HIPAA-Compliant Hosting: The Questions a Practice Manager Should Ask Before Signing

The practice management system is on a server in a closet behind reception. It has been there since the practice opened. The person who installed it has retired. The cyber-insurance renewal asks whether it is backed up off-site, whether the operating system is supported, and whether anyone has reviewed who can log in. The honest answers are sort of, not after January, and no.

That is the moment most practices start searching for “HIPAA-compliant hosting”, and the search returns a wall of badges. This post is what to ask before you believe any of them.

There is no HIPAA certification. There is a contract.

The Department of Health and Human Services does not certify hosting providers. Nobody does. “HIPAA certified” on a website means the provider paid a third party to say so, or means nothing.

What the HIPAA Rules actually say, in HHS’s own guidance on cloud computing, is simpler and more useful. When a covered entity, which is your practice, engages a provider to store or process electronic protected health information, that provider is a business associate. A business associate must sign a business associate agreement with you, is contractually liable for the terms of it, and is directly liable under the HIPAA Rules for the parts that apply to it.

Three consequences follow, and HHS states each one explicitly:

1. Encryption does not get the provider out of it. A provider holding only encrypted data, with no key, is still a business associate. HHS calls this “no-view services” and says the provider is not exempt from any otherwise applicable requirement.
2. Using a host without a BAA is itself a violation. Not a grey area; HHS’s FAQ says a covered entity that uses a cloud provider to maintain ePHI without a BAA is in violation of the Rules.
3. The provider cannot lock you out of your own data. The HHS guidance warns that a service agreement which blocks the practice’s access to its own ePHI would breach the Rules. Read the termination clause.

So the first question is not “are you HIPAA compliant?” It is “send me your BAA.”

What the BAA has to settle

HHS says the Security Rule’s requirements are “flexible and scalable” and that the parties should confirm in writing how each will handle them. That is the whole game. A good BAA, or the schedule attached to it, answers:

• Who controls access to the data? In the no-view model, the practice decides who can log in; the provider never has a user account in the practice management system. Authentication and unique user IDs are the practice’s job.
• Who controls the hardware and the tools that manage it? The provider. HHS specifically calls out the administrative tools that manage storage, memory, network interfaces and CPUs, and says the provider must control access to those and keep them patched. Ask what “patched” means in practice and how often.
• Who encrypts, and where is the key? Typically the provider encrypts at rest and in transit; the practice, or the application vendor, holds the keys to the application itself.
• What happens on a breach? A no-view provider still has HIPAA breach-notification duties to you. The BAA should say how fast you hear about an incident on the provider’s side, and in what form.
• What happens when you leave? How you get your data back, in what format, in what timeframe, and what the provider destroys afterwards.

If a provider’s BAA is a two-page template with none of this in it, that is your answer.

Hosting is the easy half. The practice still has the hard half.

A hosting provider can take the server out of the closet, put it on dedicated hardware in a data center with biometric access and an annual SOC 2 Type II audit, patch the operating system, back it up to a second site, and stand behind every one of those things in writing. That is real, and it closes most of the insurer’s questionnaire.

What it does not do is make the practice compliant. The Security Rule’s risk analysis is yours. Workforce training is yours. Who gets a login to the practice management system, and whether the receptionist who left in March still has one, is yours. A hosted server with a shared front-desk password is a hosted problem.

The honest provider will say this. The one who says “move to us and you’re covered” is selling the badge.

How it works when the server is on dedicated hardware

Most “HIPAA hosting” is a slice of a shared cloud platform with a BAA attached. That is a legitimate arrangement; it is also the one where the answer to “who else is on this hardware?” is “we can’t say.”

The alternative, and the model we run for regulated clients, is a server copied exactly as it is onto hardware we build and own, that runs only your workloads, inside a SOC 2 Type II data center. Same server name, same addresses, same logins; the practice management vendor does not need to know it moved. The provider’s staff manage the hardware and the hypervisor and never log into the application. That is the no-view split HHS describes, with the added property that there is no other tenant to describe.

It is the model Sigma Underwriting Managers, an insurance underwriter, has run on for fifteen years, and Armellini Express Lines for ten; insurance and logistics, not healthcare, but under the same auditor’s questions about who can touch the hardware and where the backups are. When their questionnaires arrive, the section about servers, backups and access is ours to fill in, from the systems we run, and we sit down with the client to confirm every answer before it goes back. A practice manager with an insurer’s renewal in hand needs exactly that, and should ask any provider who does it.

Five questions before you sign

1. “Send me your business associate agreement.” Read it against the list above. If it is not offered before pricing, be wary.
2. “Is our server on dedicated hardware or a shared platform, and who else is on it?” Either answer can be fine. “We don’t disclose that” is not.
3. “Who at your company can log into our practice management system?” The right answer is nobody. If the provider needs access to support the application, that is a separate, written, logged arrangement.
4. “When our insurer sends the IT questionnaire, who fills in the server section?” If the provider pauses, you will be doing it.
5. “What is the Windows Server version on the box today, and what is the plan for January 2027?” Windows Server 2016 reaches end of support on 12 January 2027. An unsupported operating system holding ePHI is a Security Rule risk-analysis finding before it is anything else. The three options are here.

Phoenix hosts regulated clients on dedicated hardware in a SOC 2 Type II data center in Fort Lauderdale, under the no-view model described above, with the audit paperwork inside the monthly number. What is included is on the managed hosting page. Practices in Broward County and South Florida: managed IT in Fort Lauderdale. Practices in Sonoma, Marin and Napa: IT consulting from Rohnert Park. If the renewal is on your desk, book a thirty-minute review and we will go through the questionnaire with you.