Search this site
HIPAA website guide

HIPAA-compliant web hosting · host pages read November 7, 2026

HIPAA-compliant web hosting: which hosts sign a BAA.

HHS certifies no host as HIPAA compliant. It requires a business associate agreement with a host that creates, receives, maintains or transmits ePHI for a practice HIPAA covers. Of 15 hosts read on November 7, 2026, 11 offer one, some only on an enterprise plan or a paid add-on; Pantheon publishes one but bars patient data; WP Engine, Kinsta and Bluehost say no.

Call (908) 249-0016See the host table

Every row quotes the host's own terms, help page or pricing page as it read on November 7, 2026, with a link. The call is with LA Digital Systems about building a practice website; please do not share patient information on it. General information, not legal advice.

A long data center corridor lined with black server cabinets, with a monitor on a rolling cart at the far end.
Illustrative photo · Brett Sayles on Pexels (Pexels License)

The first question

Does your practice website need a host that signs at all?

HHS ties business associate status to what the host does with ePHI: a cloud provider that creates, receives, maintains, or transmits ePHI for a covered practice is a business associate, "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data." So the answer depends on which of these three sites you have, or are about to build.

Brochure site, patient tools elsewhere

Pages about the practice, providers and services. The booking button and any patient form open on a vendor that signs its own agreement, and the site's own database keeps nothing a patient typed.

The host: The host may never hold PHI. HHS's business associate test is whether the host creates, receives, maintains or transmits PHI for the practice, so what matters is that nothing on the site quietly stores or forwards patient details.

Check: Contact forms that email or save submissions, chat widgets, and analytics or ad tags on pages a patient uses to book or log in.

Site that stores what patients send

A WordPress or Drupal form saves submissions in the site's database, the media library holds uploads, or a plugin keeps appointment requests.

The host: The host maintains ePHI, so HHS treats it as a business associate, and the practice and host "must enter into" a BAA. Hosts that sign limit the agreement to named plans or services, so the site has to run on those.

Check: The database, the media library, the backups and any staging copy: each is a copy of the same patient data.

Portal or application

Patients log in, see records, message staff or pay a balance on pages the practice runs itself.

The host: Every part that holds ePHI (host, database, file storage, and any logs or backups that contain it) has to run on services the agreement covers. AWS, Google Cloud and DigitalOcean each say so for their own lists.

Check: The eligible-services list of the cloud provider, and who configures access controls and logging on each piece.

  1. Patient's browsertypes into a form or booking page
  2. Proxy or CDNa vendor if it sits in front
  3. Web hosta business associate once it stores ePHI
  4. Database and backupssame data, more copies
  5. Email, form tool, schedulereach signs, or each stays off the path

Which page types on a practice site can carry protected health information, and which third-party scripts can see them, is set out in the page-type table of the HIPAA-compliant website guide. Which of the three a site becomes is settled when its routes are planned; the eight routes a practice site needs are listed on the medical and healthcare website design page.

HHS: Guidance on HIPAA and cloud computing (read November 7, 2026)

Host by host

Which web hosts sign a business associate agreement, on which plan.

Three hosts that sell HIPAA hosting plans and an enterprise Drupal platform, four cloud platforms, three front-end and edge platforms, and four WordPress and Drupal hosts. The last column is what each host itself says to watch.

