HIPAA Compliant Website Hosting: Which Hosts Sign a BAA

HIPAA compliant hosting means a web host that signs a business associate agreement (BAA) covering the protected health information it stores or transmits for you: AWS, Google Cloud and Microsoft Azure sign one, Vercel, Wix and Cloudflare sign on named plans, Supabase signs with its HIPAA add-on, and Squarespace, Webflow and Shopify say their website platforms are not for protected health information. HHS treats a cloud provider that stores ePHI for you as a business associate "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data" (HHS). A host's BAA covers your server, not the Meta or Google pixels on your pages. Curve Compliance, which signs a BAA on every plan for HIPAA-compliant ad tracking, checked each host's own page on October 26, 2026.

Book a call. A BAA host keeps your server covered, and your ad tags are a separate question. Curve Compliance replaces browser ad pixels with one script, sends conversions to your ad platforms server-side, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup. Book a call with Curve.

What HIPAA compliant hosting means

HHS's cloud computing guidance sets the rule. When a covered entity uses a cloud service provider (CSP) to create, receive, maintain or transmit ePHI on its behalf, "the CSP is a business associate under HIPAA." Using one is allowed if the covered entity "enters into a HIPAA-compliant business associate contract or agreement (BAA) with the CSP" and "otherwise complies with the HIPAA Rules" (HHS).

A host that stores ePHI is not a mere conduit. HHS says "the conduit exception is limited to transmission-only services for PHI (whether in electronic or paper form), including any temporary storage of PHI incident to such transmission," while a provider that stores ePHI has "more persistent access." There is also no certificate to look for: "OCR does not endorse, certify, or recommend specific technology or products." And the work is shared: "A CSP is not responsible for the compliance failures that are attributable solely to the actions or inactions of the customer" (HHS). See what a business associate is.

Which hosts and site builders sign a BAA?

Each row comes from the host's own page, fetched October 26, 2026, and the rows are in no order of preference. A row marked Specific plans means the BAA is offered only on the plans named.

Host	Signs a BAA?	What it covers	How you get it	Source
AWS	Yes	HIPAA-eligible services only, including Amazon EC2, AWS Amplify Console, Amazon CloudFront and Amazon S3	Accept it in AWS Artifact in the AWS Management Console	AWS HIPAA; eligible services
Google Cloud	Yes	The entire Google Cloud infrastructure, used with the products on Google's supported list	Review and accept the Google Cloud BAA	Google Cloud
Microsoft Azure	Yes	In-scope Azure services	By default through the Microsoft Product Terms; no separate contract	Microsoft Learn
Vercel	Specific plans	Pro and Enterprise customers; core services such as the CDN and Vercel Functions	Pro: buy the HIPAA add-on under Billing in the dashboard. Enterprise: contact your Vercel account team	Vercel
Supabase	Specific plans	Hosted projects with the HIPAA add-on enabled, which Supabase's plans page offers on the Team and Enterprise plans; not self-hosted Supabase	Contact Supabase to sign the BAA, then enable the add-on	Supabase Docs; plans
Cloudflare	Specific plans	Enterprise-level customers; Cloudflare lists Pages, Workers, R2 and Cache/CDN as in scope for its HIPAA Attestation of Compliance	Both parties sign the BAA before any PHI is processed	Cloudflare Trust Hub
GoDaddy	Specific plans (email only)	Microsoft 365 email from GoDaddy; its HIPAA help page does not mention web hosting	Activate HIPAA compliant email, then sign the Microsoft 365 HIPAA BAA	GoDaddy Help
Wix	Specific plans	Business, Plus, Elite, Business Elite and Enterprise plans	Activate PHI protection, then sign the BAA	Wix Help Center
Squarespace	No, for websites	Its BAA covers Acuity Scheduling only	Not offered for website features	Squarespace Help
Webflow	No	None; its terms ask customers not to collect PHI	Not offered	Webflow Terms
Shopify	No	None; its Acceptable Use Policy lists uploading PHI as not supported	Not offered	Shopify AUP

Where a host has a BAA Directory entry, its name links to it, with the vendor's own words. WordPress is software rather than a host, so for a WordPress site the BAA question goes to the company that hosts it and to each plugin vendor that stores form entries; see Gravity Forms on WordPress.

Host by host

AWS. "Yes. AWS has a standard Business Associate Addendum (BAA) we present to customers for signature." Customers "should only process, store, and transmit protected health information (PHI) in the HIPAA-eligible services defined in the Business Associate Addendum (BAA)" (AWS). The eligible list, last updated October 15, 2026, includes Amazon EC2, AWS Amplify Console and Amazon CloudFront, with CloudFront Embedded Point of Presences excluded (AWS).

Google Cloud. "Google enters into Business Associate Agreements as necessary under HIPAA," and "The HIPAA BAA for Google Cloud includes the entire Google Cloud infrastructure, not only a subset of Google Cloud." Google also says to "Disable unsupported Google Cloud services when working with PHI" (Google).

Microsoft Azure. Microsoft says "the HIPAA BAA is available via the Microsoft Product Terms (formerly Online Services Terms) by default to all customers who are covered entities or business associates under HIPAA" (Microsoft).

Vercel. "We sign Business Associate Agreements (BAAs) with customers," and "The HIPAA BAA is available to Enterprise and Pro customers who are covered entities or business associates under HIPAA." (Vercel).

Supabase. "Organizations must have a signed BAA with Supabase and have the Health Insurance Portability and Accountability Act (HIPAA) add-on enabled when dealing with PHI" (Supabase). Its plans page offers HIPAA as an add-on on the Team and Enterprise plans (Supabase), and the controls are on the hosted platform: "These controls are not supported out of the box in self-hosted Supabase" (Supabase).

