iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
General cloud services can be used for electronic protected health information (ePHI); HIPAA does not require a particular public, private, or hybrid cloud setup. The key questions are whether each provider handling ePHI has the appropriate business associate agreement (BAA), which services and safeguards the arrangement actually covers, and whether your practice manages its own HIPAA responsibilities. “Managed HIPAA hosting” describes a service model, not proof that a practice or system is compliant.
Is general cloud allowed for ePHI?
Yes. The U.S. Department of Health and Human Services (HHS) says a covered entity or business associate may use a cloud service provider (CSP) to create, receive, maintain, or transmit ePHI on its behalf if it enters into a HIPAA-compliant BAA with that CSP and otherwise complies with the HIPAA Rules. HHS does not require a specific cloud deployment model. Public, private, hybrid, and other configurations may be used, though the configuration can affect risk analysis, risk management, and the BAA’s terms. See HHS guidance on HIPAA and cloud computing.
That means the useful comparison is not “HIPAA cloud versus non-HIPAA cloud.” It is the actual service arrangement: what can handle ePHI, which parties are business associates, what the contracts cover, and who performs each security and operational task.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →What is different about managed hosting and general cloud?
Managed hosting generally signals that a provider takes on some operational work in addition to supplying infrastructure. General cloud may leave more design and day-to-day operating work to the customer. These are service-model tendencies to confirm in the contract—not guarantees about any particular vendor’s security, compliance, or level of support.
#1 Best Overall
- Enterprise-grade prevention, detection, correlation and response from the perimeter to the endpoint with our Total Security Suite.
- Gain critical insights about network security, from anywhere and at any time, with WatchGuard Cloud.
- Built-in compliance reports, including PCI and HIPAA, mean one-click access to the data you need to ensure compliance requirements are met.
- Up to 18 Gbps firewall throughput. Turn on all additional security services and still see up to 2.4 Gbps throughput.
| What to compare | Managed HIPAA hosting | General cloud |
|---|---|---|
| Who operates the environment? | The provider may manage specified infrastructure or operational tasks; verify the exact scope, exclusions, and response duties in the contract. | The customer may be responsible for more of the design and operation; confirm which tasks the provider performs and which remain yours. |
| Which services may handle ePHI? | Confirm the BAA’s covered services and any limits; the “managed” label alone does not establish coverage. | Check eligibility and contract coverage service by service. For example, AWS says customers should use only HIPAA-eligible services identified under its Business Associate Addendum when processing, storing, or transmitting PHI: AWS HIPAA Compliance. |
| How does the configuration affect HIPAA work? | Its architecture and division of responsibilities still need to be understood and assessed by the practice. | The chosen cloud configuration can affect the practice’s risk analysis, risk management, and BAA provisions. |
| Does the model establish compliance? | No. A hosting description or contract does not by itself establish that the practice meets its obligations. | No. Using cloud is permitted under the conditions HHS describes, but the practice must also meet its own HIPAA obligations. |
The hosting label is therefore less useful than a written account of who does what. Ask the provider to identify the services in scope, the administrative and technical tasks it performs, and the tasks your practice must perform. HHS explains that a covered entity or business associate engaging a CSP should understand the specific cloud solution so it can conduct its own risk analysis, establish risk management policies, and enter into appropriate BAAs.
When does a cloud provider need a BAA?
A CSP can be a business associate when it creates, receives, maintains, or transmits ePHI on behalf of a covered entity or another business associate. HHS says this can be true even when the provider cannot decrypt encrypted information it maintains. Do not assume that encryption or lack of access to readable records, by itself, removes a provider from the BAA requirement. HHS explains business associate roles in its Business Associates guidance and Business Associates FAQ.
Check the agreement against the actual data flow. If a cloud service, support function, backup, or other part of the arrangement handles ePHI on the practice’s behalf, establish whether that party is covered by the appropriate BAA and whether the relevant service is within its scope. Do not infer that a provider’s BAA applies to every service it sells.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Does a BAA or “HIPAA-compliant” hosting make a practice compliant?
No. A BAA sets contractual terms, including permitted and required uses and disclosures of ePHI and safeguards; it does not transfer all of the practice’s HIPAA duties to the vendor. HHS places responsibility on the covered entity or business associate to understand the cloud solution, perform its own risk analysis, and manage its risks. A product name, security claim, or signed BAA is not a substitute for those activities.
Rank #3
For a telehealth practice, that means documenting the relevant systems and risks, deciding how risks will be managed, and confirming that the practice can carry out the safeguards and operational responsibilities assigned to it. The vendor’s obligations and the practice’s obligations should be distinguishable in the contract and in day-to-day procedures.
How should a telehealth practice compare providers?
Use the same questions for a managed-hosting proposal and a general-cloud design. Record the answers for the specific services and configuration under consideration rather than relying on a broad compliance statement.
