HIPAA Website Hosting: When a Practice Site Needs One

A practice site can sit on ordinary hosting until patient details reach its server. Then the host needs a business associate agreement (BAA, the contract a vendor signs to protect patient information). "HIPAA compliant website hosting" is not an official status: HHS says its Office for Civil Rights (OCR) "does not endorse, certify, or recommend specific technology or products."

Where HHS draws the line

A host that stores patient information is a business associate, even if the data is encrypted and the host holds no key. HHS's cloud guidance says so directly, and says the postal-service "conduit" idea generally does not apply to storage.

The practice itself breaks the rules by using such a host without a BAA.

That was a university, not a small office. HHS's page on the 2016 settlement says OCR found "widespread and diverse problems" there, so the missing BAA was one finding among several.

In Ontario, the rule for a web host that is not the custodian's agent sits in O. Reg. 329/04, section 6. A custodian is the clinician or clinic holding the records. A company supplying it electronic services may use the health information it can reach only as the service needs, and may not disclose it unless a law requires.

What each kind of site needs

What decides it is what the site does with a visitor's details.

For form tools and their contracts, read HIPAA website forms. Booking widgets are sorted by BAA in HIPAA scheduling software.

Squarespace, Wix, WordPress hosts and clouds

Two managed WordPress hosts refuse outright; the others attach conditions.

Two details may change the decision. Wix says PHI protection hides visitor data that could identify someone, so you lose analytics data you had before; switching it off later does not restore data from the protected period. Liquid Web says encrypting patient information is your job, and only some products encrypt at rest.

A BAA has limits too. Google Cloud's HIPAA page lists the products its BAA covers, and its product notes say to keep patient details out of URIs, headers and labels.

Tags are a separate question from hosting

A tag is a script that sends visit data to another company. A tag can send data out even from a well-run host. HHS's tracking bulletin says a tag that collects what a visitor types on a patient portal's login or registration page makes a disclosure of patient information.

On June 20, 2024, a federal court in Texas (AHA v. Becerra, N.D. Tex.) vacated one part of that bulletin. It struck the idea that HIPAA applies when a tag links an IP address to a visit to a public page, one with no login, about specific conditions or providers. HHS's note on the bulletin names that portion as vacated and says HHS is evaluating its next steps.

For an anonymized NYC medical practice, I set up conversion tracking so tags stay off pages where patients enter details. See HIPAA-conscious conversion tracking.

Move the form or move the host

Find where your entries are stored

1. Log in to WordPress and open the form plugin's menu. Look for "Entries" or "Submissions".
2. If you see names and phone numbers listed, the site stores them. Note the oldest date.
3. Open the plugin's settings and look for an option to save or delete entries.
4. Find the hosting invoice. Write down the company's name, plan and renewal date.
5. Send that company one line: "Do you sign a BAA for this plan?"

If the host says no and the form takes patient details, ask your designer to move it to a form vendor that signs a BAA.

Questions for a host or designer

• Do you sign a BAA for this exact plan, and may I read it first?
• Which products does the BAA cover, and which does it leave out?
• Who encrypts the data, and who holds the keys?
• What happens to my entries and backups if I cancel?
• Does your plan log form data in URLs, labels or error reports?

Prices and rules checked on 2026-10-30.