Liquid Web signs a BAA for its HIPAA-ready dedicated server environments, not for its standard hosting plans, and encrypting ePHI is left to the customer. This page records what Liquid Web publishes, not how good the hosting is. It contains no review ratings.
Conditional A BAA is available for the standalone HIPAA server, the HIPAA server and firewall, and the HIPAA multi-server package. Standard non-HIPAA hosting plans are excluded, and the customer must handle encryption of ePHI. Verdict date: 2026-10-20.
Short answer
Liquid Web states that it provides a signed BAA for all HIPAA-ready hosting environments on dedicated servers, Linux and Windows. Configuring encryption of ePHI remains the customer's responsibility. Pricing starts at $229/mo for the Linux dedicated HIPAA server. For the terms, see the HIPAA glossary (BAA, ePHI). For other vendors, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Standalone HIPAA server | Yes | Provided with the HIPAA-ready dedicated server environment | Not published by the vendor |
| HIPAA server & firewall | Yes | Provided with the HIPAA-ready dedicated server environment | Not published by the vendor |
| HIPAA multi-server package | Yes | Provided with the HIPAA-ready dedicated server environment | Not published by the vendor |
| Standard (non-HIPAA) hosting plans | No | Not offered | Not applicable |
The starting prices of $229/mo (Linux) and $271/mo (Windows) are server prices, not BAA fees. Whether the BAA carries a separate charge is not published.
What the BAA covers and what it excludes
Covered
- HIPAA dedicated servers, on Linux and Windows.
Excluded or left to the customer
- Configuration of data encryption. Liquid Web places this with the customer.
- Standard non-HIPAA hosting plans, which are outside the BAA.
Liquid Web's HIPAA hosting page says that when you handle ePHI on the server, proper encryption is your job.
In practice, a clinic that moves its patient-portal database onto a HIPAA dedicated server must set up disk or database encryption itself. It cannot assume the host has done so. A marketing site on a standard plan that later gains an intake form is not covered by the BAA.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published" means the vendor's page does not state it. It does not mean the control is absent. Ask Liquid Web for details before relying on any of these.
How to use Liquid Web with PHI
Responsibility is shared. Use this checklist:
- Sign the BAA before any ePHI goes on the server.
- Use a HIPAA-ready dedicated environment, not a standard hosting plan.
- Configure encryption of ePHI yourself, for data stored on the server and for traffic to and from it.
- Set access controls and remove access promptly when staff or contractors leave.
- Document your risk analysis and policies.
- Train staff on how ePHI may be handled on the server.
- Keep ePHI off any third-party service, such as backup, monitoring or email tools, unless that service has its own BAA.
Compliance depends on the signed BAA, your configuration and your policies. The BAA alone does not make an organization HIPAA compliant.
Alternatives with a BAA
These are factual entries from the directory, in no ranked order. Verdicts follow each vendor's own published terms.
- Atlantic.Net: conditional (HIPAA Developer).
- Amazon Web Services: conditional (all accounts).
- Microsoft Azure: conditional.
- GoDaddy: conditional (Microsoft 365 email plans).
- Google Cloud Platform: yes (all accounts).
Compare more tools in HIPAA-compliant software by category.
Sources
- HIPAA Compliant Hosting Services | Liquid Web — BAA page, checked 2026-10-20. "We provide signed Business Associate Agreements (BAAs) for all HIPAA-ready hosting environments."
- HIPAA Compliant Hosting Services | Liquid Web — Pricing page, checked 2026-10-20. "Liquid Web's dedicated server HIPAA solutions are billed monthly, starting at $229/mo (Linux) and $271/mo (Windows)."
- HIPAA Compliant Hosting Services | Liquid Web — Vendor page, checked 2026-10-20. "if you're handling ePHI on your server, it's your responsibility to ensure that the information is properly encrypted to meet HIPAA requirements."
- HIPAA Compliant Hosting Services | Liquid Web — Trust center, checked 2026-10-20. "SOC 2 SSAE-22"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Does Liquid Web sign a BAA?
Yes, for its HIPAA-ready hosting environments on dedicated servers, per its HIPAA hosting page. This covers the standalone HIPAA server, the HIPAA server and firewall, and the HIPAA multi-server package.
Do Liquid Web's standard hosting plans include a BAA?
No. Standard non-HIPAA hosting plans are outside the BAA, so ePHI should not be placed on them.
Who is responsible for encrypting ePHI on a Liquid Web HIPAA server?
The customer. Liquid Web states that proper encryption is the customer's job when ePHI is handled on the server. The vendor does not publish encryption-in-transit or encryption-at-rest details.
How much does Liquid Web HIPAA hosting cost?
Pricing starts at $229/mo for the Linux dedicated HIPAA server and $271/mo for Windows. Whether the BAA carries a separate fee is not published by the vendor.