No. WP Engine states it does not sign BAAs, and its Acceptable Use Policy prohibits storing or processing PHI on its services, so patient data should not live on a WP Engine site.
Is WP Engine HIPAA compliant? Verdict: no
No No BAA is available on any plan (Startup through Enterprise), and the main exclusion is storing or processing PHI on any WP Engine service. Verdict date: 2026-10-20.
Short answer
WP Engine states that it does not sign Business Associate Agreements. Its Acceptable Use Policy prohibits storing or processing protected health information on any plan. The platform is positioned for public-facing, non-PHI websites only.
In practice, patient records, form submissions that contain PHI and similar data should not sit on WP Engine. Examples are a "reason for visit" field on a contact form, an uploaded insurance card, or an intake PDF in the media library. For definitions of the terms used here, see the HIPAA glossary: BAA and PHI. For other vendors, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| All plans (Startup through Enterprise) | No | Not available | Not applicable |
No plan or add-on changes the outcome.
What the BAA covers and what it excludes
Covered services
- None, because no BAA is offered.
Excluded
- Storage or processing of PHI on any WP Engine service.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Published controls do not substitute for a BAA when PHI is involved.
How to use WP Engine with PHI
The only supported pattern is to keep PHI off the platform. Whether a site that is hosted elsewhere can handle PHI is a separate question, covered in Is WordPress HIPAA compliant?. A checklist for a clinic site on WP Engine:
- Keep PHI off WP Engine entirely, including the database, media library and any file uploads.
- Limit the site to public, non-PHI content such as service pages, provider bios, location hours and general contact details.
- Send intake forms, appointment requests and scheduling data to a vendor that signs a BAA, and link to it from the site rather than embedding PHI capture on the page.
- Review every form plugin, booking widget, chat widget and third-party embed for fields that could collect PHI.
- Record the decision, including the verdict date and the source, in your vendor inventory.
- Train front-desk and marketing staff not to upload patient photos, referral letters or screenshots of patient records to the website.
Compliance depends on a signed BAA, correct configuration and written policies. A site that follows this checklist avoids placing PHI on WP Engine, but the checklist does not make the organization compliant by itself.
Alternatives with a BAA
Each entry below is conditional: a BAA exists only under the stated terms. Moving a site to one of them does not by itself make it HIPAA compliant. You still need to sign the BAA, configure the service and set staff policies. Browse more options in HIPAA-compliant software by category, including the hosting and websites categories.
| Vendor | Verdict | BAA starting plan |
|---|---|---|
| Atlantic.Net | Conditional | HIPAA Developer |
| Amazon Web Services | Conditional | All AWS accounts (no plan tiers) |
| Microsoft Azure | Conditional | All Azure customers under a volume licensing or online subscription agreement (no plan tiers) |
| Bubble | Conditional | Dedicated Enterprise (HIPAA add-on) |
| GoDaddy | Conditional | Microsoft 365 email (plans GoDaddy represents as HIPAA-compliant) |
Sources
- Acceptable Use Policy – WP Engine — Terms, checked 2026-10-20. "You are not permitted to use or cause the Services to store or process sensitive or otherwise regulated health or financial information, including Protected Health Information"
- Is Your Website HIPAA Compliant? 8 Questions to Ask Your Hosting Provider — Vendor page, checked 2026-10-20. "WP Engine does not sign BAAs and should not be used as a repository for patient health records."
- Is Your Website HIPAA Compliant? 8 Questions to Ask Your Hosting Provider — Vendor page, checked 2026-10-20. "WP Engine serves as a secure managed web platform for hosting your public-facing, non-PHI digital properties."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes and FAQ
Changes: No changes recorded since first verification on 2026-10-20. For status updates across vendors, see Recent changes in vendor HIPAA status.
Does WP Engine sign a BAA?
No. WP Engine states that it does not sign BAAs, and no plan from Startup through Enterprise offers one.
Can I store PHI on a WP Engine site?
No. WP Engine's Acceptable Use Policy prohibits storing or processing PHI on any of its services.
Is there a WP Engine plan that is HIPAA compliant?
No. No plan includes a BAA, so no plan can be treated as suitable for PHI. This page does not describe WP Engine as HIPAA compliant on any plan.
What does WP Engine say it is intended for?
WP Engine positions its platform for public-facing websites that do not contain PHI. See the quoted passages in the Sources section above.