Rank #4
- PHYSICAL KEY AUTHENTICATION – NO PASSWORDS: Access is controlled by a unique hardware CipherKey—no key, no access. Removing the key or cutting power instantly locks and encrypts all data, preventing unauthorized use if the drive is lost or stolen. Bundled with 1 key.
- AES 256-BIT HARDWARE ENCRYPTION (FIPS 140-2 LEVEL 2): Real-time, NIST-certified Full Disk Encryption is handled entirely at the hardware level—immune to malware, OS attacks, and SATA bypass attempts.
- SMART INSERT KEY OPERATION OPTION: Mode 0 requires the key to remain inserted for continuous access; Mode 1 Hot-Plug (select models) allows key removal after authentication for uninterrupted backups and large transfers.
- HIGH-SPEED, PLUG-AND-PLAY PERFORMANCE: USB 3.2 Gen 1 (USB 3.0) delivers speeds up to 5 Gbps. Bus-powered design requires no external power, drivers, or software. Available in SSD or HDD configurations.
- COMPLIANCE-READY & CROSS-PLATFORM: Meets HIPAA, HITECH, FERPA, and SOX requirements. Compatible with Windows, macOS, and Linux, plus Windows Server editions.
- Map the ePHI. List the systems and services that create, receive, maintain, or transmit ePHI, including the relevant hosting and telehealth communication components.
- Confirm business associate roles. Identify which providers act on the practice’s behalf with ePHI and obtain an appropriate BAA where required.
- Check the service scope. Match the services the practice plans to use against the provider’s BAA and any service-specific eligibility terms. For cloud platforms, do not treat the platform name as a blanket statement about every service.
- Assign responsibilities. Ask who configures and monitors safeguards, handles incidents, maintains the environment, and performs each other operational task. Record what remains with the practice.
- Assess the actual configuration. Use the planned architecture and data flows in the practice’s risk analysis and risk management, rather than assessing only the vendor’s marketing category.
- Check operational fit. Confirm that the practice has the people, procedures, and visibility needed to perform its remaining duties and respond to the risks it identifies.
A proposal that clearly identifies its covered services, contractual limits, task ownership, and support processes is easier to assess than one that relies on a general “HIPAA-ready” label. HHS’s cloud guidance notes that the chosen configuration can affect both risk management and BAA provisions.
Free tools Windows power users keep installed
One-click scans. No signup required.
What else matters for telehealth besides hosting?
Hosting is only one part of the technology used to deliver telehealth. HHS recommends developing a privacy and security strategy that includes a risk analysis. Patient and provider access choices matter too: unsecured devices and public Wi-Fi can increase risks of interception or unauthorized access. See Telehealth.HHS.gov’s guidance on developing a privacy and security telehealth strategy and getting started with telehealth privacy and security.
Best Value
- The Encrypted Drive includes both USB-C and USB-A Adapters to make your out-of-box experience great. Ready for any USB-C or USB-A ports on your computer, laptop, phone, or other systems with USB support. Full USB 3.2 Speeds up to 5MBs. TAA Compliant, CJIS, HIPAA, CMMC, GDPR Compliant.
- The Secure Stick (Encrypted USB) does not require any software or drivers to validate or unlock the drive. The built-in battery allows unlocking the drive before insertion making it easy to insert into hard-to-reach USB ports.
- USB 3.2/3.1./3.0/2.0 is compatible with all systems and Operating systems. The USB Flash Drive comes formatted FAT32, but you can easily reformat it for Win, Mac, or Linux.
- Protect your files on the wireless flash drive with the Antivirus SW included on the drive. AV runs from the drive and scans all files written to it. This is a subscription service and the first year is included. Go online to activate the license.
- Military Grade, XTS-AES 256-bit Hardware Encryption and made with aircraft grade crush-proof aluminum sleeve keeps the data and the drive safe. Rated IP68 to protect the drive from water or dust when the sleeve is on.
Video, messaging, or other communication vendors also need to be considered separately from the hosting arrangement. HHS says covered providers and health plans must use telehealth communication vendors that comply with HIPAA and will enter into BAAs for relevant communication products. Its HIPAA rules for telehealth technology describe the applicable vendor considerations.
HHS also describes a limited conduit circumstance for certain telecommunications providers with only transient access to PHI in audio-only telehealth. That narrow example is not a general exemption for hosting providers or vendors that maintain ePHI. See HHS guidance on audio-only telehealth.
Which model should a practice choose?
Choose based on the work your team can responsibly operate and the specific arrangement a provider will put in writing—not on the word “managed” or “cloud.” Managed hosting may suit a practice that wants a provider to take on defined operational tasks, provided the scope and remaining duties are clear. General cloud may suit a practice able to design and manage more of its environment, provided it selects covered services and can meet its responsibilities. The available HHS guidance does not establish that either model is universally safer, cheaper, or more compliant.
The decision is complete only when the practice understands which services handle ePHI, which agreements apply, how the system is configured, and what work remains its own.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
