HIPAA-Eligible vs HIPAA-Compliant Hosting: How To Choose The Right Provider

Healthcare providers, business associates, and digital health startups need hosting that can protect electronic protected health information. When comparing hosting providers, clients often encounter the terms “HIPAA-eligible” and “HIPAA-compliant.” Although closely related, these terms describe different levels of provider support and customer responsibility.

A HIPAA-eligible service provides infrastructure and security features that can support workloads regulated by the Health Insurance Portability and Accountability Act. The customer must configure and manage those features correctly. In comparison, HIPAA-compliant hosting includes an implemented environment supported by a HIPAA Business Associate Agreement (BAA), technical safeguards, operating procedures, and documented risk assessments.

Because the Department of Health and Human Services does not certify or recommend specific cloud services, these labels cannot replace a detailed provider evaluation. Therefore, healthcare organizations must examine the service scope, security controls, compliance support, and shared responsibilities before selecting a hosting provider.

This article explains HIPAA-eligible vs. HIPAA-compliant hosting and provides a practical basis for choosing a service that supports ongoing HIPAA compliance.

HIPAA-Eligible Vs HIPAA-Compliant Hosting

HIPAA-eligible services include computing, storage, databases, networking, and other cloud services that a provider permits customers to use for workloads involving electronic Protected Health Information. Eligibility normally applies only to specified services, regions, account types, and contractual conditions. The customer must still configure and manage the selected services correctly.

HIPAA-compliant hosting describes an implemented environment supported by a signed HIPAA Business Associate Agreement (BAA), access controls, data protection, audit logging, monitoring, backup, recovery, and documented operating procedures. The hosting model may divide responsibility for these measures between the provider and the customer.

The phrase “fully HIPAA-compliant hosting” should therefore be interpreted carefully. It is a commercial description, not an official HHS designation. Although a provider may manage the hosting infrastructure, the customer still controls its users, applications, internal policies, and use of patient data.

Table 1: Main Differences Between HIPAA-Eligible Services and HIPAA-Compliant Hosting

Therefore, HIPAA eligibility confirms that a service may support a regulated workload, while HIPAA compliance focuses on the full implementation and how it is operated.

Confirming The Scope Of HIPAA-Eligible Services

Before selecting a provider, the organization should map each part of its proposed architecture to the provider’s eligible service list. This review should include compute, databases, storage, backups, logging, encryption, networking, technical support, and disaster recovery. It should also confirm any restrictions involving regions, account types, subcontractors, or service plans.

The review must follow the complete flow of ePHI. For example, an eligible server may transfer logs or backups to a service outside the approved scope. Similarly, an application using Google Cloud may depend on the Cloud Healthcare API and several supporting services. Before deployment, the organization should obtain written confirmation that every component handling ePHI is included in the applicable HIPAA Business Associate Agreement (BAA).

Creating A HIPAA-Compliant Hosting Environment

The selection of HIPAA-eligible services must be followed by a risk analysis of the systems and data flows that create, receive, maintain, or transmit ePHI. HHS guidance on risk analysis requires covered entities and business associates to examine potential risks to the confidentiality, integrity, and availability of this information.

The identified risks then determine which safeguards are required within the hosting environment. At this stage, the provider and customer should document their respective duties for access management, configuration, patching, monitoring, backup, recovery, and incident response. Each control should also have an assigned owner and review schedule.

Configuring HIPAA-Eligible Services

A hosting service does not become suitable for ePHI merely because the provider identifies it as HIPAA-eligible. The customer or managed hosting provider must configure available security features based on the risks identified for the healthcare workload.

To control administrative access, the environment should use unique accounts, limited permissions, and multi-factor authentication. Service accounts also require managed credentials and access restricted to their assigned functions. Together, these measures prevent eligible cloud services from being operated with weak or excessive permissions.

Alongside access protection, encryption should cover databases, storage volumes, backups, and archives containing ePHI. Current TLS settings should also protect data during transmission. Since encryption depends on secure key management, the organization should define procedures for key access, rotation, recovery, and revocation.

