Updated: July 22, 2026

HIPAA cloud hosting meets the HIPAA Security Rule and Privacy Rule requirements for storing, processing, and transmitting electronic Protected Health Information (ePHI), backed by a signed HIPAA Business Associate Agreement (BAA) between the healthcare organization and the cloud service provider. Both halves of that sentence carry weight. The technical half covers encryption, access controls, audit logging, backup and recovery, and the physical security of the building where the hardware sits. The contractual half is the BAA, which makes the provider directly liable under the HIPAA Rules for the part of the environment it operates. A cloud platform with strong security and no BAA is not a HIPAA cloud, and neither is a signed BAA over an environment with no encryption at rest. The term describes a way of operating infrastructure, so it applies to public, private, and hybrid deployments alike.

The U.S. Department of Health and Human Services (HHS) is explicit on this in its cloud computing guidance: “A covered entity or business associate may use cloud-based services of any configuration (public, hybrid, private, etc.), provided it enters into a BAA with the CSP.” One caveat belongs at the top. No hosting provider can make an organization HIPAA-compliant on its own. A HIPAA-compliant cloud provider delivers an audited platform, signs the BAA, and operates the infrastructure controls. The covered entity still owns its risk analysis, workforce training, and application-level permissions. Most HIPAA enforcement actions turn on that second list.

What Is HIPAA-Compliant Cloud Computing?

HIPAA-compliant cloud computing runs healthcare workloads on shared, virtualized infrastructure under the same safeguards HIPAA would demand of an on-premises server room. The regulation sets out what has to be achieved and leaves the technical means open. It requires access controls, audit controls, integrity controls, transmission security, and a documented risk analysis. It does not name a firewall vendor or a cipher suite. That flexibility is why two providers can both offer HIPAA cloud services and mean different things. One has commissioned an independent audit against HIPAA AT-C 105/205, SOC 2 Type II, and SOC 3 Type II, and can produce the reports. The other has read the HIPAA Security Rule and written a policy document. Both claims are legal. Only one is verifiable.

Who Needs HIPAA Cloud Computing?

Covered entities are healthcare providers, health plans, and clearinghouses. Business associates handle ePHI on their behalf, which now covers most healthcare software companies: telehealth platforms, medical billing processors, EHR vendors, medical SaaS products, and biotech research teams. Covered entities and business associates both need HIPAA cloud hosting the moment healthcare data touches infrastructure they do not physically control. That catches organizations assuming they are out of scope, because a scheduling tool storing patient names alongside appointment reasons is handling ePHI. Business associates are where the boundary surprises people, since the definition follows the data and not the job title.

HIPAA Cloud Requirements Checklist

The table below covers what a HIPAA cloud environment has to include and, more usefully, who owns each piece. The right-hand column is where compliance projects go wrong.

Requirement What It Covers Who Typically Owns It
Signed BAA HIPAA duties allocated between the covered entity and cloud service provider Provider offers; customer executes
Encryption at rest AES-256 encryption on volumes, snapshots, and backups Provider
Encryption in transit TLS 1.2 or 1.3 for ePHI in motion, plus VPN for administrative access Shared
Access controls Unique user IDs, role-based permissions, and automatic logoff Provider at the infrastructure layer; customer at the application layer
Multi-factor authentication MFA on administrative and remote access paths Shared
Audit logging Retained access and administrative action records with traceability Shared
Risk analysis Documented assessment under 45 CFR § 164.308(a)(1)(ii)(A) Customer
Backup and disaster recovery On-site and off-site encrypted copies, with tested restore procedures Provider
Breach notification Reporting breaches of unsecured PHI under 45 CFR § 164.410 Provider notifies the customer; customer notifies individuals and HHS
Physical safeguards Facility access control, environmental protection, and media disposal Provider
Workforce policies and training Sanctions, authorization, and termination workflows Customer

A provider can take eight of those eleven rows. The other three stay with the covered entity, whichever cloud it picks. Providers that publish their own version of this split, mapping each of the HIPAA requirements to a named owner, make the customer’s risk analysis a great deal shorter.

The HIPAA Privacy Rule, Security Rule, and Breach Notification Rule

HIPAA compliance rests on several rules working together. The HIPAA Privacy Rule governs how protected health information (PHI) may be used and disclosed. The HIPAA Security Rule sets the administrative, physical, and technical safeguards for ePHI. The Breach Notification Rule defines what has to be reported, to whom, and how quickly. The HITECH Act extended enforcement to business associates directly and raised the penalty tiers, which reach into the millions per violation category per year. Named OCR settlements give the range: $100,000 against Phoenix Cardiac Surgery, $2.7 million against Oregon Health & Science University. One point worth watching through 2026. HHS published a Notice of Proposed Rulemaking on January 6, 2025, that would make encryption of ePHI at rest and in transit a required specification, removing today’s “addressable” flexibility. It remains proposed, and HHS has moved the amendments to the long-term section of its regulatory agenda with final action projected for July 2027. Encryption is still addressable, which has always meant “do it, or document a defensible reason why not.”

