Updated: July 22, 2026

A database is HIPAA-compliant when the electronic Protected Health Information (ePHI) inside it is encrypted at rest and in transit, reachable only through access controls tied to unique named accounts, recorded in audit logs showing who read or changed what, and running on infrastructure covered by a signed HIPAA Business Associate Agreement (BAA). No database product ships in that state. Relational databases such as MySQL, PostgreSQL, and SQL Server give you the controls. What makes a database HIPAA-compliant is how you configure it, how you monitor it, and how you evidence that work to an auditor.

Being handed responsibility for a HIPAA-compliant database is a lot to absorb, and the temptation is to shop for a product that advertises itself as compliant. Healthcare teams arrive at the same short list either way, because HIPAA requirements apply whichever engine you pick.

The 10 Considerations at a Glance

# Consideration What It Means in Practice HIPAA Rule It Maps To
1 Understand what HIPAA is Know which parts of HIPAA govern patient data and ePHI Privacy Rule and Security Rule, Title II
2 Know the core tools Use encryption, firewalls, electronic auditing, and independent audits 45 CFR § 164.306(a)
3 Train your staff Train everyone who handles ePHI and enforce sanctions for policy breaches Administrative safeguards, 45 CFR § 164.308(a)(5)
4 Examine technical and physical safeguards Review software controls, hosting controls, and data center protections Technical safeguards, 45 CFR § 164.312; physical safeguards, 45 CFR § 164.310
5 Limit access to applications and data Use unique logins, role-based access controls, and MFA on administrative paths 45 CFR § 164.312(a)(1), § 164.312(d), and § 164.502(b)
6 Set up data usage controls Restrict ePHI exports and classify sensitive data 45 CFR § 164.308(a)(4) and § 164.310(d)(1)
7 Encrypt your databases Encrypt data at rest and in transit to support HHS safe harbor expectations 45 CFR § 164.312(a)(2)(iv) and § 164.312(e)(2)(ii)
8 Monitor use and create logs Record and review access activity so incidents can be reconstructed 45 CFR § 164.312(b) and § 164.308(a)(1)(ii)(D)
9 Decide whether to use an outside party Confirm whether any provider handling ePHI is a business associate and requires a BAA 45 CFR § 164.308(b)(1) and § 164.314(a)
10 Choose a partner with HIPAA experience Select a host whose audit scope, safeguards, and compliance documentation can be reviewed. Risk analysis, 45 CFR § 164.308(a)(1)(ii)(A), and evaluation, § 164.308(a)(8)

The Health Insurance Portability and Accountability Act (HIPAA) classifies the encryption specifications in row 7 as addressable, not required. The Department of Health and Human Services is clear that addressable “does not mean that an implementation specification is optional.” You implement it, or you document why an alternative achieves the same purpose, and that reasoning belongs in your risk assessments. A Security Rule overhaul proposed in January 2025 would make encryption and multi-factor authentication mandatory, and OCR states that the current rule remains in effect while that rulemaking proceeds. Treating encryption as optional is a poor bet under either version.

What Is a Database?

The two most widely deployed engines in healthcare systems are MySQL and SQL Server, with PostgreSQL now common in newer patient portals and medical SaaS platforms. Healthcare organizations run patient portals, billing, and scheduling on the same engines, so one database system often holds clinical records and ordinary operational data side by side.

What Is MySQL?

MySQL is an Oracle-owned open-source relational database, usually run on Red Hat Enterprise Linux, Rocky Linux, or Ubuntu. Current releases support InnoDB encryption for data at rest at the tablespace level, the feature that matters most for HIPAA work.

What Is MS-SQL?

MS-SQL, also known as Microsoft SQL Server, is the long-standing choice for Windows Server environments. Microsoft has supported SQL Server on Linux since 2017, and SQL Server 2025 runs on Red Hat Enterprise Linux 9 and 10 and Ubuntu 22.04 and 24.04.

Securing a Database for HIPAA Compliance

Traditional databases have no built-in way to identify which columns hold sensitive patient data. Hence, nothing warns you when a support ticket table starts collecting diagnoses, and the chance of ePHI landing somewhere unplanned is high. Our ten considerations cover how healthcare organizations secure databases holding ePHI, and what a HIPAA-compliant database needs across the physical, technical, and administrative safeguards of HIPAA compliance.

