HIPAA-Friendly Domain Hosting

GoDaddy provides a variety of services including website hosting, email management, and domain names. Covered entities can use email services for protected health information, but website hosting services may not meet HIPAA requirements.For example, basic website hosting plans are on shared servers. Other technical and physical safeguards aren’t in place for these plans. Covered entities shouldn’t use GoDaddy shared hosting for websites containing patient information.GoDaddy also offers email services through Microsoft Office 365. Two plans, Business Premium and Premium Security, offer HIPAA compliance features. Covered entities may purchase HIPAA-friendly email as an add-on to the service. All email accounts offer the option of full integration with Microsoft Office.

Bluehost provides customers with a variety of security features, including SSL certification and HTTPS protocol. While these security features are necessary steps for HIPAA compliance, they aren’t enough. HIPAA compliance requires access control and audit control for digital security. Additionally, facility controls must include physical safeguarding of server equipment.The company is transparent that its services aren’t authorized for patient health data and identifiable medical information.Covered entities that need web hosting services for PHI should choose a service that meets HIPAA requirements.

In its terms of service, SiteGround has stated in a HIPAA disclaimer section that customers are prohibited from using its services to store PHI.Covered entities that need web hosting services should choose a provider that offers digital and physical HIPAA-compliant safeguards. While most hosting providers provide HTTPS protocol and SSL certification for security, these features alone aren’t sufficient to meet HIPAA requirements. For a hosting account to be HIPAA compliant, it must include physical safeguards to protect equipment and servers. Audit controls and access controls are other digital security features that help with HIPAA compliance.