Public or Private Cloud for HIPAA Compliance?

Both work. HHS permits any configuration provided a BAA is in place, so the choice changes the risk analysis and not the legality. Public cloud puts ePHI on shared, multi-tenant hardware with logical isolation between customers, and it provisions faster and costs less at small scale. Private cloud gives a single-tenant environment on dedicated hosts, which shortens the risk analysis because the tenancy question disappears. Hybrid deployments keep an EHR database on private infrastructure and run a patient-facing web tier in public cloud. Atlantic.Net’s HIPAA-Compliant Cloud Hosting is engineered for HIPAA in either configuration, including private dedicated hosts for customers whose auditor pushes them that way.

What a BAA Actually Does

The BAA converts a hosting relationship into a HIPAA one. It names the permitted uses and disclosures of protected health information (PHI), requires the business associate to apply the Security Rule safeguards, obliges it to report breaches and security incidents, flows the same duties down to subcontractors, and sets out what happens to the data when the contract ends. HHS takes an expansive view of who needs one. A cloud service provider storing only encrypted ePHI and holding no decryption key is still a business associate, because lacking an encryption key “does not exempt a CSP from business associate status and obligations under the HIPAA Rules.” The industry calls this a no-view service. It reduces what the provider can see. It does not reduce what the provider is liable for. Under HITECH, business associates carry the Security Rule duties directly, so a hosting provider answers to OCR for its own safeguards as well as to the covered entities it serves. Atlantic.Net includes a legally binding BAA as standard with every HIPAA hosting plan, across Linux and Windows and across the Fortress Developer, Business, DR, and Custom tiers.

HIPAA-Compliant Cloud Storage as Part of a HIPAA Cloud

Compute attracts most of the attention in a HIPAA project, but most protected health information (PHI) in a cloud environment is sitting still, in database files, object stores, snapshots, log archives, and backup sets. HIPAA-compliant cloud storage has to satisfy the same HIPAA requirements as the instance reading from it. When it fails, it fails for dull reasons: a bucket left open, a snapshot copied into an unencrypted region, a backup product with no BAA behind it. Secure cloud storage starts from the assumption that every object holding ePHI is one misconfiguration away from the wrong person. Three storage layers appear in almost every healthcare deployment.

  • Block storage. The volumes attached to instances, holding databases and application state. Encrypted at rest, snapshotted on a schedule, and governed by access controls at the hypervisor and inside the guest operating system.
  • Object storage. Where imaging studies, exported reports, and document archives land. Secure cloud storage at this layer means private by default, authenticated access only, and audit logs covering every read, write, and permission change.
  • Backup and archive storage. Encrypted onsite and offsite copies of the first two, with their own key material and a restore that has actually been tested.

The BAA has to reach all three. A cloud service provider that signs a BAA for compute while excluding its cloud storage product leaves ePHI outside the agreement, and HHS treats storage providers as business associates for the data they hold. Business associates cannot narrow the HIPAA Rules by narrowing a contract. Hyperscalers handle this by publishing a covered-services list. Google Cloud signs a BAA and names the products it covers, Cloud Storage among them, while stating that “the customer is responsible for ensuring that the environment and applications that they build on top of Google Cloud are properly configured and secured according to HIPAA requirements.” Google Cloud secures the platform, and covered entities configure identity, encryption, and audit logs correctly on top of it. Enabling a service outside that list, or writing PHI into object metadata or build logs, moves data beyond the BAA with no warning.

Retention, Disposal, and Audit Trails for Stored ePHI

Retention is two questions. HIPAA requires policies, procedures, and required documentation to be kept for six years from creation or last effective date under 45 CFR § 164.316(b)(2)(i). How long the medical records themselves have to be kept is state law, commonly six to ten years, and that is the clock that drives cloud storage capacity planning. Disposal is where cloud storage differs from a filing cabinet. The device and media controls standard at 45 CFR § 164.310(d)(2)(i) requires a documented method for disposing of ePHI and the media holding it. In cloud storage that means knowing what happens when a volume is destroyed, whether snapshots and replicas go with it, and how the cloud service provider retires failed disks. Encrypting at rest and destroying the key is the workable answer, because ciphertext nobody can read is not unsecured PHI. Audit trails tie the layers together. Storage audit logs should record who touched which object, when, from where, and what changed. Auditors ask for a year of operating evidence, so audit trails that roll off after 30 days answer a question nobody asked. On Atlantic.Net, HIPAA-compliant cloud storage sits inside the same audited environment as the compute: encrypted volumes, Veeam-managed onsite and offsite backups replicated across regions, geographic redundancy, and data mirroring, all under the same BAA that covers the servers. Secure cloud storage is as much a configuration outcome as a product choice, so data security here is a review discipline: check bucket permissions, volume encryption settings, and retention periods before each annual audit and not during it.