1 – Understand What HIPAA Is

Congress passed the Health Insurance Portability and Accountability Act in 1996. The law is wide-ranging, covering:

  • portability of health insurance coverage when US employees change jobs;
  • fraud and abuse prevention in the healthcare industry;
  • standards for healthcare data used in billing; and
  • safeguarding health data and maintaining its privacy.

That fourth point governs a database, through the Privacy Rule and the Security Rule of HIPAA Title II. Work out which side of the line you sit on first, because it sets your HIPAA obligations: covered entity or business associate. Healthcare providers, health plans, and clearinghouses transmitting individually identifiable health information electronically are covered entities, and the vendors they hand ePHI to are business associates bound by business associate agreements. NIST’s SP 800-66 Revision 2, published in February 2024, maps each requirement to concrete controls.

2 – Know the Core Tools for Protecting a HIPAA-Compliant Database

Four tools protect data in a HIPAA-compliant database: encryption, firewalls, electronic auditing systems, and third-party audits. Most healthcare organizations already own all four somewhere, and the gap is usually that none were ever pointed at the database.

Encryption ensures only authorized users can read sensitive information, whether it sits in stored data or in transmission. Firewalls block illegitimate network access, and electronic auditing platforms require login credentials and produce audit logs of everything each individual does. Third-party audits bring in someone who works on HIPAA compliance full time, surfacing weaknesses your own healthcare teams have stopped seeing.

3 – Train Your Staff

Data security is maintained through your staff as much as your technology. The 2026 Verizon Data Breach Investigations Report healthcare snapshot found the human element present in 54% of healthcare data breaches, with internal actors involved in 19%. Miscellaneous errors have appeared in the top three healthcare breach patterns in every Verizon report from 2014 through 2026.

The errors are mundane: misdelivery, loss (frequently unencrypted devices and portable media), and misconfiguration such as exposing a data store to the internet. Training the people who handle protected health information (PHI) stops those from becoming compliance violations and reportable breaches, and 45 CFR 164.308(a)(5) requires a security awareness and training program for every workforce member, management included. Auditors routinely ask for the attendance records, so keep them with your HIPAA compliance evidence.

4 – Examine Your Infrastructure for Technical and Physical Safeguards

Whether you run your own data center or use a HIPAA-compliant server hosting provider, the technical safeguards and the physical controls both have to be in place, and the risk assessments at 45 CFR 164.308(a)(1)(ii)(A) tell you where the gaps sit.

Technical safeguards secure electronic data. The security measures 45 CFR 164.312 expects are data integrity controls, audit controls, unique user identification, authentication, and encryption and decryption. The same section requires an emergency access procedure, defining how clinicians reach patient data when the primary access path fails.

Physical safeguards govern in-person contact with the equipment holding ePHI: controlled access to the building and the cabinet, data center physical security, and disposal. A failed drive tests this, because 45 CFR 164.310(d) requires a documented procedure for how it leaves the building and how the ePHI on it is destroyed first.

5 – Limit Access to Applications and Data

Robust access controls on healthcare applications and patient data improve security more reliably than most other single measures. Limit patient record access to the employees who need it, which is the Privacy Rule’s minimum necessary standard at 45 CFR 164.502(b) applied to a schema. Patient portals add a second population of accounts, so the same logic covers patients reaching their own records.

In database terms, that means named accounts instead of a shared application login, role-based access controls granting read or write per table or per view, and no direct production data access for developers. Put multi-factor authentication in front of the administrative path, so an attacker holding a valid password still cannot reach the data.

Write the access controls down as well as configuring them. An auditor will ask which authorized users can manage patient data, who approved each one, and how fast access is removed when somebody changes role. Controlled access is easy to evidence when the grant list and the approval trail sit together.

6 – Set Up Data Usage Controls

Data usage controls extend data protection past monitoring access to blocking malicious activity as it emerges. They stop the actions that move sensitive data out of the environment: printing, copying files onto external drives, unauthorized email, and uploads to third-party services.

None of that works until you know where the ePHI is. Use data discovery and classification to tag the columns and tables holding patient data, then attach secure data-handling rules to the tags. Classification also marks the operational data that can stay outside the strictest rules. This is the step teams skip, and it is why an export blocker so often misses the reporting replica.

7 – Encrypt Your Databases

Encrypting ePHI converts the data into an encoded form readable only with a decryption key. Every covered entity must protect data it creates, receives, maintains, or transmits, and encryption is the standard way to do it.

