HIPAA Compliant Hosting Solutions
HIPAA Compliant Hosting by Atlantic.Net™ is SOC 2 TYPE II and SOC 3 TYPE II certified, HIPAA and HITECH audited, designed to secure and protect critical healthcare data, and electronic protected health information (ePHI) and records. Our HIPAA Hosting Solutions have been audited by a qualified independent third party auditing firm, demonstrating our commitment to providing the best IT security and top-notch compliance solutions.
Whether you're looking for comprehensive, fully managed HIPAA compliant hosting solutions for your HIPAA servers or unmanaged hosting service, we can assist you with all your HIPAA compliance hosting needs. Our high-performance Website, Database, and Storage servers are available in both Dedicated and HIPAA Compliant Cloud environments and backed by our 100% uptime guarantee.
HIPAA Web Server Hosting
Our HIPAA Compliant Web Site Hosting plans offer ultra-fast data processing speeds, and security features to help you attain fast compliance. The fast loading speeds of our highly available HIPAA compliant web servers come with security safeguards, high performance, and guaranteed reliability. Faster servers mean faster websites.
HIPAA Web Hosting Features
- Firewall for HIPAA Compliant Web Hosting
- HIPAA-Compliant Encrypted VPN
- HIPAA-Compliant Offsite Backups
- SSL certificates for HIPAA Compliance
- SOC 2 TYPE II and SOC 3 TYPE II Certifications
- Business Associate Agreement (BAA)
HIPAA Windows and Linux Dedicated Hosting
Here at Atlantic.Net, we’re committed to offering covered entities fully compliant solutions affordably. We understand that one size fits all does not apply to complex regulatory compliance, that’s why we stand ready to better understand your needs and create a customized solution for you. Whether you need Windows or Linux HIPAA Hosting, we can assist you with a solution that best fits your needs.
WINDOWS HIPAA COMPLIANT HOSTING
You can get your HIPAA Windows Hosting with distributions to include Windows Server 2019, Windows Server 2016 Datacenter, Windows Server 2016 Datacenter (with Containers/Docker), Windows Server 2008 Datacenter SP1, Windows Server 2012 R2 Datacenter, and Windows Server 2012 Desktop Experience.
LINUX HIPAA COMPLIANT HOSTING
You can get your HIPAA Linux Hosting with distributions to include Ubuntu, Debian, CentOS, Fedora, FreeBSD, and Arch Linux.
HIPAA ONE-CLICK HOSTED APPLICATIONS:
Our One-Click hosted applications include LAMP, LEMP, WordPress, Docker, Node.js, cPanel/WHM, OctoberCMS, and Nextcloud.
HIPAA Compliant Database Solutions
Our HIPAA Database Solution combines high system performance and a completely audited HIPAA-compliant platform, to create a customized solution built for all your database needs. Security, scalability, high-speed data transfers, and performance are the focus of our HIPAA Database Hosting Solutions. Our solutions work with a variety of SQL platforms both proprietary and open source. Whether you are hosting sensitive healthcare records or large data sets and images, you can rest assured that your databases will be backed by 100% uptime SLA!
Supported Databases
Atlantic.Net’s HIPAA Database solutions offer fast provisioning, ongoing management, and round-the-clock monitoring of your databases. We understand that system performance is critical in supporting your business performance, we provide:
MSSQL:
Our support for Microsoft SQL Server ranges from small datasets to large enterprise data warehouses. Microsoft SQL Server 2017 secures your data with layers of Always-On encrypted technology, row-level security, dynamic data masking, transparent data encryption (TDE), and robust auditing. For a unified solution of high availability combined with disaster recovery, the enhanced Always-On feature in Microsoft SQL Server 2017 offers fast failover, easy setup, and load balancing.
MySQL:
MySQL offers easy access and interaction with the server. Triggers, stored procedures, and views enhance development efficiency and productivity. MySQL allows developers to roll back transactions and commit them to crash recovery. It supports a large number of embedded applications, making MySQL very flexible. Because of its unique storage engine architecture, it is faster, cost-effective, and reliable. The solid security layer of MySQL protects sensitive data from intruders.
PostgreSQL:
PostgreSQL is a general-purpose object-relational database management system that allows you to add custom functions using a variety of programming languages. Designed to be extensible and customizable, PostgreSQL allows you to define your own data types, index types, and functional languages. To enhance the system to suit your needs, you can develop custom plugins, such as adding a new optimizer.
What is HIPAA Compliant Hosting?
HIPAA compliant hosting is a web hosting solution that meets and exceeds the required physical, administrative, and technical safeguards mandated by the HIPAA regulations of 1996, including the subsequent Security Rule and Privacy Rule amendments of 2003. Managed service providers, covered entities, and relevant third parties are bound by these regulations to protect and uphold patient data integrity.