Web hosts, whether each offers a business associate agreement, the plan or route it needs, and what the host says to watch
HostAgreement offered?Plan or routeWhat the host says to watch
HIPAA VaultYes. The agreement is part of its HIPAA plans.HIPAA WordPress hosting is listed at "$120/mo (first month free !)"; the general hosting page says "HIPAA Compliant Web Hosting as low as $309/mo"; Linux $349/mo and Windows $749/mo.The WordPress plan comparison lists "Business Associate Agreement" as a row. Its own guidance: any vendor that can access, store, or transmit PHI "requires a signed BAA before you go live."
Atlantic.NetYes. Its published Linux and Windows HIPAA plans each list a "Business Associates Agreement."The lowest published price is the HIPAA Developer Linux Managed Cloud Server: $605.11 a month on a 12-month term, $558.52 on 24 months and $514.34 on 36 months. The Windows version starts at $664.36 on 12 months.The plans are managed servers with a FortiGate firewall, daily backups and bi-weekly vulnerability scans listed per plan. The term length changes the price, and a one-time $150.00 setup fee configures the firewall.
Liquid WebYes, on its HIPAA-ready environments: "We provide signed Business Associate Agreements (BAAs) for all HIPAA-ready hosting environments."Dedicated server HIPAA solutions "starting at $229/mo (Linux) and $271/mo (Windows)," billed monthly.Only the HIPAA-ready environments are covered, and its page says "Select Liquid Web data centers are equipped with the necessary physical and environmental safeguards required by HIPAA."
Acquia (Drupal)Yes, through its HIPAA offering: "Customers with this offering must sign a BAA through Acquia to meet the HIPAA requirements."Cloud Platform Enterprise and Site Factory customers "should contact their Account Manager." No public price.The HIPAA offering is a separate setup: a "Shared HIPAA Environment" logically separated from non-HIPAA customers, with encrypted EBS volumes.
Amazon Web ServicesYes. The agreement is accepted per account in AWS Artifact.Any account, but only for services on AWS's HIPAA Eligible Services list (last updated October 15, 2026), which includes Amazon EC2, Amazon S3, Amazon RDS, AWS Elastic Beanstalk, AWS Amplify Console and Amazon CloudFront (with an exclusion)."Customers still must configure these services consistent with HIPAA requirements." Amazon Lightsail is not on the eligible list as read.
Microsoft AzureYes, by default. "There is no separate contract to sign"; the BAA comes through the Microsoft Product Terms.Every customer that is a covered entity or business associate, for the Azure services Microsoft lists as in scope.Only in-scope services are covered; Microsoft points to its "Cloud services in audit scope" list.
Google CloudYes. "Google enters into Business Associate Agreements as necessary under HIPAA."The agreement is reviewed and accepted through Google Cloud's privacy compliance and records settings. It covers Google Cloud's infrastructure and a list of products (supported-services list last updated September 17, 2025) that includes Compute Engine, Cloud Run, Cloud Storage, Cloud SQL and Cloud CDN."Disable unsupported Google Cloud services when working with PHI. If you can't disable a service, you must not use it for PHI." Firebase is not named on the covered-products list as read.
DigitalOceanYes, on request: "We offer a Business Associate Agreement"; new customers ask Sales, existing customers ask Support.PHI may go only on its HIPAA Eligible products: Droplets, GPU Droplets, Kubernetes, Spaces Object Storage, Volumes Block Storage, Load Balancers, Firewalls, VPC, backups and snapshots, Container Registry and others on the list."Customers are responsible for uploading ePHI exclusively to the following DigitalOcean's HIPAA Eligible products." App Platform and Managed Databases are not on that list as read.
VercelYes on paid plans: Vercel commits to "Signing Business Associate Agreements (BAAs) with eligible Pro and Enterprise customers."Pro: a HIPAA BAA add-on listed at $350 a month on the pricing page, bought in the team's Billing settings. Enterprise: custom, by request. The Hobby plan has none."Customers subject to HIPAA may enable Vercel Secure Compute (available on Enterprise plans) for additional layers of protection."
NetlifyEnterprise only: "enterprise customers handling PHI can now execute a Business Associates Agreement (BAA) with Netlify."Enterprise, through Netlify's sales and solution engineering teams. Its Trust Center lists a "BAA for Business Associates" document.The offering was announced on August 15, 2024 for enterprise customers; the announcement names no route for smaller plans.
CloudflareEnterprise only: "Cloudflare will only enter into business associate agreements (BAAs) with its enterprise customers."Enterprise. Plans below Enterprise have no agreement.When Cloudflare sits in front of the host as a proxy and cache, it is a second vendor on the same path, even if the host signs.
Pantheon (WordPress and Drupal)An agreement is published, but it says patient data is not allowed on the service.Pantheon's Business Associate Agreement in its legal center states the services "do not involve the management, creation, modification or storage of Protected Health Information ... which is expressly prohibited by the Services Agreement."The agreement covers only what Pantheon might touch "unknowingly"; it is not a route to storing PHI on the platform.
WP EngineNo. Its Acceptable Use Policy forbids storing or processing PHI.None. The policy applies to all its services."You are not permitted to use or cause the Services to store or process sensitive or otherwise regulated health or financial information, including Protected Health Information."
KinstaNo. "Kinsta does not offer a HIPAA-compliant hosting product, and we do not enter into Business Associate Agreements (BAAs) with our customers."None."You should not store or transmit protected health information (PHI) on Kinsta."
BluehostNo. "Bluehost does not sign 'Business Associate Agreements.'"None. "The Services do not comply with the U.S. Health Insurance Portability and Accountability Act.""Storing and permitting access to 'Protected Health Information,' is a material violation of this Agreement, and grounds for immediate account termination."

