Choose a hosting provider by checking the exact services that will handle electronic protected health information (ePHI), the scope of the provider’s business associate agreement (BAA), and the safeguards and responsibilities assigned to each party. A BAA is essential when a provider handles ePHI for a covered entity or business associate, but neither the agreement nor a “HIPAA-compliant” marketing claim makes your own systems compliant. Your organization must assess and manage risk in its actual configuration.
Start with the service and data you plan to host
List the systems and information that will contain ePHI, then trace how that information will be created, received, maintained, or transmitted. Include storage, backups, support access, integrations, and any other service involved in the data path. Ask each provider to identify the precise products, regions, support functions, and subprocessors covered by its BAA. Do not assume an agreement covers every service sold by the same company.
As an Amazon Associate I earn from qualifying purchases.
Under HHS guidance, a cloud service provider (CSP) that handles ePHI on behalf of a covered entity or business associate is generally a business associate and needs an appropriate BAA. That remains true when the provider maintains encrypted data but does not hold the decryption key. See HHS guidance on HIPAA and cloud computing.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Compare providers against the same criteria
Use a written comparison so that each candidate is evaluated on the same services and requirements. A BAA offer or security badge alone is not enough.
#1 Best Overall
| What to compare | Questions to ask |
|---|---|
| BAA scope | Does the BAA cover the exact service, account, support, storage, and transmission paths that will handle ePHI? Are permitted uses and disclosures defined, and are appropriate safeguards required? |
| Security responsibilities | For this architecture, who implements identity and access controls, infrastructure access restrictions, encryption, configuration, monitoring, and incident response? Is the allocation documented and consistent with your risk analysis? |
| Availability and recovery | What availability commitment applies? How are backups, restoration, disaster recovery, and ransomware recovery handled? What evidence supports the stated commitments? |
| Incident and breach response | Which events must the provider report, to whom, and on what contractual timetable? What information will it provide so your organization can assess and respond? |
| Subcontractors and locations | Which downstream parties may handle ePHI, and where will it be stored or supported? What protections and oversight apply to those parties? |
| Assurance and evidence | What independent reports, security documentation, or diligence answers can the provider make available? Which evidence does your organization need to manage its risks? |
| Data return and deletion | At termination, can you retrieve data in a usable format? When will remaining copies be returned or destroyed where feasible, and what retention terms apply? |
| Contract consistency | Do the BAA, service-level agreement (SLA), service terms, security exhibits, and exit terms agree? Does any term conflict with the BAA’s obligations? |
Review the BAA and SLA together
The BAA should address permitted uses and disclosures, safeguards, incident and breach reporting, subcontractors, access to records, and return or destruction of PHI at termination when feasible. HHS provides sample business associate agreement provisions that identify relevant contract topics.
Read the SLA alongside the BAA rather than treating it as a separate uptime document. Check availability and reliability commitments, backup and recovery arrangements, responsibility allocations, retention and disclosure limits, and the process for returning data when the relationship ends. The contract package should describe what the provider actually undertakes, not leave essential responsibilities ambiguous.
Rank #2
Map shared responsibilities to your own risk analysis
Security duties can be divided between the CSP and the customer. The division depends on the services purchased, the architecture, the parties’ risk-management plans, and their contract. For example, a provider may operate underlying infrastructure while the customer remains responsible for configuring access to its application or stored data. Do not infer responsibility from a product description; get the allocation for your specific deployment in writing.
HHS says customers should understand the particular cloud environment so they can conduct their own risk analysis and establish risk-management policies. A BAA is necessary where required, but it does not perform that analysis for you or establish that your configuration meets your obligations. Identify how ePHI will flow, which safeguards apply at each point, who operates them, and how gaps will be addressed.
Evaluate assurances without treating them as a HIPAA certificate
HHS does not endorse, certify, or recommend specific technology, products, or hosting providers. A provider’s badge or claim is not an HHS approval, and choosing a hosting plan does not by itself make a customer’s environment HIPAA-compliant.
Ask for security documentation, independent reports, and answers to diligence questions that your risk analysis calls for. However, HIPAA does not expressly require a CSP to provide customers with documentation of its security practices or to permit customer audits. HHS explains this distinction in its FAQ on CSP documentation and customer audits. Negotiate the evidence and assurances your organization needs rather than assuming they are automatically available.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Account for service location and the full data lifecycle
Overseas storage is not categorically prohibited by HIPAA, according to HHS. But location can affect risks, vulnerabilities, and the practical enforceability of protections, so assess storage and support locations as part of the organization’s risk analysis. Include subcontractors and support functions—not only the primary data center—in that review.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsBefore signing, establish how you will retrieve data if the relationship ends, what format it will be in, what copies may remain, and when return or destruction will occur where feasible. Confirm retention rules and ensure those exit terms fit your continuity and record-management needs.
Quick Recap
A practical decision process
- Inventory ePHI and services. Identify the workloads, data flows, support functions, storage, and transmission services that will touch ePHI.
- Confirm BAA coverage. Match each in-scope service and relevant region or subprocessor to the provider’s written BAA scope.
- Map safeguards and ownership. Document which party handles each administrative, technical, and operational safeguard in the actual architecture.
- Compare operational terms. Record availability, backup, restoration, disaster recovery, incident notice, and customer-information commitments for every candidate.
- Assess assurance and location. Request evidence needed for your risk analysis, identify downstream parties and locations, and account for remaining risks.
- Reconcile the contract package. Review the BAA, SLA, service terms, security exhibits, retention rules, and exit provisions together; resolve gaps or conflicts before deployment.
- Complete your risk analysis. Decide whether the proposed service and your configuration adequately address risks to ePHI, and document any risk-management steps still required.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