HIPAA Compliant Hosting requirements checklist
Implementing HIPAA compliance can be complicated. HIPAA compliance hosting involves integrating server hosting solutions with security and managed services. This also means that the end solution would include a Business Associates Agreement. We have compiled an easy, solution-oriented HIPAA web hosting requirements checklist, in accordance with the HIPAA Privacy Rule and Security Rule. Atlantic.Net can help provide all these components to help deliver HIPAA Compliant Server Hosting Solutions Below are eight elements you need for a HIPAA compliant hosting environment for HIPAA Web Hosting, HIPAA Database Hosting, or other HIPAA hosting setups:
Firewall
Essentially, you need to have firewalls fully implemented on your site. There are three basic types of firewall solutions: hardware firewalls, software firewalls, and web application firewalls (WAFs). Typically, infrastructure has a combination of hardware and software firewalls, along with solutions specifically designed for web applications, because apps create their own unique challenges and have become such a frequent target for intrusions. Making sure that technology is system-wide is one of the HIPAA compliant server requirements.
What is a firewall?
A firewall is actually a kind of broad term. It refers to a hardware or software system (i.e., physical component or an app) that is used to secure a network, via a set of rules that control the traffic that’s entering and exiting it.
The hardware/software distinction is just one way to categorize firewalls, though. As indicated in the US Department of Commerce’s NIST firewall guidelines (Special Publication 800-41), and as expanded by TechTarget, five primary types of firewalls are application-level gateways (proxies), circuit-level gateways, multilayer inspection firewalls, packet-filtering firewalls, and stateful inspection firewalls.
Encrypted VPN
The VPN needs to be encrypted, and you want it to be strong. Not all VPNs are the same, so do your homework.
What is an encrypted VPN?
An encrypted VPN is a technology that essentially creates a tunnel between two devices (typically the server and the client). The data is encrypted entering the tunnel and decrypted as it exits it.
There are a couple of standard encryption protocols for VPNs other than SSL, IPsec (Internet Protocol Security), and GRE (generic routing encapsulation). GRE gives you a framework with which you’re able to package and transport via IP.
Offsite backups
You want to have your data backed up in an external location, such as external HIPAA data centers. This HIPAA compliant hosting requirement is a reasonable way to ensure all the EMRs are safe. Note how many of these requirements are probably already in place for your company. Very little is required additionally to the security parameters that most enterprises and many SMBs already have up and running. Again, HIPAA Compliant Hosting Services must meet this and the other HIPAA compliant hosting requirements as well.
What are offsite backups?
Offsite backups are a security tactic and disaster recovery technique that means data, and in some cases software, is being stored at a remote location from the company (frequently offsite data centers). Offsite backups are also called offsite data backups or offsite data protection – albeit, the latter really denoting the safeguards of the external environment. Offsite backups are simply a distribution or diversification method to prevent total loss of your valuable ePHI (electronic protected health information).
Multifactor authentication
Multifactor authentication is simple and fast to establish, similar to the other HIPAA compliant server requirements. You just go into the control panels for each of your various systems and make the configuration changes. Many of the systems you’ll see will be based on Google Authenticator, which will require everyone to have that app installed on their cell phones; though there are plenty of other brands you can choose from.
What is MFA?
Multifactor authentication, which goes by MFA, is a security check that uses two different forms of authentication to confirm the identity of the user. MFA is a stronger evolution of SFA (single-factor authentication), which only authenticates in one manner, usually via a password matching the username provided.
Private Hosted Environment
You cannot have a platform that shares resources with any other entities if you want to achieve HIPAA compliant server requirements. Working with a HIPAA compliant hosting provider with experience related to properly privatizing your infrastructure obviously helps.
What is a private hosted environment?
What's meant by a private hosted environment is your servers are reserved solely for your use. That’s the key point and refers to Atlantic.Net’s Cloud Hosting (including HIPAA compliant cloud solutions) or dedicated hosting servers.
In a private hosted environment, the data is all in its own place, so it is not being shared or intermingled with the information of other apps or hosting users.
Atlantic.Net trusts and utilizes DUO for multifactor authentication solutions.
SSL certificates
You need secure sockets layer (SSL) certificates established throughout your site, for any domains and subdomains hosting healthcare information or where sensitive ePHI is accessed. In other words, any parts of your site that need login credentials should always also have an SSL. Each server used for your site needs its own SSL certificate installed. Also, be aware that an EV certificate, creating a green address bar, and/or respected brand name such as Norton or GeoTrust, can help increase trust, security, and credibility for your system.
What is an SSL certificate?
