Web hosting and HIPAA: do hosts sign a BAA?

If your practice's website collects patient information (a contact form about symptoms, online booking, intake forms), the web host stores it. We checked what each of the 10 hosts in our web hosting ranking says about signing a Business Associate Agreement (BAA). All were read on Sep 26, 2026.

What a BAA is

The US Department of Health and Human Services puts it this way: "The HIPAA Rules permit a covered entity to disclose PHI to a business associate if the covered entity obtains satisfactory assurances, in the form of a contract or other written arrangement (collectively referred to as a 'business associate agreement,' or BAA), that the business associate will appropriately safeguard the information, among other obligations." (HHS, checked Sep 25, 2026.)

The 7 hosts that say they won't sign one

• Bluehost: "Bluehost does not sign “Business Associate Agreements,” and you agree that Bluehost is not a Business Associate or subcontractor or agent of yours pursuant to HIPAA."
• DreamHost: "Is DreamHost HIPAA compliant? DreamHost is not HIPAA compliant."
• GoDaddy: "The Hosting Services are not intended to provide a PCI (Payment Card Industry) or HIPAA (Health Insurance Portability and Accountability Act) compliant environment and therefore should not be used or considered as one."
• HostGator: "We do not sign "Business Associate Agreements" and you agree that HostGator is not a Business Associate or subcontractor or agent of yours pursuant to HIPAA."
• Hostinger: "As for Health Insurance Portability and Accountability Act, our hosting services are not intended to provide a HIPAA-compliant environment according to our Hosting Agreement."
• Kinsta: "Kinsta does not offer a HIPAA-compliant hosting product, and we do not enter into Business Associate Agreements (BAAs) with our customers."
• WP Engine: "WP Engine does not sign BAAs and should not be used as a repository for patient health records."

The 3 hosts that don't say

• Cloudways: we found no statement on its own pages. We checked its help centre, legal and security pages.
• InMotion Hosting: we found no statement on its own pages. We checked its help centre, legal and security pages.
• SiteGround: we found no statement on its own pages. Its site showed our automated browser a robot check, so we could not read its terms.

What this means for a practice

None of the hosts we rank says it will sign a BAA for the hosting it sells, so our ranking has no list for healthcare practices. A practice that needs patient information on its website can keep that information off the site (for example, a booking or form tool from a vendor that does sign a BAA) or look for a host that offers one in writing.