Every row was read on November 7, 2026 on the host's own page; the sources are linked in the cards below. Wix, Squarespace, WordPress.com, Webflow, Duda and GoDaddy host the sites they build, and what each says about agreements is quoted in Is Wix, Squarespace or WordPress HIPAA compliant?

What each agreement reaches

The same 15 hosts, with each host's own words on where the agreement stops.

A signed agreement covers a plan, a set of services and sometimes a region. Each host also says what it leaves to the practice, and three of them say no in writing.

Rows of black mesh server cabinets with red and blue network cables visible through the open front door of the nearest rack.
Illustrative photo · Brett Sayles on Pexels (Pexels License). An agreement names services, not buildings: the same rack can run covered and uncovered products.

HIPAA Vault

Host with HIPAA plans

Agreement: Yes. The agreement is part of its HIPAA plans.

HIPAA Vault sells fully managed Linux, Windows and WordPress hosting it describes as "For Healthcare," so the agreement and the server management come together. Two of its pages quote two starting prices: $120 a month on the WordPress page and "as low as $309/mo" on the general hosting page. Ask which plan the agreement is written against and what the monthly price includes before comparing it with anyone else's.

HIPAA Vault: HIPAA compliant WordPress hosting (read November 7, 2026) HIPAA Vault: HIPAA hosting solutions

Atlantic.Net

Host with HIPAA plans

Agreement: Yes. Its published Linux and Windows HIPAA plans each list a "Business Associates Agreement."

Atlantic.Net's page is titled "HIPAA-Compliant Hosting with a BAA," and every Linux and Windows plan in its price list names the agreement alongside the firewall, daily backups and bi-weekly vulnerability scans. Its price notes add a one-time $150.00 setup fee for the FortiGate firewall, and migration beyond four free hours is billed at $160.00 an hour.

Atlantic.Net: HIPAA-compliant hosting with a BAA (read November 7, 2026)

Liquid Web

Host with HIPAA plans

Agreement: Yes, on its HIPAA-ready environments: "We provide signed Business Associate Agreements (BAAs) for all HIPAA-ready hosting environments."

Liquid Web sells HIPAA hosting as a separate line from its regular hosting: a standalone HIPAA server, a server with a firewall, and a multi-server package. Its page ties the agreement to "HIPAA-ready hosting environments," so a practice on another Liquid Web plan should ask in writing whether its environment is one, and which data center the agreement names.

Liquid Web: HIPAA compliant hosting services (read November 7, 2026)

Acquia (Drupal)

Enterprise CMS platform

Agreement: Yes, through its HIPAA offering: "Customers with this offering must sign a BAA through Acquia to meet the HIPAA requirements."

Acquia's compliance page says Cloud Platform "enables customers to comply with the HIPAA Security Rule and HITECH" and that its annual SOC 2 Type 2 audit report contains "a section that maps controls to HIPAA security requirements." Customers whose websites need HIPAA environments are told to contact their Account Manager "to discuss these settings and other infrastructure changes necessary"; the HIPAA offering is its own "Shared HIPAA Environment," so ask which environment the agreement names.

Acquia docs: Compliance with standards and regulations (read November 7, 2026)

Amazon Web Services

Cloud platform

Agreement: Yes. The agreement is accepted per account in AWS Artifact.

AWS says: "To review, accept, and manage the status of the BAA for your account, sign in to AWS Artifact in the AWS Management Console." The eligible list is what the agreement reaches; AWS adds that customers "may use services not listed here, including within HIPAA Accounts, provided that the services do not process or store ePHI." Amazon Lightsail was not on that list on November 7, 2026.

AWS: HIPAA compliance (read November 7, 2026) AWS: HIPAA Eligible Services Reference (updated October 15, 2026)

Microsoft Azure

Cloud platform

Agreement: Yes, by default. "There is no separate contract to sign"; the BAA comes through the Microsoft Product Terms.

Microsoft's Azure HIPAA page: "the HIPAA BAA is available via the Microsoft Product Terms (formerly Online Services Terms) by default to all customers who are covered entities or business associates under HIPAA." It also says there is "currently no certification program approved by the US Department of Health and Human Services (HHS) through which a CSP acting as a business associate could demonstrate compliance with HIPAA and the HITECH Act."

