Is WordPress HIPAA compliant? BAA by plan, covered services and exclusions

"WordPress" in a search covers three different things:

• WordPress.com, the hosted service run by Automattic.
• WordPress VIP, Automattic's enterprise offering.
• Self-hosted WordPress.org, open-source software that a clinic or its agency installs on a host of its choice.

Short answer

The sources checked contain no public statement that WordPress.com signs a BAA. A staff forum reply points regulated customers to WordPress VIP, and VIP's capabilities page says only to contact its team about HIPAA. Self-hosted WordPress is open source, so the hosting provider and each plugin vendor decide what a BAA covers.

A WordPress site can handle PHI only if every vendor that receives, stores or transmits that data has signed a BAA and the organization configures the site accordingly. The software alone confers nothing. For term definitions, see the HIPAA glossary: BAA, PHI.

Which plans include a BAA

Plan	BAA	How it is obtained	Extra cost
WordPress.com plans	Not published by the vendor	Not published by the vendor	Not published by the vendor

WordPress VIP: the capabilities page says "For HIPAA and other regulated industries, contact the team." This is an invitation to contact the team, not a BAA offer.

What the BAA covers and what it excludes

• Covered services: none published.
• Excluded features: none published.

For a self-hosted site, coverage is whatever the hosting provider's own BAA and each plugin vendor's own BAA says. The WordPress software itself is not a party to any agreement.

Four data paths in a typical clinic site each need their own answer:

• Forms. A new-patient intake or appointment-request form sends data through whatever form tool is installed.
• Form-entry storage. Many form tools keep submissions in the site database or a third-party service.
• Backups. Copies of the database or uploads sit with the host or a backup vendor.
• Email notifications. A "new submission" message to the front desk sends the content through a mail service.

Security controls the vendor publishes

Control	Published status
Encryption in transit	Not published by the vendor
Encryption at rest	Not published by the vendor
Audit log	Not published by the vendor
Access controls	Not published by the vendor
SSO	Not published by the vendor
Data residency	Not published by the vendor
SOC 2	Not published by the vendor
HITRUST	Not published by the vendor
ISO 27001	Not published by the vendor

A WordPress.com staff reply on the support forum states that WordPress.com does not hold HITRUST or ISO 27001 certifications.

How to use WordPress with PHI

Compliance depends on the signed BAA, configuration and policies, not on the software. A shared-responsibility checklist:

1. Get a signed BAA from the host before any PHI is stored. Without one, keep PHI off the server.
2. Get a BAA from every vendor that receives submissions. That includes form, email, storage, backup and analytics vendors. Is Google Forms HIPAA compliant? and Is Google Analytics HIPAA compliant? show how adjacent tools each need a separate answer.
3. Decide whether the site should collect PHI at all. A contact form that asks only for a name and phone number carries less exposure than one that asks about symptoms or insurance.
4. Restrict admin and plugin access. Give each person a named account, limit who can install plugins, and remove access when staff or agency contractors leave.
5. Keep core and plugins maintained. Remove plugins you no longer use.
6. Document policies and train staff. Write down who may view form entries, where they are stored and how long they are kept.

Alternatives with a BAA

These website options have a BAA path under stated conditions. Placement never depends on payment. Verify each against its own page.

• Bubble: conditional, via the Dedicated Enterprise HIPAA add-on.
• GoDaddy: conditional, Microsoft 365 email on plans GoDaddy represents as HIPAA-compliant. Is GoDaddy HIPAA compliant?
• Squarespace: conditional, Acuity Scheduling Premium. Is Squarespace HIPAA compliant?
• Wix: conditional, Business plan. Is Wix HIPAA compliant?

Compare more options in HIPAA-compliant website builders and hosting.

Sources

Changes

No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.

FAQ

Do WordPress forms need to be HIPAA compliant?

If a form collects PHI, the vendors that receive or store the submissions are in scope, and each needs a BAA. That includes the form tool, the database host and the email service that sends notifications.

Can a WordPress site be HIPAA compliant?

Self-hosted WordPress is open source with no vendor to sign a BAA. Coverage depends on the hosting provider, the plugins and the organization's own configuration and policies.

Does WordPress.com sign a BAA?

No public statement was found for any plan. A staff reply points regulated customers to WordPress VIP, which says to contact its team about HIPAA.

Is self-hosted WordPress.org different from WordPress.com?

Yes. WordPress.com is a hosted service from Automattic, so a BAA would have to come from Automattic. With self-hosted WordPress.org you choose the host, so the BAA question moves to that host and to every plugin vendor that touches PHI.

Does WordPress.com hold ISO 27001 or HITRUST?

A staff forum reply states it holds neither as of the check date. SOC 2 status is not published by the vendor.