HIPAA-Compliant Website Hosting: What Healthcare Providers Actually Need to Know

The short answer is: it depends on what your website does — but the trigger is probably closer than you think.

HIPAA applies when a covered entity — a healthcare provider, health plan, or healthcare clearinghouse — creates, receives, maintains, or transmits protected health information (PHI). The critical thing to understand is that PHI is not limited to diagnoses or clinical records. Under the HHS Privacy Rule, a name and phone number become PHI as soon as they are linked to someone’s status as a patient or tied to the delivery of healthcare services — regardless of whether any health condition is mentioned.

This means that a basic contact form on a therapy practice website is not a gray area. When a prospective patient submits their name and phone number to a therapist’s website, that submission creates PHI the moment it is associated with the healthcare provider relationship. The same applies to appointment request forms, new patient intake forms, and any scheduling tool that books visits for patients.

A purely informational website — one that displays your services, hours, and a phone number visitors can dial themselves, with no data collection features of any kind — does not inherently trigger HIPAA requirements for your hosting environment. Once your site has a form or data collection feature of any kind, the analysis changes.

Note on HIPAA applicability: HIPAA regulations apply when a provider is a “covered entity” — generally meaning they electronically bill insurance or engage in electronic healthcare transactions. Providers in cash-pay private practice who do not bill insurance electronically may fall outside federal HIPAA jurisdiction, but state privacy laws and professional ethical codes regarding client data still apply. Most compliance advisors recommend treating all patient contact information as protected regardless of billing structure.

HIPAA-compliant hosting is not a certification or a product category with a clear definition. It is a set of technical and administrative safeguards that a hosting provider must have in place — and, critically, must be willing to contractually commit to.

The Business Associate Agreement

The single most important factor when evaluating a hosting provider for a healthcare website is whether they will sign a Business Associate Agreement (BAA). A BAA is a contract in which the hosting provider acknowledges that they may come into contact with PHI on your behalf and agrees to handle it in accordance with HIPAA requirements.

Without a signed BAA, the hosting relationship does not meet HIPAA standards — regardless of what security features the provider offers. This is worth stating clearly: some of the most widely used and technically capable hosting platforms, including Cloudways, do not offer BAAs and are therefore not appropriate for healthcare websites that handle patient data. A great host for a standard business website is not automatically the right host for a healthcare practice.

Technical safeguards to look for

Beyond the BAA, a hosting environment appropriate for healthcare websites should include:

• Data encryption in transit and at rest — SSL/TLS for data moving between browser and server, plus encryption for stored data
• Access controls — Role-based permissions limiting who can access server resources and data
• Audit logging — The ability to track who accessed what data and when
• Regular backups — Secure, recoverable backups in the event of data loss or breach
• Vulnerability management — Active patching and security monitoring

Many reputable managed hosting providers offer these features. The key is confirming that a BAA is available and that the provider understands the obligations that come with it.

Not every host markets itself as healthcare-specific, and that is acceptable. What matters is the combination of technical capability and contractual willingness. Here is what to evaluate:

BAA availability

Ask directly. Some enterprise-tier providers offer BAAs as part of a higher service tier. Others include them as standard. If a provider cannot clearly confirm BAA availability, that is your answer.

Managed vs. unmanaged hosting

For most healthcare practices, managed hosting is the appropriate choice. With managed hosting, the provider handles server updates, security patches, and monitoring on your behalf. Unmanaged hosting puts that responsibility on you — which is rarely realistic for a clinical practice without dedicated IT staff.

Data center location and redundancy

Your provider should be able to confirm where your data is stored and that it remains within the United States. Geographic redundancy — meaning your data is backed up across multiple locations — is a reasonable expectation at this level.

Support and incident response

In the event of a security incident, your host needs to be reachable and responsive. Look for providers with documented incident response procedures and clear communication commitments.

Purpose-built healthcare hosting providers

A number of hosting providers build specifically for healthcare use cases and include BAAs as a standard part of their offering rather than an enterprise add-on. HIPAA Vault is one example that is sized appropriately for small and independent practices — it offers managed WordPress hosting with BAA included, encrypted storage, audit logging, and support designed around healthcare compliance requirements. It is worth evaluating alongside any other providers you are considering.

Working with a web partner who understands the healthcare hosting landscape means you do not have to navigate provider selection alone. At Minnesota Web Studio, we help healthcare clients evaluate hosting options, configure the right environment, and get everything in place before a site goes live.

Hosting is the foundation, but it is not the only piece. The tools embedded in your website — scheduling software, contact forms, intake tools — create their own compliance considerations.

Contact forms

For healthcare providers, a contact form is not a gray area. When a prospective patient submits their name and phone number through a form on a therapy or medical practice website, that information becomes Protected Health Information because of the relationship context — not because of what the form asks. The safest approaches are to use a HIPAA-compliant form solution with a BAA in place, or to limit your contact form to non-patient inquiries (general business questions, vendor contact, and similar) and direct patients to call the practice directly for anything related to appointments or care.

Online scheduling

Appointment scheduling tools vary widely in their HIPAA posture. Some platforms offer HIPAA-compliant tiers with BAAs available. Others are designed for general business use and do not offer BAAs at any level. The key question to ask of any scheduling tool: will you sign a BAA? If the answer is no, or if the provider does not clearly address this, that tool is not appropriate for patient scheduling on a healthcare website.

Is Calendly HIPAA compliant?

Calendly is one of the most widely used scheduling tools, and the question comes up often in healthcare contexts. Standard Calendly does not offer a BAA and is not designed for healthcare use. Calendly has offered HIPAA-compliant options at enterprise pricing tiers, but availability is not consistent and should be confirmed directly with Calendly before use for patient scheduling. For most independent practices, purpose-built healthcare scheduling tools are the more reliable path.