HHS ties encryption to breach reporting. Its guidance on rendering unsecured PHI unusable treats healthcare data at rest as protected when encrypted to NIST SP 800-111, and data in motion when encrypted to NIST SP 800-52, 800-77, or 800-113, or another FIPS 140-2 validated method. Encrypted data lost or stolen with the encryption keys held separately does not carry the same notification obligations as plaintext. Those encryption requirements cover backups and replicas too, and a nightly dump written to an unencrypted volume undoes the rest of the work.

Microsoft SQL Server offers Transparent Data Encryption, Always Encrypted, row-level security, and data masking. MySQL encrypts InnoDB tablespaces through a keyring plugin. PostgreSQL handles column-level encryption through pgcrypto, with full-volume encryption at the storage layer, which on Atlantic.Net block storage means LUKS. Enable Transport Layer Security (TLS) 1.2 or higher on the client connection, because encryption of data at rest does nothing for sensitive information traveling in the clear. Map the encryption requirements to the edition you are licensing, because the feature set differs by edition and release.

8 – Monitor Use of the Database and Create Logs

Comprehensive audit logging in a HIPAA-compliant database records every access to ePHI: the accounts, devices, times, applications, and specific records involved. During an audit, those logs support compliance by showing that access review is happening. After a security event, they let you find the point of entry and scope the damage.

45 CFR 164.312(b) makes this a named requirement, mandating audit controls that record and examine activity in systems holding ePHI, and 164.308(a)(1)(ii)(D) requires regular review of those records, naming audit logs, access reports, and security incident tracking reports explicitly. Database-native tooling produces most of these audit logs: SQL Server Audit, the pgAudit extension for PostgreSQL, and the MySQL Enterprise Audit plugin. Most healthcare organizations ship the output to a separate collector the database administrator cannot edit, which also stops a busy database filling its own disk. Check your HIPAA log retention requirements before setting rotation.

9 –  Decide Whether You Want to Use an Outside Party

You can use your own data center or a hosting service, cloud or otherwise, to run your HIPAA-compliant database. Meeting HIPAA compliance standards is easier on compliant infrastructure built for the purpose by a provider that does this work continuously. Every vendor with a path to sensitive patient information needs to be under contract, so your business associate agreements have to cover the host, the backup provider, and any managed service in the chain. Healthcare organizations running their own data center underestimate the physical side, forgetting that a stolen drive or an unescorted visitor produces the same reportable breach.

Managed Database Services and the Shared-Responsibility Line

Many healthcare organizations now reach for a managed database service instead of installing an engine themselves. Managed MySQL, managed PostgreSQL, and database-as-a-service offerings take patching, replication, and backup scheduling off your plate, a genuine operational efficiency gain for a small team. Compared with traditional databases you install and patch yourself, you trade host-level control for that. Amazon RDS is HIPAA-eligible for its SQL Server, MySQL, Oracle, PostgreSQL, Db2, and MariaDB engines, with Aurora and DynamoDB on the same list.

AWS states that eligibility is subject to the shared responsibility model and that customers must still configure the services consistently with HIPAA requirements, with a BAA executed before any ePHI lands on the platform. HHS is blunter: a cloud service provider that creates, receives, maintains, or transmits ePHI is a business associate, and that holds “even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data.” A managed database provider secures the platform underneath, and that work does support HIPAA compliance, but it ends at the boundary of what the provider controls. Your schema design, your access controls, your audit logs, and your key management stay yours. Collect the business associate agreements for every layer of the stack, because a missing one is a finding on its own.

10 – Choose a Partner With Niche HIPAA Experience

Hosting plans vary widely in how much HIPAA experience sits behind them. Plenty of providers list features that support HIPAA compliance without holding an audit that covers them, so ask what the provider’s audit actually covers, and ask to see it. Ask too how they handle business associate agreements for each service you plan to use, and whether their own risk assessments are current.

Healthcare has been one of Atlantic.Net’s primary focuses for years. HIPAA-compliant database hosting from Atlantic.Net runs in a secure environment: SOC 2 Type II and SOC 3 Type II audited, SSAE 18 attested, HIPAA and HITECH audited data centers, with a legally binding BAA included as standard. Fortress HIPAA plans start at 6 vCPU, 16 GB RAM, 200 GB SSD, and 10 TB of transfer, and include a managed FortiGate firewall, encrypted onsite and offsite daily backups, managed VPN access, multi-factor authentication, intrusion detection and prevention, bi-weekly vulnerability scanning, and a log management system that keeps audit logs traceable. Four hours of migration service are included, with additional hours at $160 per hour. Supported engines include MySQL, PostgreSQL, MongoDB, Redis, and SQL Server.