Microsoft Learn: HIPAA, Azure compliance (read November 7, 2026)

Google Cloud

Cloud platform

Agreement: Yes. "Google enters into Business Associate Agreements as necessary under HIPAA."

Google calls HIPAA "a shared responsibility between you and Google" and says it supports compliance "within the scope of a Business Associate Agreement, but ultimately you are responsible for evaluating your own HIPAA compliance." Its guidance also says not to put PHI in metadata such as labels or dashboard titles, because "anyone with the appropriate IAM permissions" can view the monitoring console or API.

Google Cloud: HIPAA compliance on Google Cloud and Google Workspace (read November 7, 2026)

DigitalOcean

Cloud platform

Agreement: Yes, on request: "We offer a Business Associate Agreement"; new customers ask Sales, existing customers ask Support.

DigitalOcean's HIPAA page says an external auditor performs an annual risk assessment against HIPAA, the Security Rule and the HITECH breach notification requirements, and that its features "do not constitute a representation or guarantee of HIPAA adherence." A site built on App Platform with a Managed Database would sit outside the eligible list as it read on November 7, 2026.

DigitalOcean: HIPAA at DigitalOcean (read November 7, 2026)

Vercel

Front-end platform

Agreement: Yes on paid plans: Vercel commits to "Signing Business Associate Agreements (BAAs) with eligible Pro and Enterprise customers."

Vercel's compliance page lists what it commits to as a business associate: safeguards for a customer's PHI, notifying customers of breaches "without undue delay" and signing BAAs with eligible Pro and Enterprise customers. "Pro teams can purchase the HIPAA BAA add-on from their team's Billing settings." The $350 is on top of the Pro plan itself.

Vercel docs: Security and compliance measures (HIPAA) (read November 7, 2026) Vercel pricing (Compliance rows)

Netlify

Front-end platform

Agreement: Enterprise only: "enterprise customers handling PHI can now execute a Business Associates Agreement (BAA) with Netlify."

Netlify's announcement says its HIPAA service offering has "undergone an additional audit" and is "suitable for the transmission and processing of Personal Health Information (PHI)," and that "Netlify is considered a business associate for our healthcare customers." By the announcement's wording, a team below Enterprise is not on that offering.

Netlify: Netlify supports HIPAA compliance (August 15, 2024) (read November 7, 2026) Netlify Trust Center

Cloudflare

CDN and proxy

Agreement: Enterprise only: "Cloudflare will only enter into business associate agreements (BAAs) with its enterprise customers."

Cloudflare's privacy compliance page says its network and processes "are consistent with the security requirements specified by HIPAA" while noting that HHS "does not recognize a certification for HIPAA compliance." HHS limits the conduit exception to transmission-only services with no more than temporary storage incident to the transmission; whether a proxy in front of a patient form fits that is a question to settle with counsel, not to assume.

Cloudflare Trust Hub: U.S. privacy compliance (read November 7, 2026) HHS: Guidance on HIPAA and cloud computing, question 3

Pantheon (WordPress and Drupal)

Enterprise CMS platform

Agreement: An agreement is published, but it says patient data is not allowed on the service.

This is the case where "they have a BAA" misleads. Pantheon's agreement exists for the incidental case: "to the extent Company may unknowingly perform or assist in performing a function or activity on behalf of Customer that involves the access to and/or use of Protected Health Information." The same document says storing PHI is prohibited by the services agreement. Treat Pantheon as a host for sites that keep PHI elsewhere.

Pantheon Legal Center: Business Associate Agreement (PDF) (read November 7, 2026)

WP Engine

Managed WordPress host

Agreement: No. Its Acceptable Use Policy forbids storing or processing PHI.

WP Engine's policy puts the risk on the customer: "You acknowledge and agree that we are not responsible for any liabilities arising from your violation of this restriction." So any form submission, upload or booking that carries PHI has to stay out of a WP Engine site and go to a vendor that signs a business associate agreement.

WP Engine: Acceptable Use Policy (read November 7, 2026)

Kinsta

Managed WordPress host

Agreement: No. "Kinsta does not offer a HIPAA-compliant hosting product, and we do not enter into Business Associate Agreements (BAAs) with our customers."

Kinsta notes that its SOC 2 Type 2 report "includes an examination of our controls against the HIPAA Security Rule safeguards." An audit report is not an agreement. HHS says a cloud provider that maintains ePHI for a covered entity is a business associate and the two "must enter into" a BAA, and Kinsta says it will not sign one.