Encryption Standards for HIPAA-Compliant Cloud Storage

Data at rest should be encrypted with AES-256. Data in transit should move over TLS 1.2 or 1.3. Backups need their own encryption and ideally their own key material, so a compromise of the production keys does not hand over the archive as well. The underlying detail matters more than the headline number. HIPAA-compliant cloud storage on Atlantic.Net uses LUKS with the aes-xts-plain64 cipher mode and a 512-bit key split into two 256-bit halves, one for the cipher and one for the XTS tweak. That is an AES-256 deployment described accurately, which is easier to verify than a claim about bank-grade encryption. Key management is the part that breaks at scale. Atlantic.Net rotates the key-encryption key every three months, retains former KEK sets for decryption while only the active set encrypts, governs access to each key through a control list restricted to authenticated users and services, and logs every request. Three-month rotation is an operational standard, not a HIPAA requirement. The Security Rule says nothing about intervals, only that safeguards be reasonable and appropriate.

Data Security and Access Controls for HIPAA Compliance

The security layer on Atlantic.Net HIPAA web hosting starts with a fully managed FortiGate firewall and an intrusion prevention service. The IPS matches live traffic against a continually revised threat database and blocks known attack signatures, while the firewall controls the perimeter. Atlantic.Net engineers own the monitoring, tuning, and patching of both, which removes a standing source of risk and staff hours from healthcare organizations. Around that sit the data security controls a HIPAA audit asks about directly:

  • Managed encrypted VPN. Five accounts as standard, so administrative traffic to servers holding PHI never crosses the public internet unprotected.
  • Multi-factor authentication and role-based access controls. Unique user identification with least-privilege roles, which is where the Security Rule’s access controls standard lands in practice.
  • Trend Micro Deep Security Suite. Anti-malware, virtual patching, and host intrusion detection on Fortress Business tiers and above.
  • Bi-weekly vulnerability scanning and file integrity monitoring. Scheduled and evidenced, ready when an auditor asks for a year of operating evidence.
  • Detailed access and admin action logging. Audit trails that separate suspecting a breach from being able to characterize one.
  • Onsite and offsite encrypted daily backups. Veeam-managed, replicated across regions, with file-level and full-system restore.

Customers can manage their own host servers or hand that to Atlantic.Net engineers. Either way the firewall, IPS, and network layer stay managed, so the data security and access controls at the infrastructure layer sit with the same team whichever option a customer picks. That keeps the shared-responsibility line short to explain to an auditor.

HIPAA-Compliant, Access-Controlled Hosting and Physical Security

Storing files in a HIPAA-compliant manner means showing how the environment satisfies each safeguard. Atlantic.Net’s infrastructure is independently audited for HIPAA and HITECH and holds SOC 2 Type II, SOC 3 Type II, and SSAE 18 attestations from a third-party CPA firm. Physical safeguards are the ones customers see least and auditors check hardest. In the Orlando data center that includes biometric palm scanners and proximity card readers at access points, a man-trap entry vestibule, closed-circuit television with 24-hour recording and 30-day retention, and VESDA air-sampling fire detection. No document review confirms that a palm scanner works. Someone has to stand in front of it. The Service Level Agreement carries compliance weight of its own. HHS guidance points to the SLA for backup and disaster recovery, availability, limitations on use and disclosure, data return at contract end, and adherence to the Security Rule safeguards.

Benefits of HIPAA Cloud Computing

Healthcare’s move to cloud infrastructure is well past the pilot stage. MarketsandMarkets values the healthcare cloud computing market at USD 74.02 billion in 2026, forecast to reach USD 169.34 billion by 2031 at an 18.0% compound annual growth rate, with North America holding 45.4% of the market in 2026. A worked example shows why. A telehealth platform running a Node.js API, a PostgreSQL database of consultation records, and a Redis session store does not need a rack. It needs one properly sized compliant instance. Atlantic.Net’s Fortress Developer tier provides 6 vCPU, 16 GB RAM, 200 GB SSD, and 10 TB of transfer on a 12-month term at $492.31 per month for Linux, with the BAA, managed firewall, VPN, and backups included. Fortress Business at $644.16 adds IPS and Trend Micro Deep Security Suite. Migration includes four hours of assistance, additional hours at $160 per hour. That is a useful starting point for budgeting, but sizing still needs checking against real workload data. An instance that runs out of memory during a Monday morning appointment rush creates an availability problem no SLA can solve.

