A BAA is available for the Microsoft 365 email services GoDaddy sells and represents as HIPAA-compliant. GoDaddy web hosting, including shared hosting, is expressly excluded, so it should not hold PHI.
Is GoDaddy HIPAA compliant? Verdict: conditional
Conditional Checked 2026-10-20. A BAA is available on GoDaddy's Microsoft 365 email plans that GoDaddy represents as HIPAA-compliant. Web hosting is the main exclusion. The verdict is per product: email can be covered by a BAA, hosting cannot.
Short answer
GoDaddy accepts a BAA electronically for the Microsoft 365 email services it sells and supports, and for nothing else. Its Hosting Services (shared, WordPress, VPS and dedicated) are not intended to provide a HIPAA-compliant environment and are not covered. If you searched for "GoDaddy shared hosting HIPAA compliant BAA" or "GoDaddy HIPAA compliant hosting plans," the answer is that no hosting plan is covered by a BAA.
For the same check on other vendors, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
| Plan / product | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Microsoft 365 email (plans GoDaddy represents as HIPAA-compliant) | Available | Accepted electronically | Not published by the vendor |
| Web hosting (shared, WordPress, VPS, dedicated) | No | Not available | n/a |
| Website builder | No | Not named in the BAA | n/a |
| Other GoDaddy products not named in the BAA | No | Not named in the BAA | n/a |
The BAA says GoDaddy may expand its scope in the future, so re-check it before assuming a product outside this table is covered.
What the BAA covers and what it excludes
Covered
- Microsoft 365 email services sold and supported by GoDaddy.
Excluded
- Hosting Services: shared, WordPress, VPS and dedicated.
- The website builder and any other product not named in the BAA.
A clinic whose website runs on GoDaddy hosting cannot rely on this BAA for contact forms, intake forms or appointment requests that collect PHI. The same applies to a WordPress site on GoDaddy. WordPress is covered in Is WordPress HIPAA compliant?, and website builders are covered in Is Wix HIPAA compliant?.
Security controls the vendor publishes
On the pages checked, GoDaddy does not publish any of the controls below. Nothing here is inferred from Microsoft's or any other product's documentation.
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
How to use GoDaddy with PHI
A signed BAA is one input. Compliance depends on the signed BAA, your configuration and your policies. A checklist for a practice using GoDaddy email:
- Accept the BAA before any PHI is sent or stored in email. A BAA is the written agreement under which a vendor handles PHI on your behalf.
- Confirm your mailboxes are on a plan GoDaddy represents as HIPAA-compliant, not just any GoDaddy email product.
- Keep PHI off GoDaddy hosting and the website builder, including contact, intake and appointment forms on your site.
- Configure access: assign mailboxes to named users, and remove access the day a staff member leaves.
- Set staff policies on what may be emailed, for example no PHI in subject lines, and train staff on them.
- Re-check the BAA scope before adding any GoDaddy product to your stack.
Alternatives with a BAA
| Vendor | Verdict | BAA starting plan |
|---|---|---|
| Atlantic.Net | Conditional | HIPAA Developer |
| Amazon Web Services | Conditional | All AWS accounts (no plan tiers) |
| Microsoft Azure | Conditional | All Azure customers under a volume licensing or online subscription agreement (no plan tiers) |
| Bubble | Conditional | Dedicated Enterprise (HIPAA add-on) |
| Gmail in Google Workspace | Conditional | Business Starter |
Browse hosting, website and email options on HIPAA-compliant software by category.
Sources
- HIPAA Business Associate Agreement — BAA page, checked 2026-10-20. "This Agreement sets forth each party's respective obligations regarding the Microsoft® 365 email services sold and supported by GoDaddy and represented by us as being HIPAA-compliant (the "Services")"
- HIPAA Business Associate Agreement — BAA page, checked 2026-10-20. "Services Scope. As of the effective date of this Agreement, this Agreement is applicable only to the described Services. GoDaddy may expand the scope of the described Services to include other GoDaddy products or services."
- Hosting Agreement – GoDaddy — Terms, checked 2026-10-20. "The Hosting Services are not intended to provide a PCI (Payment Card Industry) or HIPAA (Health Insurance Portability and Accountability Act) compliant environment and therefore should not be used or considered as one."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Is GoDaddy shared hosting HIPAA compliant, and is there a BAA for it?
No BAA covers it. GoDaddy states that its Hosting Services, including shared hosting, are not intended to provide a HIPAA-compliant environment. Do not store or collect PHI there.
Does GoDaddy sign a BAA, and how do I accept it?
Yes, for Microsoft 365 email services sold and supported by GoDaddy. The BAA is accepted electronically. Accept it before any PHI goes through the mailboxes.
Is there a GoDaddy HIPAA-compliant hosting plan?
No. None of GoDaddy's hosting plans (shared, WordPress, VPS or dedicated) is covered by the BAA. If a site must handle PHI, choose a host that signs a BAA for the services you use, such as those listed under Alternatives above.
Which GoDaddy services does the BAA cover, and could that change?
It covers Microsoft 365 email services sold and supported by GoDaddy. Hosting Services are excluded, and the website builder and other products are not named. The BAA says GoDaddy may expand the scope in the future, so re-read it before relying on any other product.