Kinsta docs: Technical FAQ (HIPAA) (read November 7, 2026)

Bluehost

Shared web host

Agreement: No. "Bluehost does not sign 'Business Associate Agreements.'"

Bluehost's User Agreement, section 3, also says subscribers "requiring secure storage of 'Protected Health Information' as defined under HIPAA are expressly prohibited from using the Service for such purposes." Under those terms, a practice site on Bluehost that stores PHI breaks the agreement, which Bluehost calls grounds for immediate account termination.

Bluehost: User Agreement, section 3, HIPAA Disclaimer (read November 7, 2026)

Before you sign

Seven questions to settle with a host before patient data touches it.

HHS's cloud computing guidance lists service level agreement provisions that "may be relevant to HIPAA compliance" and what a business associate agreement must require. These are those points, asked as questions.

  1. 01

    Will you sign a BAA for the plan and the services we will run on?

    An agreement that covers a cloud provider's eligible services does not cover the ones that are not on the list. Name the plan, the products and the region in writing.

  2. 02

    What uptime and recovery do you commit to?

    HHS lists "System availability and reliability" and "Back-up and data recovery (e.g., as necessary to be able to respond to a ransomware attack or other emergency situation)" among the provisions a service level agreement can include that "may be relevant to HIPAA compliance."

  3. 03

    How do we get our data back when we leave?

    HHS lists the "Manner in which data will be returned to the customer after service use termination" and says a BAA must require the business associate to return or destroy all PHI at termination where feasible. If that is not feasible, the BAA must extend its protections to the data that stays.

  4. 04

    Which security controls are yours, and which are ours?

    HHS says the provider and the customer "should each confirm in writing, in either the BAA or other documents, how each party will address the Security Rule requirements."

  5. 05

    How and when will you report a security incident?

    HHS says a BAA must require the business associate to report security incidents it becomes aware of, and the agreement can set the detail, frequency and format of those reports.

  6. 06

    Where will the data be stored?

    HHS allows servers outside the United States with a BAA in place, but notes the risks "may vary greatly depending on its geographic location" and belong in the practice's risk analysis.

  7. 07

    Who else touches the data on your side?

    A host's subcontractors that create, receive, maintain or transmit the data are business associates too, by HHS's definition. Ask which ones the host uses for backups, support and monitoring.

HHS on going without one: a practice that uses a cloud provider to store ePHI without first signing a business associate agreement "is in violation of the HIPAA Rules," and OCR has settled with a covered entity that stored the ePHI of over 3,000 individuals on a cloud server without one.

HHS: Guidance on HIPAA and cloud computing, questions 1, 5, 6, 8 and 9

The rest of the site

Six things a host's agreement does not cover on a practice website.

A host signs for the servers and services it runs. A practice website can involve more vendors than the host, and each one that stores or sees patient data needs its own answer.

  • The proxy or CDN in front of the host

    Cloudflare signs only for enterprise customers. A covered host behind an uncovered proxy still sends every request through a second vendor.

  • The form tool, scheduler and chat

    Each is its own vendor with its own agreement, or none. The scheduler side is covered tool by tool in the HIPAA-compliant scheduling software guide.

  • Email notifications from the site

    A form that emails each submission to the front desk puts the submission in the email provider's systems as well as on the host.

  • Analytics and ad tags

    Scripts the site loads from other companies run on those companies' services, which a host's agreement does not name. Which page types those scripts can see is laid out in the HIPAA-compliant website guide.

  • Backups and staging copies kept elsewhere

    A backup plugin that copies the database to an outside storage account moves the same data to a vendor the host's agreement does not name.

  • The people who build and maintain the site

    HHS defines a business associate by the work: services to a practice that involve creating, receiving, maintaining, or transmitting PHI. A developer or agency whose upkeep of the site involves stored submissions belongs in the same agreement conversation.

The booking side, tool by tool, is in HIPAA-compliant scheduling software. Trackers, page types and the vendor roles around a practice site are in the HIPAA-compliant website guide.

What it costs

What the hosts that publish a price charge, as of November 7, 2026.

Prices from the hosts' own pages, linked in the cards above. They buy different things: a managed WordPress plan, a dedicated server, a managed cloud server or only the agreement on top of a plan you already pay for.

