Before putting electronic protected health information (ePHI) in a cloud hosting service, confirm that the specific service and support work are covered by a business associate agreement (BAA), understand which safeguards you must operate, and assess the risks in your own environment. Then compare providers’ written terms for incidents, recovery, availability, subcontractors, and what happens to your data when the service ends. A provider’s “HIPAA compliant” claim is not a government certification.
Does HIPAA certify cloud hosting providers?
No. The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) says in its Guidance on HIPAA & Cloud Computing, last reviewed December 23, 2022: “OCR does not endorse, certify, or recommend specific technology or products.” Treat a provider’s compliance language as a claim to investigate, not proof that your organization’s use of the service meets its obligations.
As an Amazon Associate I earn from qualifying purchases.
Whether a particular arrangement satisfies HIPAA depends on the services involved, the parties’ responsibilities, the contract, and your organization’s safeguards and risk analysis. This is a federal HIPAA-focused buying checklist, not a compliance determination for a particular organization or configuration. State law and other contractual requirements may also apply.
What to verify before buying HIPAA hosting
1. Identify every service that may handle ePHI
List the exact hosting services, environments, and support functions that may create, receive, maintain, or transmit ePHI. Include relevant operations and support—not just the main storage or compute service. If a provider performs any of those functions for a regulated organization, it generally acts as a business associate.
#1 Best Overall
- Enterprise-grade prevention, detection, correlation and response from the perimeter to the endpoint with our Total Security Suite.
- Gain critical insights about network security, from anywhere and at any time, with WatchGuard Cloud.
- Built-in compliance reports, including PCI and HIPAA, mean one-click access to the data you need to ensure compliance requirements are met.
- Up to 18 Gbps firewall throughput. Turn on all additional security services and still see up to 2.4 Gbps throughput.
Do not assume that encryption, or the provider’s inability to decrypt the data because it lacks the key, removes that relationship or its obligations. HHS’s cloud guidance says a BAA is required for a business associate relationship even in that situation.
2. Get a BAA that covers the actual arrangement
Confirm the provider will sign a BAA covering the identified services and functions before ePHI is placed in them. Review the agreement for permitted uses and disclosures, safeguards, security-incident and breach reporting, and subcontractor obligations. Check that the contracted scope matches what you plan to deploy; a general promise or a BAA covering a different service is not a substitute.
Ask which subcontractors may handle ePHI and how the contracting chain is addressed. HHS explains that a business associate must have a BAA with its subcontractor before disclosing PHI for the subcontractor’s work.
3. Put the division of security work in writing
Request a service-specific responsibility matrix that distinguishes provider-operated controls from settings and processes your organization must configure, monitor, or document. Map those assignments to your environment and risk-management plan, and keep the allocation in the BAA or related written materials.
Assess administrative, physical, and technical safeguards in context. In particular, document who manages customer identity and access settings, provider administrative-tool access, logging, encryption, patching, and incident response. HHS notes that customer authentication controls do not remove a provider’s need for appropriate internal controls over its administrative tools.
4. Perform your own risk analysis
A BAA does not perform the customer’s risk analysis or configure the customer’s safeguards. HHS’s Guidance on Risk Analysis describes risk analysis as foundational and says it must reflect the organization and its environment. Assess the ePHI you create, receive, maintain, or transmit, and the threats and vulnerabilities introduced by the selected cloud arrangement. Use what you learn to guide your risk-management plan and the evidence or contract terms you need.
Rank #3
Consider the service architecture, deployment model, administrative access, and data locations in that analysis. HHS says overseas storage is permitted when the parties have a BAA and comply with HIPAA, while also noting that location can affect risk and enforcement considerations.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall5. Evaluate encryption without treating it as the whole answer
Ask how encryption is applied, who controls the keys, and which parts of the service or workflow it covers. Then assess integrity, availability, backups, recovery, and administrative and physical safeguards separately. HHS cautions that encryption alone does not maintain data integrity or availability and does not replace contingency planning or other safeguards.
Check who owns and can access backups, how recovery works, and whether your organization can restore usable data and systems after an incident. Make sure the recovery approach fits your own operations; a statement that backups exist does not establish that recovery will meet your needs.
Rank #4
- PHYSICAL KEY AUTHENTICATION – NO PASSWORDS: Access is controlled by a unique hardware CipherKey—no key, no access. Removing the key or cutting power instantly locks and encrypts all data, preventing unauthorized use if the drive is lost or stolen. Bundled with 1 key.
