What is HIPAA-Compliant Hosting?
HIPAA-compliant hosting is web hosting in which customer data is protected by secure server restrictions and encryption. There are many ways in which a hosting provider can stay HIPAA-compliant. These include activity logs, secure backups, and access controls. In the case where customer data is hosted on the server and that data includes either PHI or ePHI, the hosting provider requires a Business Associate Agreement (BAA).
Introduction
Various features on a healthcare website support patient data collection, such as forms, appointment settings, portals, and connected applications. A website that processes ePHI typically hosts the data more securely than the average website.
Hosting that is HIPAA-compliant uses various security measures to ensure the protection of ePHI, such as encryption, access restrictions, authentication, auditing and logging activities, and secure backups. If the hosting company processes ePHI, in addition to HIPAA hosting, a Business Associate Agreement (BAA) is required. In this post, we will talk about HIPAA hosting, when it is required, and what should be considered while choosing a host.
What is HIPAA-Compliant Hosting?
What does it mean when one uses HIPAA-compliant hosting? It means providing a method to secure ePHI that is transmitted, processed, or stored electronically on a website or application.
HIPAA is the Health Insurance Portability and Accountability Act, and PHI is Protected Health Information. PHI is health-related sensitive information about an individual, like medical records, treatment information, or data about a patient. Anything that is in an electronic format about such information is ePHI.
What is the importance of hosting? Because all the sensitive information can be stored on various servers, databases, and backups. Data center security also plays an important role in protecting the underlying infrastructure where this data is stored and processed. All of these components need a secure environment.
HIPAA Compliant Does Not Mean HIPAA Certified
No government badge certifies a hosting company as being “HIPAA certified.” The HHS also does not require any organization to get HIPAA certification. It all depends on how the environment has been set up.
When Does a Website Need HIPAA Compliant Web Hosting?
Not all health care provider websites require HIPAA-compliant hosting. A basic clinic website does not contain any protected health information.
This requirement becomes relevant in case the website or app deals with electronic protected health information (ePHI), including
- Patient medical records
- Patient intake forms
- Telehealth information
- Treatment or appointment details linked to a patient
- Healthcare application databases
- Other identifiable health information
The hosting environment will need to be reviewed if the website stores any ePHI. It does not matter if the website is operated by a healthcare entity. It is necessary to know if the systems that operate the website process any protected health information.
What Makes Hosting HIPAA Compliant and Different From Regular Hosting?
Regular hosting is designed for sites that deal with information that is used in daily operations. In situations where the server contains ePHI, there will be a need for additional security measures in the hosting environment.
| Area | Regular Hosting | HIPAA Hosting |
| Data | General website data | ePHI and sensitive health data |
| BAA | Usually not required | Required when the provider is a business associate |
| Access | Standard account controls | Restricted access with appropriate authentication |
| Logging | May vary by provider | Relevant activity should be recorded and reviewed. |
| Encryption | Often available | Must be appropriately implemented |
| Backups | Standard backup options | Recovery and data protection need careful planning. |
| Responsibilities | General security | Provider and customer duties must be clearly defined. |
The BAA also refers to the business associate agreement. In cases where ePHI is handled by the business associate (BA), that BA must have a BAA agreement with you. The BAA specifies how the BA should handle the information.
In HIPAA hosting, there is more than simply implementing security controls. Physical safeguards, infrastructure, monitoring, backup, and access control systems are among the many elements that must be in place for HIPAA hosting.
Does HIPAA-Compliant Hosting Make a Website HIPAA-Compliant?
No. Hosting that meets HIPAA standards will not make the website HIPAA-compliant. This only covers one part of the infrastructure. But the website operator will have control over collecting, accessing, using, and disclosing patient information. Such things as application security, user permission, employee access, vendor applications, policies and procedures, risk assessment, and incident handling are to be considered.
Even if there is a properly safeguarded server, it will be of no use if there is some application configuration flaw through which patient records become exposed to others. HIPAA compliance should, therefore, be the duty of both parties involved. It is necessary to safeguard the services on the side of a hosting company. Meanwhile, a healthcare organization should assess risks within the environment under its control.
How to Choose HIPAA-Compliant Hosting
Just because a provider claims to be HIPAA-compliant doesn’t mean they really are. Check if the provider is actually protecting your ePHI.
Check their BAA and decide if you want to use their service if they are not ready to sign a BAA. Also decide if you want to use their service if they aren’t willing to provide any hosting services.
Understand your provider’s infrastructure. Look into where ePHI and databases are stored, who has access to ePHI and databases, how administrative access is controlled, whether the environment is capable of user authentication and logging, whether the environment is capable of user permission controls, and how user permissions, backups, and restoration are controlled
Understand the process of how a breach is handled. Know the incident response process. Who does the provider notify, and what is the limit of your liability?
A provider that is truly HIPAA compliant can answer the above questions and won’t rely on their hosting provider to answer those questions.
Is VPS Hosting Suitable for HIPAA Workloads?
Yes, VPS Hosting can be used for HIPAA workloads. Having a VPS does not mean that the environment is HIPAA-compliant. The server has to be appropriately configured and secured to handle ePHI. The hosting provider is also responsible for the controls to secure the environment. The same applies to dedicated and cloud environments. If you want to understand how VPS virtualization differs from a traditional virtual machine, see our guide to VPS vs virtual machine.
Conclusion
Choosing the hosting for healthcare data should not be based on the server specifications and price. The service provider should explain how they manage ePHI across their environment and at what point they fulfill their commitment.
Before signing up, it is important to ensure that the provider offers a BAA, access controls, logging, backups, incident management, and other customer requirements. This is more important than HIPAA hosting. Cantech can help with healthcare workloads in choosing the perfect VPS or cloud infrastructure.
FAQs
What is HIPAA-compliant hosting?
A hosting environment that meets the HIPAA standards allows the customer to control how ePHI is accessed, stored, transmitted, and processed. The environment must also provide a mechanism for generating audit trails and maintaining audit trails for backups and disaster recovery.
Does every healthcare website need HIPAA-compliant hosting?
No, a simple healthcare website that only contains published information about the services offered, contact details, and general information would not be considered a covered entity and is most likely not going to handle ePHI. HIPAA hosting would apply when a website or application handles protected health information.
Does a HIPAA hosting provider need to sign a BAA?
Hosting providers will become business associates if they come into contact with ePHI. A BAA identifies the liability of the business associate in the security and access of PHI.
Is HIPAA-compliant hosting the same as HIPAA-certified hosting?
No. HIPAA does not grant official certifications. Having HIPAA requirements automatically satisfied depends on a hosting provider’s safeguards, configurations, policies, and procedures to secure ePHI.
Can a VPS be HIPAA compliant?
Yes, a VPS can support a HIPAA workload after being properly configured and secured. The provider needs to provide certain assurances regarding their responsibilities, security controls, and contractual assurances. The customer also has to play a role and ensure they are also compliant.