Finally, audit logging should record authentication attempts, privileged actions, configuration changes, and access to sensitive systems. These records can be sent to a protected monitoring platform, where alert rules and intrusion detection systems flag activity that requires investigation. In this way, the security features available within HIPAA-eligible services become working controls within the hosted environment.

Evaluating The HIPAA Business Associate Agreement (BAA) And Operational Responsibilities

Technical security features are not sufficient when the provider’s contractual and operational duties are unclear. Therefore, provider evaluation should confirm whether the company will sign a HIPAA Business Associate Agreement (BAA) before creating, receiving, maintaining, or transmitting ePHI. According to HHS cloud computing guidance, this requirement may apply even when the provider stores encrypted information without possessing the decryption key.

The proposed HIPAA Business Associate Agreement (BAA) should identify permitted uses of ePHI, required safeguards, incident-reporting duties, subcontractor responsibilities, and data-availability requirements. It should state that the service will securely delete information when the service ends.

The provider’s responsibilities must also match the proposed architecture. If backups, monitoring, technical support, or disaster recovery involve subcontractors, the customer should confirm that these services receive appropriate contractual coverage. Select a provider only when the HIPAA Business Associate Agreement (BAA) and service documents clearly distinguish its responsibilities from those retained by the customer.

Matching The Hosting Model To Organizational Capabilities

The division of responsibilities identified during provider evaluation should also inform the hosting model choice. Healthcare organizations must consider their internal, available personnel, application architecture, and required level of control before selecting public cloud, managed hosting, or dedicated infrastructure.

For organizations with established cloud and security teams, public cloud services can provide direct control over architecture and configuration. The customer must select HIPAA-eligible services and manage its responsibilities for identity management, network rules, operating systems, applications, logging, and data protection. AWS, Microsoft Azure, and Google Cloud are therefore suitable only when the organization can configure and monitor the selected services appropriately.

Managed HIPAA hosting may be more appropriate when an organization cannot perform every security and administrative task internally. Under this model, the provider may assume responsibility for server hardening, patching, firewalls, vulnerability scanning, intrusion detection, monitoring, backups, and reThey support. The exact scope varies by provider and service plan.

Managed services may be delivered through cloud infrastructure or dedicated servers. Cloud hosting can support flexible capacity, while dedicated infrastructure may be selected when the organization requires physical isolation or direct control over hardware. For example, AtlanticAtlantic.Net’sosting includes managed cloud and dedicated options and offers a HIPAA Business Associate Agreement (BAA). When evaluating such a provider, the organization should confirm which services are included, which controls require an additional fee, and which responsibilities stay with the customer.

The selection should therefore reflect both the technical requirements of the healthcare application and the organization’s capabilities. A managed or dedicated service is suitable only when its documented responsibilities address the operational work that the organization cannot perform independently.

Reviewing Provider Evidence Before Selection

The responsibilities described in a service agreement should be supported by evidence that the provider’s operations match the agreement. Therefore, the evaluation should include independent audit reports and other records covering the services, facilities, and review period relevant to the proposed hosting environment.

A SOC 2 Type II report may provide evidence about security, availability, confidentiality, and related controls. Similarly, current HITRUST or ISO/IEC 27001 certification may support the assessment when its scope includes the services under review. These records do not make the customer’s hosting provider HIPAA-compliant, and HHS has not issued HIPAA compliance for hosting providers.

Additional evidence may include penetration-testing summaries, remediation records, architecture diagrams, data-flow documentation, backup-test results, and incident-response procedures. Some records may require a nondisclosure agreement because they contain sensitive security information. Even then, the provider should offer a suitable method for reviewing evidence related to the service being purchased.

Evaluating Backup And Disaster Recovery Capabilities

Provider selection must also consider ePHI availability because the HIPAA Security Rule requires regulated entities to protect its confidentiality, integrity, and availability. Therefore, the organization should determine how quickly each hosted system must be restored and how much recent data it can lose. These requirements establish the recovery time objective and recovery point objective used to evaluate the provider’s capabilities.

