.g., 72 hours), and retention of forensic images with chain-of-custody notes. Migration verification: store checksumed data exports, run pre/post cutover data integrity checks, and collect performance baselines and uptime SLAs as part of go‑live evidence. Each checklist item should map to one or two concrete artifacts (for example: ‘IAM credential report .csv, CloudTrail S3 path and SIEM export, encrypted backup snapshot IDs, signed restore test PDF’).
Frequently asked questions
What is HIPAA-compliant hosting?
Hosting that meets HIPAA Security Rule requirements protects ePHI when a signed BAA exists and the covered entity applies required administrative and technical controls. The host must support encryption, logging, and U.S. Data residency.
Do I need HIPAA-compliant hosting for my medical site?
If the site, portal, or app creates, transmits, or stores ePHI, you need HIPAA-compliant hosting and a signed BAA. Public informational sites without PHI do not require HIPAA hosting.
How do I get a business associate agreement with a provider?
Request the provider’s standard BAA during procurement and confirm the exact services it covers. Negotiate breach timelines, subcontractor clauses, key custody, and audit access before signing.
Can I host PHI on AWS/Azure/GCP and stay compliant?
Yes, provided you sign the provider BAA, restrict usage to HIPAA-eligible services, implement encryption and IAM controls, and document the shared-responsibility model. Verify the provider's list of eligible services.
How much does HIPAA-compliant hosting cost in the US?
Costs vary by architecture and ePHI volume. Expect small practices hundreds per month, medium practices thousands, and large practices tens of thousands, including support and compliance testing.
What to do when hosting violates HIPAA?
If a violation occurs, follow the incident response plan, notify affected parties per state and federal rules, collect forensic evidence, and engage legal counsel. OCR may require reporting and remediation.
Next steps and resources
Start procurement
