Conditional A BAA is available on Atlantic.Net's HIPAA Developer, Business, DR Hosting and Custom plans, and standard (non-HIPAA) cloud and dedicated plans are excluded. Verdict date: 2026-10-20; next check 2027-01-20.
Atlantic.Net will sign a BAA for HIPAA hosting. The BAA follows the plan, not the company, so a server on an ordinary cloud plan is not covered.
Short answer
The BAA is a standard part of every HIPAA hosting plan. It is tied to those plans rather than to ordinary cloud or dedicated plans. Covered services are HIPAA managed cloud servers (Linux and Windows) and HIPAA dedicated and custom deployments.
Published pricing starts at $605.11 per month for HIPAA Developer Linux on a 12-month term. For other vendors, see all vendor HIPAA checks.
Which plans include a BAA
A business associate agreement (BAA) is the contract a hosting provider signs before it may store or process PHI for you. Atlantic.Net includes it with its HIPAA hosting plans.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| HIPAA Developer | Yes | Included with HIPAA hosting plans | None listed |
| HIPAA Business | Yes | Included with HIPAA hosting plans | None listed |
| HIPAA DR Hosting | Yes | Included with HIPAA hosting plans | None listed |
| HIPAA Custom | Yes | Included with HIPAA hosting plans | None listed |
| Standard (non-HIPAA) cloud and dedicated plans | No | Not available | Not applicable |
Pricing example: the HIPAA Developer Linux Managed Cloud Server (6 vCPU, 16GB RAM, 200GB SSD, 10TB monthly transfer) is $605.11 per month on a 12-month term. The pricing lists a one-time $150.00 setup fee for the FortiGate firewall. Pricing for HIPAA Business, DR Hosting and Custom is not published by the vendor.
What the BAA covers and what it excludes
Covered
- HIPAA managed cloud servers (Linux and Windows)
- HIPAA dedicated and custom deployments
Excluded
- Standard non-HIPAA cloud and dedicated plans
- The vendor lists no further excluded features
The BAA scope follows the HIPAA plan. A clinic that spins up a test server on a standard plan, then loads real patient exports onto it, has put PHI on a service the BAA does not cover. Confirm the plan before any PHI moves.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published by the vendor" means the vendor's pages do not state it. It does not mean the control is absent.
How to use Atlantic.Net with PHI
A BAA covers the provider's side. The rest is yours. See the HIPAA guides for the wider program. For a server holding PHI:
- Sign the BAA before any PHI reaches the server.
- Confirm the server runs on a HIPAA plan, not a standard plan.
- Configure access and user management yourself, since the vendor publishes no access-control details.
- Keep logs and review them on a schedule your policy sets.
- Encrypt data according to your own policy.
- Train staff and keep written policies.
- Record the setup, plan and BAA date in your vendor inventory.
Compliance depends on the signed BAA, your configuration and your policies.
Alternatives with a BAA
- Amazon Web Services: conditional, all AWS accounts. See AWS.
- Microsoft Azure: conditional.
- GoDaddy: conditional, Microsoft 365 email on plans it represents as HIPAA-compliant. See GoDaddy.
- Google Cloud Platform: yes, all accounts.
- Liquid Web: conditional, standalone HIPAA server.
The full category is at HIPAA-compliant hosting.
Sources
- HIPAA-Compliant Hosting with a BAA – Atlantic.Net — BAA page, checked 2026-10-20. "Atlantic.Net offers a BAA as a standard part of the HIPAA hosting offering."
- HIPAA-Compliant Hosting with a BAA – Atlantic.Net — Pricing page, checked 2026-10-20. "HIPAA Developer Linux Managed Cloud Server $605.11 Per Month 6 vCPU 16GB RAM 200GB SSD Storage 10TB Monthly Data Transfer"
- HIPAA-Compliant Hosting with a BAA – Atlantic.Net — Trust center, checked 2026-10-20. "SOC 2 TYPE II and SOC 3 TYPE II Certifications"
- HIPAA-Compliant Hosting with a BAA – Atlantic.Net — Vendor page, checked 2026-10-20. "Encryption of protected health information both in transit and at rest."
- HIPAA-Compliant Hosting with a BAA – Atlantic.Net — Vendor page, checked 2026-10-20. "Detailed logging and monitoring of system access and administrative actions."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
FAQ
Does Atlantic.Net sign a BAA, and on which plans?
Yes. A BAA is included with the HIPAA Developer, HIPAA Business, HIPAA DR Hosting and HIPAA Custom plans. It covers HIPAA managed cloud servers (Linux and Windows) and HIPAA dedicated and custom deployments.
Is a BAA available on Atlantic.Net's standard cloud or dedicated plans?
No. Standard (non-HIPAA) cloud and dedicated plans are excluded. Move PHI only onto a server on a HIPAA plan.
Does the BAA cost extra, and what does HIPAA hosting start at?
The vendor lists no separate charge for the BAA. HIPAA hosting starts at $605.11 per month for HIPAA Developer Linux on a 12-month term (6 vCPU, 16GB RAM, 200GB SSD, 10TB monthly transfer). The pricing also lists a one-time $150.00 setup fee for the FortiGate firewall.
Does Atlantic.Net publish encryption and audit logging for PHI?
Yes. The vendor publishes encryption in transit, encryption at rest and an audit log, and states SOC 2. Access controls, SSO, data residency, HITRUST and ISO 27001 are not published by the vendor.