HIPAA-compliant hosting: cloud and web hosts with a BAA compared

Six of the seven hosts covered here will sign a business associate agreement (BAA) for at least one service: Google Cloud, AWS, Azure, Liquid Web, Atlantic.Net and GoDaddy (Microsoft 365 email only). WP Engine is the exception. A BAA covers specific services, not a brand, so the useful question is "BAA available on plan X for services Y?" This page answers it for each host. Sources and the last verification date are at the end.

Short answer: which hosts will sign a BAA

Hyperscalers sign for an eligible-services list, so a BAA does not cover everything in the console. Shared web hosts usually do not sign at all. "Conditional" in the table means a BAA exists but covers only part of the product line.

Vendor	Verdict	BAA available from	How it is obtained
Google Cloud Platform	Yes	All Google Cloud accounts	Review and accept the Google Cloud BAA online
Amazon Web Services	Conditional	All AWS accounts (no plan tiers)	Accept in AWS Artifact; PHI only in HIPAA-eligible services
Microsoft Azure	Conditional	All Azure customers under a volume licensing or online subscription agreement (no plan tiers)	Included in the licensing agreement via the Product Terms and DPA
Liquid Web	Conditional	Standalone HIPAA server	Provided with HIPAA-ready dedicated server environments
Atlantic.Net	Conditional	HIPAA Developer	Included with HIPAA hosting plans
GoDaddy	Conditional	Microsoft 365 email (plans GoDaddy represents as HIPAA-compliant)	Electronic acceptance of the HIPAA Business Associate Agreement for Microsoft 365 email
WP Engine	No	No BAA offered	Not applicable

The table is ordered by the verdict logic above, not by payment. No host here is "HIPAA certified," and HIPAA has no certification for hosting. For what the phrase does and does not mean, see what 'HIPAA compliant' means for a vendor. Other categories are listed under HIPAA-compliant software by category.

Disclosure: Chanty, Inc. owns and publishes HIPAA Compliant Wiki. Placement in tables never depends on payment or on Chanty's interest. Chanty is not a host and is not listed on this page. The directory reports vendors' published BAA terms and does not audit vendors. Sources and the verification date are listed at the end of the page.

What "HIPAA-compliant hosting" actually requires

Hosting PHI needs a provider that signs a BAA for the specific services you use: compute, storage, database or managed WordPress. PHI has to stay inside those covered services. A host that signs a BAA for its dedicated servers has not necessarily signed one for its shared plans.

Under 45 CFR 164.308(b) and 164.314(a), a covered entity must have a written business associate contract before a vendor handles ePHI. HHS cloud guidance says a cloud provider that stores ePHI is a business associate even if the data is encrypted and the provider lacks the key. For the terms themselves, see what a business associate agreement covers.

Responsibility is shared. The provider secures the infrastructure. You configure:

• encryption
• access controls
• logging
• backups
• patching

A clinic that moves its scheduling database to a signed-BAA cloud account but leaves a storage bucket publicly readable has met the contract requirement and still has a problem. The BAA does not make your environment compliant.

Typical exclusions to look for: shared hosting plans, and any service outside the vendor's eligible list.

Cloud platforms: Google Cloud, AWS and Azure

Google Cloud Platform: yes. The Google Cloud BAA is accepted online in the console when your Google Cloud Services Agreement does not already include it, at the same public pricing as any other customer. It covers all regions and zones and a named list of covered products. Services outside that list must not hold PHI, pre-GA offerings are excluded, and customers of unaffiliated resellers are not covered. Encryption at rest is available. Google's HIPAA pages do not state audit log, SSO or SOC 2 details.

Amazon Web Services: conditional. You sign in to the AWS Management Console, then review and accept the Business Associate Addendum for the account in AWS Artifact. You can instead accept it once for all accounts in an AWS Organization. There are no plan tiers. PHI must then be processed only in HIPAA-eligible services, and that list changes, so confirm each service against the current list before putting PHI in it. SOC 2 is reported: AWS's Spring 2026 SOC 2 report covers 188 services for the 12 months from 2025-04-01 to 2026-03-31 and is available through AWS Artifact.

Microsoft Azure: conditional. According to the Microsoft Service Trust Portal, there is no separate contract. Executing the customer's volume licensing or online subscription agreement incorporates the Microsoft Product Terms and the Products and Services Data Protection Addendum (DPA), and that includes execution of the HIPAA BAA. The BAA text is on the Service Trust Portal. The no-separate-contract wording is also on Microsoft Learn's HIPAA offering page, which applies to Azure and Azure Government. SOC 2 is reported: Microsoft confirms Azure has a SOC 2 Type 2 report but does not publish the audit period. Reports are issued a few months after each period ends, with no gaps between periods. The list of in-scope services is in Appendices A and B of Microsoft Azure Compliance Offerings on the Service Trust Portal. Check it for each Azure service you plan to put PHI in.

Dedicated and managed HIPAA hosting: Liquid Web and Atlantic.Net

Liquid Web: conditional. Liquid Web signs a BAA for all of its HIPAA-ready hosting environments, including the multi-server package. There is no standalone BAA page; the terms appear on its HIPAA hosting page. Pricing starts at $229/mo for a Linux dedicated HIPAA server and $271/mo for Windows. SOC 2 is listed only as "SOC 2 SSAE-22" in a data-center certification list, without report type, scope or period. Liquid Web does not publish encryption at rest, audit log, data residency or BAA coverage of managed services.

Atlantic.Net: conditional. The BAA comes with every HIPAA hosting plan, from HIPAA Developer. Pricing starts at $605.11 per month for HIPAA Developer Linux on a 12-month term, plus a one-time $150 FortiGate setup fee. The plan-level security item is "Encryption & MFA"; encryption at rest and audit logging appear only in a generic standard-versus-HIPAA comparison table. Atlantic.Net reports SOC 2 Type II and SOC 3 for its data-center infrastructure without an audit period.