Wix. "HIPAA compliance is available with Business, Plus, Elite, Business Elite and Enterprise plans," and "Once you’ve activated PHI protection, you can sign the BAA." (Wix).

Squarespace, Webflow and Shopify. Squarespace says "Acuity is the only Squarespace feature currently designed to offer services consistent with HIPAA obligations" (Squarespace). Webflow's terms say "Please do not collect Protected Health Information using the Platform as Webflow does not offer HIPAA compliant services at the present time" (Webflow). Shopify lists "uploading Protected Health Information subject to HIPAA" among activities "not supported by our platform" (Shopify). For Webflow sites, see is Webflow HIPAA compliant.

When a marketing website needs a BAA host

The test is whether the host creates, receives, maintains or transmits PHI for you. Contact and intake forms whose entries the site stores, patient portals and booking pages that hold visit details all put PHI on the host. A site that only publishes pages still raises tracking questions, covered below. If the host you have does not sign a BAA, you can keep PHI off it by running forms on a service that hosts them under a BAA; see form builders that sign a BAA.

The pixel gap: your host's BAA and your ad tags

A host's BAA covers the data the host handles. Ad pixels and tags run in the visitor's browser and send data from there to Meta, Google or TikTok, so the host is not in that path, and the BAA Directory lists Meta and Google Ads as not signing a BAA. Vercel's guide puts the general point plainly: "Each provider that stores or processes PHI is a business associate in its own right, so the BAA chain has to extend all the way down your stack" (Vercel).

So moving to a BAA host does not settle what your pixels send. Check which trackers load on your pages with Curve's free website scan, read what counts as PHI on a website, and see HIPAA-compliant Meta Pixel alternatives. Which rules apply depends on your setup, so talk to your counsel.

How Curve Compliance helps

Your host's BAA covers your server. Curve Compliance covers the ad tracking on top of it, under the BAA it signs on every plan. Curve replaces browser ad pixels with one script and sends conversions server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, contact identifiers are off by default on Meta, Google Ads and TikTok, and Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform.

If your host does not sign a BAA, Curve Forms are hosted by Curve under the same BAA, so form entries stay off your web server. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. For files, see which cloud storage providers sign a BAA.

Sources, checked October 26, 2026: HHS guidance on HIPAA and cloud computing; AWS HIPAA Compliance; AWS HIPAA Eligible Services Reference; Google Cloud HIPAA compliance; HIPAA Compliance with Google Workspace and Cloud Identity; Microsoft, HIPAA Azure compliance; Microsoft, HIPAA and the HITECH Act; Vercel HIPAA guide; Supabase HIPAA compliance; Supabase HIPAA projects; Supabase plans; Wix HIPAA compliance; Squarespace, Acuity Scheduling and HIPAA; Webflow Terms; Shopify Acceptable Use Policy; Cloudflare, HIPAA; GoDaddy, What is HIPAA and HIPAA compliant email?.

Frequently Asked Questions

What is HIPAA compliant hosting?

Hosting from a provider that signs a BAA covering the ePHI it stores or transmits for you, because HHS treats a cloud provider that maintains ePHI as a business associate even when the data is encrypted (HHS). AWS, Google Cloud and Azure offer a BAA, and Vercel, Supabase and Wix offer one on named plans or with an add-on.

What makes a website HIPAA compliant?

There is no certificate: HHS says "OCR does not endorse, certify, or recommend specific technology or products" (HHS). In practice it starts with a BAA from every vendor that stores or receives PHI through the site, from the host to the form and booking tools, and tracking tags that do not send PHI to companies without one, plus your own safeguards; see what counts as PHI on a website.

What is a HIPAA compliant workspace?

Usually a Google Workspace or Microsoft 365 account set up under the vendor's BAA. Google says "Administrators must review and accept a BAA before using PHI in Google services" (Google), and Microsoft makes its BAA available by default to covered entity and business associate customers (Microsoft).

Which platforms are HIPAA compliant?

The ones that sign a BAA for the service you use, set up and used under the HIPAA Rules. For hosting, AWS, Google Cloud and Azure offer a BAA, and Vercel, Supabase and Wix offer one on named plans or with an add-on, while Squarespace, Webflow and Shopify say their website platforms are not for PHI. The BAA Directory covers other categories.

How do I make my website HIPAA compliant?

Put any page or form that collects PHI on a host or form service that signs a BAA, check what each tracking tag on the site sends and to whom, and replace browser ad pixels that could carry PHI to platforms without a BAA. HHS also expects your own risk analysis and safeguards on top of any vendor's BAA (HHS).

Is Microsoft HIPAA compliant?

Microsoft signs a BAA for in-scope services, available by default through its terms to covered entities and business associates, covering Azure and Office 365 services it lists (Azure; Microsoft 365). Microsoft adds that "using Microsoft services doesn't on its own achieve HIPAA compliance" (Microsoft).

How to make Google HIPAA compliant?

For Google Workspace, an administrator reviews and accepts Google's BAA before any PHI goes in, and uses only the covered services (Google). For Google Cloud, enter the Google Cloud BAA and "Disable unsupported Google Cloud services when working with PHI" (Google Cloud). Google Ads is a separate product, and the BAA Directory lists Google Ads as not signing a BAA.

Is Supabase HIPAA compliant?

Supabase says organizations "must have a signed BAA with Supabase and have the Health Insurance Portability and Accountability Act (HIPAA) add-on enabled when dealing with PHI" (Supabase). Its HIPAA controls "are not supported out of the box in self-hosted Supabase" (Supabase).

Talk to Curve Compliance

Book a call. Your host's BAA covers your server. Curve Compliance covers your ad tracking under the BAA it signs on every plan, with conversions sent server-side and PHI stripped before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.