Based on these objectives, the provider should explain how frequently backups are created, where they are stored, and how they are protected. Backup encryption, separate administrative credentials, and controls against unauthorized alteration or deletion can reduce the risk of losing both production data and recovery copies. In addition, every backup and recovery location should satisfy applicable legal, contractual, and organizational requirements.

The organization should then examine evidence from recent restoration and disaster recovery tests. The records should identify actual restoration times, available recovery points, data-integrity results, identified failures, and corrective actions. Finally, the contract should explain how the customer can export active data and backup copies during migration, provider failure, or service termination.

Avoiding Common Selection And Problems

Strong security and compliance: Organizations must assess how providers secure their services and how they are selected and used. Healthcare organizations should therefore address the following risks before electronic protected health information enters the hosting environment:

• Verify that every cloud service receiving, storing, processing, or transmitting ePHI falls within the provider’s eligible services and HIPAA Business Associate Agreement (BAA).
• Apply role-based access control and remove excessive permissions from users, administrators, and service accounts.
• Use de-identification when synthetic data is not required for development environments and sensitive patient data is not required.
• Configure healthcare websites, applications, analytics platforms, and debugging tools to prevent protected health information from entering logs unnecessarily.
• Test complete backup and disaster recovery procedures instead of relying only on successful backup reports.
• Treat compliance certifications and independent audits as evidence of specific provider controls rather than proof of complete HIPAA compliance.
• Update risk assessments based on the measures and integrations, or healthcare data flows, the organization is choosing between the technical provider and the custom provider; it should record its reason, alternative security controls, responsible owner, deadline, and review date.

Questions To Ask Before Choosing A HIPAA Hosting Provider

You can turn the risks identified during the technical, contractual, and recovery reviews into specific questions for each shortlisted provider. Using the same questions for every provider also makes differences in service scope and responsibility easier to identify.

• Will the provider sign a HIPAA Business Associate Agreement (BAA) covering every service in the proposed architecture?
• Which services, facilities, regions, and support arrangements fall within its HIPAA program?
• Which security responsibilities belong to the provider, and which must the customer manage?
• Who manages encryption keys, access reviews, security monitoring, and incident investigation?
• Which managed services are included in the quoted price, and which require an additional fee?
• How quickly will the provider report security incidents involving the customer’s ePHI?
• Which SOC 2, HITRUST, ISO/IEC 27001, and security records can the customer review?
• What recovery point and recovery time objectives apply to the proposed service?
• How frequently does the provider test backup restoration and disaster recovery?
• How will the provider return or securely delete active ePHI and backup copies when the contract ends?

The provider’s answers should appear in the HIPAA Business Associate Agreement (BAA) and service agreement.

Implementing And Reviewing The Selected Hosting Service

The responsibilities recorded during provider evaluation should also appear in the plan. Legal and compliance personnel should confirm that the signed HIPAA Business Associate Agreement (BAA) and service contract accurately describe the compliance obligations assigned to the provider and customer. At the same time, technical teams should verify that every component handling ePHI belongs to the approved HIPAA hosting architecture.

The organization should then configure and test access controls, encryption, identity management, audit logging, monitoring, backup, and disaster recovery measures before production use. Testing should confirm that unauthorized users cannot access sensitive healthcare data, security alerts reach assigned personnel, and backup data can be restored within the approved recovery objectives.

Regular review is necessary to maintain compliance because applications, provider services, and security risks may change. Access reviews, configuration checks, recovery tests, compliance reporting, and provider reassessments should therefore follow a defined schedule. Each identified weakness should have an assigned owner and correction date, while an approved exception should include its reason, alternative safeguards, and future review date.

Conclusion

The distinction between HIPAA-eligible and HIPAA-compliant hosting matters most during. A provider may offer HIPAA-eligible services and extensive security features. Still, these advantages have limited value when the HIPAA Business Associate Agreement (BAA), security controls, and shared responsibilities do not correspond with the organization’s use of electronic protected health information.

Therefore, healthcare organizations should select a HIPAA-compliant hosting provider whose contractual commitments, compliance support, and technical safeguards can be documented, tested, and monitored throughout the service relationship. This approach provides a defensible basis for protecting sensitive patient data and meeting ongoing HIPAA compliance obligations.