Vendor	Published starting price	Encryption at rest	Audit log	SOC 2
Liquid Web	$229/mo (Linux dedicated HIPAA server)	Not published by the vendor	Not published by the vendor	Reported
Atlantic.Net	$605.11 per month (HIPAA Developer Linux, 12-month term)	Available	Available	Reported

Price caveats. Both are published starting prices. They differ by term length, operating system and what is bundled, so they are not like for like. A 12-month commitment is not the same as month-to-month.

For "cheap HIPAA-compliant hosting" searches: the lowest price is not comparable unless the BAA covers the same services. A cheaper plan with no BAA on that plan costs nothing until the first audit or breach.

Web and WordPress hosting: GoDaddy and WP Engine

GoDaddy: conditional. The BAA is accepted electronically and applies to Microsoft 365 email on plans GoDaddy represents as HIPAA-compliant. Do not read it as covering website hosting. GoDaddy's BAA defines its covered services as Microsoft 365 email only, so website hosting is outside it by scope, although GoDaddy does not publish a list of excluded hosting products.

WP Engine: no. WP Engine states that its Acceptable Use Policy prohibits storing or processing PHI and that it does not sign BAAs. No enterprise exception is published. A site that handles patient data there is not supported. This verdict is not permanent and will change if WP Engine publishes BAA terms.

For a website that handles PHI, choose a host or cloud service that signs a BAA for the service you use. See HIPAA-compliant websites.

A marketing site with no PHI needs no BAA. But appointment request forms, scheduling widgets and chat embeds can introduce PHI into a site that was never meant to hold it. If a visitor can type a symptom or a date of birth into it, treat it as a PHI system.

Matching the need: SFTP, servers, colocation, VDI, Kubernetes and AI

Match the need to a covered service type, then confirm that type is in scope of the provider's BAA. This is not a vendor claim.

You are searching for	What to check
SFTP server or hosting	A BAA with whoever runs the server, plus your own access controls and logging
Dedicated or cloud server	BAA scope for compute, and who patches the OS
Database hosting	Whether the database service is on the eligible list
Private cloud	The contract: who the provider is and what the BAA names
VDI or cloud desktop	BAA coverage of the desktop service itself
Load balancers, Kubernetes	Whether the managed service is in scope, and what you configure inside it
GPU or AI workloads	Whether the service, and any model API behind it, is covered

SFTP and encryption are controls, not compliance on their own. A BAA with the provider is still required. For moving files between organizations, see HIPAA-compliant file sharing. For bucket and object storage, see HIPAA-compliant storage.

Colocation and data centers are different. Facility certifications cover premises such as power, access control and cabling, not your PHI. The BAA and its contract scope still decide what the operator is responsible for.

Not covered yet: no vendor in the table has been researched for SFTP, colocation, VDI, load balancers or Kubernetes. Their verdict is "unknown" until a vendor's BAA or trust page is sourced.

How to verify a host before putting PHI on it

Before any PHI moves, confirm each of these:

• The BAA is signed and dated.
• The services you will use are named in scope.
• You have read the eligible-services list.
• You know the region and data residency terms.
• Encryption at rest and in transit are enabled and configured by you.
• Audit logging is on and retained.
• Backups are configured and tested. See HIPAA-compliant backup.
• Breach notification terms are in the BAA.

Ask the vendor for its BAA or trust page. Record the URL and the date in your vendor inventory. Reconfirm after any plan or product change, since a BAA that covered a plan last year may not cover the one you moved to. Updates are logged at recent changes in vendor HIPAA status.

FAQ

Is shared web hosting HIPAA compliant?

Usually not for PHI. Shared hosting plans are a typical exclusion, and hosts that sign a BAA tend to do so for dedicated or specific managed services. Check the BAA scope for your plan.

Is SFTP HIPAA compliant on its own?

No. SFTP is an encrypted transfer protocol and a control, not compliance. Whoever runs the server still needs a BAA with you, and you still configure access and logging.

Do AWS, Azure and Google Cloud sign a BAA, and for which services?

All three do, each in its own way. Google Cloud's BAA is accepted online when your agreement does not already include it, and covers all regions and zones and a published list of covered products. AWS lets you accept the BAA in AWS Artifact or sign one offline through your account manager. Any service can run in the account, but PHI may go only into HIPAA Eligible Services. Azure includes the BAA in the licensing agreement through the Product Terms and the DPA. The AWS and Azure eligible-service lists are long and change, so check them before placing PHI in a service.

How much does HIPAA-compliant hosting cost?

Published starting prices are $229/mo at Liquid Web (Linux dedicated HIPAA server) and $605.11 per month at Atlantic.Net (HIPAA Developer Linux, 12-month term). Google Cloud, AWS and Azure do not publish a HIPAA-specific price.

Is a HIPAA-compliant data center or colocation facility enough?

No. Facility certifications cover premises, not your PHI. The BAA and its contract scope decide responsibility.

Can I host a WordPress site with PHI?

Only on a host or cloud service that signs a BAA for the service you use. WP Engine states that it does not sign BAAs. The websites category has the full comparison.

Does a signed BAA make my environment compliant?

No. The BAA covers the provider's side. You remain responsible for encryption settings, access, logging, backups and patching, and for the staff policies around them.

How often is this page verified?

The last verification date is in the sources section below. The fifty most-viewed vendors are re-checked every quarter, the rest at least once a year, and sooner when a vendor changes plans or a reader reports a change.

Sources and last verification