HIPAA → Checklist

HIPAA-Compliant Hosting Checklist

HIPAA-compliant hosting helps ensure that any protected health information (PHI) stored, processed, or transmitted through your hosting environment is safeguarded according to the strict security and privacy standards mandated by the Health Insurance Portability and Accountability Act

This not only helps prevent costly data breaches and regulatory penalties, but also protects patient trust by ensuring their sensitive health data remains confidential, accurate, and available. 

For covered entities and business associates, choosing a HIPAA-compliant hosting provider is a foundational step in meeting legal obligations while maintaining secure, reliable access to critical healthcare systems.

How do you know if your hosting provider really is doing everything you need to achieve compliance? Here’s your HIPAA-compliant hosting checklist.

Get HIPAA-compliant hosting

Standalone servers in private data centers with industry-leading security

HIPAA compliance as a shared responsibility

But first: HIPAA-compliant hosting doesn’t mean your hosting provider magically makes your website or applications compliant. 

Compliance is a shared responsibility between the provider and your organization. The host handles the security and infrastructure safeguards, while you configure your applications, manage user access, and ensure your business processes follow HIPAA rules.

If you store, process, or transmit protected health information (PHI), both sides must work in sync. Your provider should meet strict technical, administrative, and physical security standards—but you must also train your staff, manage risk assessments, and follow privacy procedures on your end.

Technical safeguards for HIPAA-compliant hosting

The right hosting setup must include strong technical protections to safeguard PHI.

uncheckedEncryption in transit and at rest – Use SSL/TLS for web traffic and AES-256 or equivalent for stored data. Encryption must extend to backups and database storage.

uncheckedSSL certificates – All web portals, APIs, and admin interfaces must be secured with valid SSL certificates.

uncheckedAccess controls – Implement role-based permissions, strong password policies, and unique logins for all users with PHI access.

uncheckedTwo-factor (multi-factor) authentication – Require MFA for server logins, control panels, and database access to reduce the risk of compromised credentials.

uncheckedFirewall protection – Deploy fully configured firewalls to block unauthorized inbound and outbound traffic.

uncheckedHost intrusion detection system (HIDS) – Monitor file integrity, system logs, and unusual activities on the host.

uncheckedAntivirus and anti-malware protection – Use continuous scanning to block malicious files and scripts before they can affect ePHI.

uncheckedAnti-DDoS management – Ensure the hosting environment can withstand denial-of-service attacks without interrupting PHI availability.

uncheckedSystem monitoring and logging – Keep continuous watch over CPU, memory, and network usage, while logging all access and changes.

uncheckedIntegrity controls – Implement tools that ensure ePHI isn’t altered or deleted without authorization.

uncheckedPrivate hosted environment – Use a dedicated server or private cloud environment with isolated resources to avoid shared hosting risks.

uncheckedDynamic data availability – Build redundancy into the system to maintain 24/7 access to PHI, even during maintenance or hardware failure.

Backup and recovery measures

HIPAA requires data to remain accessible even after unexpected failures or disasters.

uncheckedEncrypted backups – All backup data should be encrypted using the same standards as your live environment.

uncheckedOffsite backups – Store backups in a secure, geographically separate location to protect against data center-level disasters.

uncheckedDisaster recovery plan – Maintain a clear plan with defined roles and timelines for restoring PHI systems after outages.

Incident response readiness

Even with strong prevention, you must be ready to respond to security events.

uncheckedIncident response plan – Define exactly how your team and hosting provider will detect, contain, investigate, and resolve incidents involving PHI.

uncheckedBreach notification – Follow HIPAA’s breach notification requirements, including timely communication with affected parties and regulators.

Additional considerations for HIPAA-compliant hosting

Some best practices go beyond HIPAA’s minimum standards but significantly reduce risks.

uncheckedEncrypted VPN for remote access – Require all staff and administrators to connect through a secure VPN when accessing the hosting environment remotely.

uncheckedSegregated development and production environments – Keep testing and staging systems completely separate from production systems handling live PHI.

uncheckedRole-based vendor access – Give third-party vendors only the access they need and log all vendor activity.

uncheckedScalable infrastructure – Make sure your hosting environment can handle growth without compromising security or performance.

Melanie Purkis is the Director of Liquid Web’s Managed Hosting Products & Services. Melanie has more than 25 years of experience with professional leadership, project management, process development, and technical support experience in the IT industry.

Let us help you find the right hosting solution

Loading form…