 

HIPAA Database Checklist

 

Frequently Asked Questions

What Audit Logging and Monitoring Capabilities Are Needed in a HIPAA Hosting Environment?

You need audit controls that record and examine every access to ePHI, plus the documented review process you can show an auditor. 45 CFR 164.312(b) mandates the recording mechanism and 164.308(a)(1)(ii)(D) mandates the review. That means database audit logs (SQL Server Audit, pgAudit, MySQL Enterprise Audit), authentication logs, and firewall alerts, stored where the people being audited cannot modify them. HIPAA sets no explicit retention period, so healthcare organizations align the logs with the six-year documentation retention rule. Atlantic.Net HIPAA plans include log management with audit traceability and 24/7 SOC monitoring.

What Encryption Standards Are Required or Recommended for HIPAA-Compliant Hosting?

The HIPAA Security Rule classifies encryption as addressable, meaning you implement it or document a reasonable alternative that achieves the same purpose. In practice, encrypt. HHS guidance points to NIST SP 800-111 at rest and NIST SP 800-52, 800-77, or 800-113 in motion, or any FIPS 140-2 validated method. AES-256 and TLS 1.2 or 1.3 are the working norms. Encrypt database files, backups, and replication traffic at rest and in transit, and store encryption keys separately in a managed key service or hardware security modules.

How Does Access Control Management Support HIPAA Compliance?

Access controls support compliance by turning the Privacy Rule’s minimum necessary standard into something enforceable. 45 CFR 164.312(a) requires unique user identification, an emergency access procedure, and technical policies allowing only authorized persons or software to access ePHI; 164.312(d) requires you to verify a user is who they claim to be. Role-based access controls do the day-to-day work: a billing clerk sees the billing tables, a clinician sees the clinical record, and nobody uses a shared account. Multi-factor authentication, prompt de-provisioning, and periodic review of those access controls complete the picture.

How Does Disaster Recovery Planning Relate to HIPAA Hosting Requirements?

Disaster recovery is a required part of HIPAA compliance. The contingency plan standard at 45 CFR 164.308(a)(7) makes a data backup plan, a disaster recovery plan, and an emergency mode operation plan all required implementation specifications for a database that means retrievable exact copies of ePHI, a rehearsed restore procedure, and a way to keep critical processes running while the primary environment is offline. Atlantic.Net includes encrypted daily backups on HIPAA plans and offers replication-based DR hosting for tighter recovery objectives.

How to Choose HIPAA Hosting for EMR or EHR Systems?

Start with what your EMR or EHR vendor supports, because the application dictates the operating system, database engine, and often the exact version. Patient portals attached to the EHR belong in the same scope. Then check that the provider signs a BAA covering every service the system touches, that the audit scope is inspectable, and that performance matches your clinician count and reporting load. Where several applications manage patient data on one server, confirm a single agreement covers all of them. Atlantic.Net publishes guidance on HIPAA hosting for EMR and EHR systems.

How Does Physical Data Center Security Factor Into HIPAA Compliance?

Physical security is one of the three categories of security safeguards in HIPAA, so a HHIPAA-compliantdata center is a prerequisite. 45 CFR 164.310 requires facility access controls, workstation security policies, and device and media controls governing how hardware carrying ePHI enters and leaves the building in an audited facility, which means biometric and card-based entry, a man-trap vestibule, closed-circuit television, escorted visitor access, and documented drive destruction. Healthcare organizations running their own server room need the same controls and the same evidence. Atlantic.Net operates HIPAA data centers across eight regions, tested during the annual independent audit.

Put Your HIPAA-Compliant Database on Audited Infrastructure

Atlantic.Net builds and operates the platform underneath databases for healthcare organizations, so your healthcare teams can concentrate on the schema, the application, and the access model. If you have a database that will hold protected health information (PHI) and you want the encryption, access controls, audit logging, and backup posture reviewed before it goes live, contact the Atlantic.Net solutions team. We will walk through your database engine and version, where the shared-responsibility line falls, and what our audit reports cover.

Read More About HIPAA IT Compliance