Choosing HIPAA-compliant WordPress hosting starts with understanding what information the site handles and who can reach it. A host may operate the server, but WordPress plugins, forms, backups, support tools, and connected vendors can also touch or store data. Review the whole arrangement before allowing electronic protected health information (ePHI) into the hosting environment.
This checklist is for practice managers preparing questions for their privacy, security, and legal advisers. It is general information, not a determination that a particular host or website is compliant. A vendor’s security statements alone do not replace your organization’s own review.
Map where ePHI could travel
Start by tracing information through the website. Include more than the visible pages and forms. For each feature, ask whether it could create, receive, maintain, or transmit patient information, and identify the systems and people involved.
- Forms: Do appointment requests, contact forms, symptom questions, or referral forms ask for information that could identify a patient or reveal something about their care?
- Uploads: Can visitors attach documents, images, or other files? Where do those files go, and who can access them?
- WordPress data: Could ePHI appear in the site database, plugin records, user accounts, or stored form submissions?
- Operational records: Could web server logs, error reports, email notifications, or support tickets capture sensitive details?
- Copies and connections: Does information reach backups, cloud storage, a content delivery network (CDN), analytics tools, or another connected service?
Document the intended path and check it against the actual configuration. A form might send information to an inbox or third-party service even if the website itself does not keep a visible record. If a page does not need ePHI, consider whether it can avoid collecting it. A separate patient portal may be more appropriate for some workflows; discuss that choice with the practice’s advisers.
For questions specifically about appointment requests, see Zevonix’s guide to a HIPAA-conscious appointment request form.
Decide whether a BAA applies to each service
Do not decide based only on a vendor’s label or a general claim that its platform is “HIPAA compliant.” The relevant questions are what the vendor does for the practice and whether its service handles ePHI. HHS explains that a software vendor’s business associate status depends on whether it creates, receives, maintains, or transmits protected health information on behalf of a covered entity. Review the HHS guidance on software vendors and business associates with the people responsible for your organization’s HIPAA decisions.
Ask the host to describe, in writing, what its service includes and what data it may handle. Then ask your privacy or compliance lead and legal adviser whether a business associate agreement (BAA) is needed for that arrangement. Do not assume that a hosting contract or security addendum is automatically a BAA, or that a BAA by itself establishes that the setup is suitable.
Encryption is important to discuss, but do not treat it as an automatic answer to the BAA question. Ask whether the provider stores or otherwise maintains ePHI for the practice, whether it can access the information, and how the service works if the provider cannot decrypt it. Have the practice’s advisers evaluate the facts and applicable agreements.
Ask who can access the environment
Support staff and technical administrators may need some level of access to maintain a website or investigate a problem. Find out how that access works before relying on a host with ePHI in its environment.
- Which provider roles can access production systems, databases, files, backups, or diagnostic records?
- How is access limited to the people and tasks that need it?
- Are access events recorded, and can the provider explain how those records are reviewed?
- How are temporary support sessions authorized, limited, and ended?
- What process applies when a staff member or subcontractor no longer needs access?
- How does the provider report suspected or confirmed security incidents to the practice?
Ask for concrete explanations rather than relying on broad assurances. Clarify whether provider personnel can see information in a form that is readable, and whether access differs between routine maintenance and emergency support. The practice should also review its own WordPress administrator accounts, plugin permissions, and other access paths.
Review safeguards and responsibilities
Hosting security is shared work. The provider may manage infrastructure, while the practice remains responsible for decisions about what the site collects, who has WordPress access, and which tools or plugins it uses. Agree on who handles each task instead of assuming that the host covers every part of the site.
Ask how the hosting arrangement addresses system protection, updates, access controls, monitoring, incident communication, and recovery. Then review the WordPress layer: how core software, themes, and plugins are maintained; how accounts are protected; and how changes are tested. The NIST guide to implementing the HIPAA Security Rule can help inform a broader security review, but it does not certify a particular host or replace your organization’s risk analysis.
Backups deserve their own questions. Ask what is copied, where those copies are stored, who can restore or retrieve them, and how access is controlled. Find out whether logs, support records, and stored form entries are included in the review as well. Ask how recovery is tested and who coordinates a restore. A backup can contain sensitive data too, so it belongs in the data-flow and vendor review.
For a wider set of WordPress security considerations, review the site’s advice on website security practices.
Include subcontractors and connected tools
A host may rely on other companies for services such as cloud infrastructure, backups, CDN delivery, monitoring, or technical support. A website may also send information to form processors, analytics tools, or email services. List these services and determine what data each one receives or can access.
Ask the host to identify relevant subcontractors and explain how they fit into the service. Ask which agreements cover their access to ePHI and how the host communicates changes to those arrangements. Your practice’s advisers should review whether each vendor relationship needs a BAA and whether the agreements and safeguards match the actual data flows. Apply the same review to tools added by the practice or its website team.
Pay particular attention to tracking and analytics on pages where a visitor may enter or view patient-related information. Check what the tool collects, where the data goes, and whether it could capture information that identifies a visitor or their interaction with the practice. Do not assume a tool is harmless simply because it is commonly used on websites.
Plan for incidents and changing hosts
Before signing, establish how the provider will notify the practice about incidents involving its systems, what information the notice will include, and how the parties will coordinate their response. Confirm who to contact and how urgent issues are escalated. Also clarify what records the provider can supply to support the practice’s review.
Plan for the end of the relationship before it happens. Ask how the practice can retrieve its website files, databases, and backups; how the provider handles remaining copies; and what secure disposal process applies. Include relevant subcontractors and connected services in the transition plan. A move is not complete merely because a new website is online if sensitive copies remain in old accounts or storage.
If you are comparing providers, Zevonix manages and hosts WordPress websites on secure VPS infrastructure and lists daily automated backups, security monitoring, and uptime monitoring among its offerings. Ask any prospective provider, including Zevonix, the same data-access and agreement questions, and have your practice’s advisers assess whether the specific setup fits your needs.
Frequently asked questions
Does a WordPress hosting provider need to sign a BAA?
It depends on the services and the provider’s relationship to the ePHI. Ask what information the host creates, receives, maintains, or transmits on the practice’s behalf, then have the practice’s privacy or legal adviser determine whether a BAA is needed.
Does encryption mean the host is not a business associate?
Not by itself. Ask whether the host maintains ePHI for the practice and how encryption and access work in the actual service. Have your advisers review the arrangement rather than relying on encryption as a shortcut.
Do backups, logs, and support tickets belong in the review?
Yes. They may contain or expose sensitive information, so include them when mapping data flows, assessing access, and reviewing vendor relationships.
What should happen to ePHI when changing hosts?
Agree on how the practice will retrieve needed data and backups, how remaining copies will be handled, and how connected vendors will be addressed. Coordinate the transition with the people responsible for the practice’s privacy and security decisions.
Make the decision with the full data flow in view
Before a WordPress host handles ePHI, document where information goes, who can reach it, which safeguards apply, and how vendors and backups fit into the arrangement. Then review the contracts and responsibilities with the practice’s privacy, security, and legal advisers. If you want to discuss a WordPress hosting arrangement, contact Zevonix at (904) 658-0777 and bring your data-flow and vendor questions to the conversation.