- AES 256-BIT HARDWARE ENCRYPTION (FIPS 140-2 LEVEL 2): Real-time, NIST-certified Full Disk Encryption is handled entirely at the hardware level—immune to malware, OS attacks, and SATA bypass attempts.
- SMART INSERT KEY OPERATION OPTION: Mode 0 requires the key to remain inserted for continuous access; Mode 1 Hot-Plug (select models) allows key removal after authentication for uninterrupted backups and large transfers.
- HIGH-SPEED, PLUG-AND-PLAY PERFORMANCE: USB 3.2 Gen 1 (USB 3.0) delivers speeds up to 5 Gbps. Bus-powered design requires no external power, drivers, or software. Available in SSD or HDD configurations.
- COMPLIANCE-READY & CROSS-PLATFORM: Meets HIPAA, HITECH, FERPA, and SOX requirements. Compatible with Windows, macOS, and Linux, plus Windows Server editions.
6. Read the BAA, service-level agreement, and exit terms together
Compare the written commitments for availability and reliability, backup and recovery, security responsibilities, and incident communication. Read service-level agreement (SLA) provisions alongside the BAA: HHS advises that SLA terms should be consistent with the BAA and HIPAA Rules, and must not prevent access to ePHI. The BAA should explain how the provider makes ePHI available for relevant customer obligations.
Examine what happens at termination: how and when ePHI is returned, whether you can access it during transition, what happens to retained copies, and how the provider handles data when return or destruction is infeasible. Review limits on use, retention, and disclosure as part of the same contractual picture.
Free tools Windows power users keep installed
One-click scans. No signup required.
7. Ask for evidence suited to your risks
Ask what security documentation, audit information, or other assurances the provider will make available, and negotiate for what your risk analysis and compliance activities warrant. HHS says the HIPAA Rules do not expressly require a cloud provider to provide security documentation or allow customer audits. Those rights may be negotiated in the BAA, SLA, or related documents; do not treat a particular report, audit right, or certification as a universal HIPAA requirement.
Best Value
- The Encrypted Drive includes both USB-C and USB-A Adapters to make your out-of-box experience great. Ready for any USB-C or USB-A ports on your computer, laptop, phone, or other systems with USB support. Full USB 3.2 Speeds up to 5MBs. TAA Compliant, CJIS, HIPAA, CMMC, GDPR Compliant.
- The Secure Stick (Encrypted USB) does not require any software or drivers to validate or unlock the drive. The built-in battery allows unlocking the drive before insertion making it easy to insert into hard-to-reach USB ports.
- USB 3.2/3.1./3.0/2.0 is compatible with all systems and Operating systems. The USB Flash Drive comes formatted FAT32, but you can easily reformat it for Win, Mac, or Linux.
- Protect your files on the wireless flash drive with the Antivirus SW included on the drive. AV runs from the drive and scans all files written to it. This is a subscription service and the first year is included. Go online to activate the license.
- Military Grade, XTS-AES 256-bit Hardware Encryption and made with aircraft grade crush-proof aluminum sleeve keeps the data and the drive safe. Rated IP68 to protect the drive from water or dust when the sleeve is on.
Compare hosting options side by side
Use the same workload and questions for each candidate. Record the provider’s answer and the contract or evidence that supports it; a marketing page alone does not resolve a gap in the written arrangement.
| Comparison axis | What to compare |
|---|---|
| BAA scope | Whether the specific services and support work touching ePHI are covered, and how permitted uses, disclosures, and downstream contractors are addressed. |
| Responsibility split | Which party operates or configures identity and access, encryption, logging, administrative access, patching, and incident response; obtain the allocation in writing. |
| Risk fit | Whether the architecture, deployment model, and data locations address risks identified in your organization’s analysis. |
| Resilience | Availability commitments, backup ownership, recovery processes, and your ability to obtain usable restored ePHI. |
| Incident handling | Security-incident and breach-notification terms, contacts, and timelines. |
| Evidence and assurance | What documentation, audit information, or other assurances the provider will supply under contract, tailored to your risk analysis. |
| Exit and portability | Return or destruction of data, handling of retained copies, and access during transition. |
Keep proposed Security Rule changes distinct from effective requirements
An HHS factsheet for the Security Rule Notice of Proposed Rulemaking issued December 27, 2024 describes proposed changes, including more specific risk-analysis and asset-inventory expectations, recurring audits and verification, encryption, multifactor authentication, scanning and penetration testing, network segmentation, and backup and recovery provisions. A proposed rule is not, on that basis alone, an effective requirement. Check current rulemaking materials and any final rule’s effective date before treating a proposal as binding.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