An office worker's hands on a keyboard and mouse beside an open handwritten logbook on the desk.
Illustrative photo · MART PRODUCTION on Pexels (Pexels License). If patient data stays off the website entirely, the host never creates, receives, maintains or transmits PHI, which is HHS's business associate test.

The price is not the whole cost. AWS says customers "still must configure these services consistent with HIPAA requirements," and Google says compliance is "a shared responsibility." On a cloud platform, the practice or its developer does that setup, on covered services only.

Hosting questions practice owners ask

Short answers, each one traceable to a host or HHS page above.

01

Is there such a thing as HIPAA-compliant web hosting?

Not as a certificate. HHS's Office for Civil Rights says it "does not endorse, certify, or recommend specific technology or products." Microsoft says there is currently no HHS-approved certification program through which a cloud provider acting as a business associate could demonstrate compliance, and Cloudflare says HHS "does not recognize a certification for HIPAA compliance." What exists is a host that signs a business associate agreement for the plan and services a practice uses, and then the practice's own setup and policies.

02

Does a medical practice website need HIPAA-compliant hosting?

Only if the practice is covered by HIPAA and the host will create, receive, maintain or transmit protected health information for it. HHS limits the conduit exception to transmission-only services, with no storage beyond what is temporary and incident to the transmission. A brochure site whose booking and patient forms run on vendors that sign their own agreements may never put any on the host. Once the site's database, media library or backups keep what patients submit, HHS treats the host as a business associate and an agreement is required.

03

Does AWS sign a BAA?

Yes. An AWS account reviews and accepts the AWS Business Associate Addendum (BAA) in AWS Artifact. It covers the services on AWS's HIPAA Eligible Services list, which was last updated October 15, 2026 and includes EC2, S3, RDS, Elastic Beanstalk, Amplify Console and CloudFront with an exclusion. Amazon Lightsail was not on that list on November 7, 2026.

04

Is WP Engine HIPAA compliant?

WP Engine's Acceptable Use Policy says customers may not use its services to store or process protected health information as defined under HIPAA. The policy bars PHI, not public pages, so any form submission, upload or booking that carries PHI has to go to a vendor that signs a business associate agreement.

05

Is Vercel HIPAA compliant?

Vercel signs business associate agreements with eligible Pro and Enterprise customers. On Pro, the HIPAA BAA is an add-on listed at $350 a month on Vercel's pricing page as of November 7, 2026; Enterprise is priced by request, and the Hobby plan has no agreement.

06

Is Cloudflare HIPAA compliant?

Cloudflare says it will only enter into business associate agreements with its enterprise customers. On plans below Enterprise there is no agreement, which matters when Cloudflare sits in front of a host that does sign.

07

If the host encrypts our data and has no key, do we still need a BAA?

Yes. HHS says a cloud provider that stores encrypted ePHI is a business associate even if it does not hold the decryption key, and that the conduit exception covers only transmission-only services, with no storage beyond what is temporary and incident to the transmission.

08

Can patient data be hosted on servers outside the United States?

HHS says yes, provided a business associate agreement is in place and the HIPAA Rules are otherwise followed, but it warns that risks to the data may vary greatly by location and belong in the practice's risk analysis.

09

How much does HIPAA-compliant web hosting cost?

On the host pages read November 7, 2026: HIPAA Vault lists HIPAA WordPress hosting at $120 a month and general HIPAA hosting from $309; Liquid Web's dedicated server HIPAA solutions start at $229 a month; Atlantic.Net's lowest-priced managed HIPAA cloud server is $605.11 a month on a 12-month term ($514.34 on 36 months), plus a one-time $150.00 firewall setup fee; Vercel's HIPAA add-on is $350 a month on top of Pro. AWS, Azure, Google Cloud and DigitalOcean list no separate price for the agreement itself.

10

What happens to our data when we leave a host?

HHS says a business associate agreement must require the business associate to return or destroy all PHI at the end of the agreement where feasible, and, if that is not feasible, to extend the agreement's protections to the data that stays. It also lists the manner of returning data after termination among the provisions a service level agreement can include.

Choose the host with the build

A practice site planned so the host, the forms and the scripts each have an answer.

Whether the host has to sign depends on what the site stores, and that is decided when the site is planned: which pages exist, where the booking button goes, what each form keeps and which scripts load where. That inventory, the build paths and the release checks are on the medical and healthcare website design page. Nothing on this site asks for personal or medical information; to talk through a practice website build, call (908) 249-0016.

Medical & healthcare website designCall (908) 249-0016