An SSL (secure sockets layer) certificate is software that creates encryption of data during transmission and validates ownership of the certificate to varying degrees.
Groups called certification authorities (CA’s), which typically have very high reputations for security, issue these certificates.
SSL certificates come in three main levels of validation: domain validation (DV), organization validation (OV), and extended validation (EV). All certs create https protocol and a lock icon, along with brief information available to all web users. EV is represented by the green address bar indicators in all major browsers. SAN certificates and wildcards certs are other types.
SOC 2 TYPE II and SOC 3 TYPE II Certifications
Note that Statement on Standards for Attestation Engagements (SSAE) 18, created by the American Institute of Certified Public Accountants (AICPA), is more stringent, in some ways, than HIPAA is regarding security. It’s not a requirement for HIPAA, but seeing that certification should make you feel more confident that a company meets HIPAA compliant hosting requirements.
What is SSAE 18 Certification?
SSAE 18 certification entails an official review and audit that verifies you are meeting all parameters of Statements on Standards for Attestation Engagements No. 16, a standard developed by the AICPA (American Institute of Certified Public Accountants) via its ASB (Auditing Standards Board).
This standard provides guidance on best practices through which a healthcare organizations or companies can report on their compliance control, as gauged through a formal audit.
In addition, HIPAA and HITECH Audits are also growing. Here at Atlantic.Net, our infrastructure is not only SOC 2 TYPE II and SOC 3 TYPE II certified but also fully audited for HIPAA and HITECH compliance. These audits are conducted on an annual basis through a third party independent auditor, who verify and attest to controls, checks, and balances of the infrastructure, as it relates to logical and physical controls and security.
Business Associate Agreement (BAA)
If you use any outside entity to assist with your EMR, including a hosting company, you must have a BAA signed with that organization. That document does not clear you of your own responsibilities related to HIPAA, but it does delineate the role that the organization takes and ways in which they should be held liable for any breaches, etc.
What is a BAA (business associate agreement)?
A HIPAA business associate agreement is a legal contract between a HIPAA covered entity and business associate, as defined via the US Health Insurance Portability and Accountability Act of 1996. These agreements safeguard ePHI (electronic protected health information), which is the sensitive personal health data and records of patients.
Covered entities are healthcare providers, plans, and data clearinghouses, while business associates are any organization or company doing business with covered entities in a manner that involves ePHI/medical records, such as hosting companies offering HIPAA cloud services.
Why Choose Atlantic.Net?
As an experienced HIPAA compliant hosting partner, Atlantic.Net has an extensive history of building, managing, and maintaining a robust healthcare IT platform and HIPAA compliant cloud environment, one that is inherently secure and designed from the ground up to protect electronic patient health information (ePHI). Our customers can directly plug into this service knowing that ePHI data integrity is protected.
Atlantic.Net has long expanded and enhanced its Infrastructure as a Service (IaaS) platform in order to allow for customizations based on specific industries like the healthcare industry. Atlantic.Net combines a world-class physical offering with a world-class team of engineers and has no peers who provide a total “peace of mind” HIPAA compliant hosting solution. Depending on the weight of your traffic, potential to scale, number of domains, and your company security needs, our dedicated consultants stand ready to evaluate your business goals to help you choose the right web hosting solutions for you.
Choose a partner with niche HIPAA expertise.
If you are concerned about setting up a database that will store electronic health data, using an outside host for your systems can be wise. There are many hosting plans from which to choose, some of which have more experience with HIPAA than others. At Atlantic.Net, healthcare is one of our primary points of focus and has been for years. HIPAA Compliant Hosting by Atlantic.Net is SSAE 18 SOC 1 & SOC 2 certified and HIPAA & HITECH audited, designed to secure and protect critical healthcare data and records.
Below you will find a couple of examples of our HIPAA Windows, and Linux dedicated server packages, to help you comply with the HIPAA Security Rule. HIPAA dedicated server pricing is based on term commitment.
Custom Windows & Linux
HIPAA Dedicated Server Hosting
Get a Quote
CPU Up to 112 CPU Cores
RAM Up to 2 TB of RAM
Disk Custom Build Storage
Redundant Storage RAID 1, 5, 10, 50, or 60
IP Addresses IPv4 and IPv6, Private and Public
Monthly Bandwidth Up to 10Gbps
VPNs 
Server Management
Managed Backup
Managed Firewall
Intrusion Prevention
Anti-Malware
Network Security
Log Inspection
Integrity Monitoring
Redundant Firewall
FIPS Disk Encryption
Failover Hosts
Redundant Switching
Encrypted Data At Rest
Get Started
Click Here for Additional Sources
This page was updated with the latest information on January 10th, 2021.