Atlantic.Net as a HIPAA Cloud Provider

Atlantic.Net has hosted regulated workloads since 1994 and runs eight data center regions across New York, Ashburn, Orlando, Dallas, San Francisco, Toronto, London, and Singapore. For healthcare customers the platform provides:

  • Audited HIPAA and HITECH compliance. Independent annual audit covering HIPAA AT-C 105/205, SOC 2 Type II, SOC 3 Type II, HITECH, and PCI DSS 4.0, with a BAA standard on every Fortress tier.
  • Fully managed security services and a 100% uptime SLA. The SLA is backed separately across network, hardware replacement, and power and HVAC.
  • US-based 24/7/365 support. Certified engineers, English and Spanish, never outsourced.
  • Recognition for healthcare cloud work. Cyber Defense Magazine named Atlantic.Net a 2026 Global InfoSec Award winner in the Cutting Edge AI Healthcare Compliant Cloud category.

HIPAA-compliant cloud storage sits alongside the compute, covering geographic redundancy, backup and data mirroring, and deduplication.

Frequently Asked Questions

What Does HIPAA Require From a Hosting Provider Handling Protected Health Information?

A hosting provider handling ePHI must sign a BAA and meet the Security Rule safeguards for the infrastructure it operates: encryption at rest and in transit, access controls with unique user identification, audit logging, integrity and transmission controls, physical safeguards at the facility, backup and disaster recovery, and breach reporting to the customer under 45 CFR § 164.410. Under HITECH, business associates are directly liable for those duties, separately from the contract.

What Encryption Standards Are Required or Recommended for HIPAA-Compliant Hosting?

HIPAA does not name a cipher. The accepted standards are AES-256 at rest and TLS 1.2 or 1.3 in transit, aligned with HHS guidance on rendering PHI unusable and unreadable, with backups separately encrypted. Encryption is currently addressable, so an organization may document an equivalent alternative, though the January 2025 proposed Security Rule update would make it required.

What Is the Difference Between HIPAA-Eligible Hosting and Fully HIPAA-Compliant Hosting?

HIPAA-eligible means the service can be used for ePHI if the customer configures it correctly and signs a BAA, which leaves the compliance work with the customer. Hyperscalers such as Google Cloud publish a list of HIPAA-eligible services, compute and cloud storage among them, that the customer must then assemble and secure. A fully HIPAA-compliant hosting environment arrives with the safeguards built and audited, operated by the provider. No hosting can be HIPAA-compliant: no such certification exists.

What Is a BAA and Why Is It Required for HIPAA Hosting?

A BAA is a contract between a covered entity and a business associate setting out how PHI may be used and disclosed, requiring Security Rule safeguards, mandating breach reporting, flowing obligations to subcontractors, and governing data return or destruction at termination. It is required because a cloud provider storing or processing ePHI meets the definition of a business associate, and HHS holds that this applies even when the provider stores only encrypted data and holds no decryption key.

Public or Private Cloud for HIPAA Compliance?

Either is permitted. HHS guidance allows public, private, or hybrid configurations provided a BAA is executed with the cloud service provider, so the configuration changes the risk analysis and not the legality. Private, single-tenant infrastructure removes multi-tenancy from the assessment. Public cloud provisions faster and costs less. Many covered entities split the two, keeping the primary database private and the web tier public.

How Does Physical Data Center Security Factor Into HIPAA Compliance?

The Security Rule’s physical safeguards apply to the building as well as the software, naming facility access controls, workstation security, and device and media controls. Atlantic.Net’s Orlando facility uses biometric palm scanners, proximity card readers, a man-trap vestibule, CCTV with 30-day retention, and VESDA fire detection, verified on site during the annual audit.

Getting Started With HIPAA Cloud Hosting

Atlantic.Net builds and operates HIPAA cloud environments for covered entities and business associates alike: healthcare providers, medical SaaS companies, telehealth platforms, and biotech research teams, with the BAA, the audited data security controls, and US-based engineering support included from day one. If you are scoping a move of ePHI into the cloud and want a clear picture of which safeguards Atlantic.Net operates and which stay with your team, contact us to review your application stack, your compliance requirements, and where the shared-responsibility line falls.

Read More About HIPAA Compliance