HIPAA and Business Associate Agreements
Last updated: October 27th, 2026
This page explains when Last Hour Hosting can be used with protected health information (PHI), what a Business Associate Agreement (BAA) with us covers, and what we will not accept. It is part of our Terms of Service and should be read with section 20 of those Terms and section 10 of the Acceptable Use Policy.
1. The short version
- By default, we are not a HIPAA business associate and you may not store PHI with us.
- We will sign a BAA for eligible services after a short architecture review. It is a paid arrangement, because it carries real obligations on both sides.
- Without a signed BAA, a service is not HIPAA-eligible — whatever the software running on it is capable of.
2. Why we say this so bluntly
Earlier versions of our Terms described a “Configurable HIPAA Server” without explaining that a BAA is required. That was unclear, and unclear is dangerous for both of us: if you store PHI on a service with no BAA, we are a business associate without a contract (a violation for us) and you have disclosed PHI to an entity with no obligation to safeguard it (a violation for you). So we are stating the rule instead of implying an exception.
3. Which services can be covered
| Service | BAA available | Notes |
|---|---|---|
| Dedicated VPS | Yes | A dedicated instance with no shared tenancy. The configuration requirements in section 5 apply. |
| Managed hosting (shared or dedicated node) | Case by case | Available where an application you run is genuinely PHI-capable; most WordPress sites are not. |
| Email hosting | No | Mail is stored on shared infrastructure. Do not put PHI in email hosted with us. |
| Backups | Yes, where purchased | A backup you do not buy does not exist. A BAA does not create one. |
| Shared hosting | No | Shared tenancy is not appropriate for PHI. |
| Domains, DNS, analytics, project management | No | Do not place PHI in these services. |
4. How to request a BAA
- Email legal@lasthourhosting.org with the subject “BAA request” and tell us which service, what kind of PHI, and who your privacy officer is.
- We send you our BAA and a short architecture questionnaire (usually one page).
- We review the configuration with you and confirm in writing whether it meets our requirements.
- You sign the BAA and the acknowledgement; we enable the service.
This usually takes 5 to 10 business days. We will tell you if we think the service is not a good fit rather than sell you something that will create a compliance problem.
5. Our requirements for a HIPAA-eligible configuration
A service covered by a BAA must, at minimum, be configured with:
- full-disk or volume encryption at rest, with keys we manage;
- TLS 1.2 or better for every connection, with no plaintext fallback;
- individual named accounts, no shared logins, and no shared administrator credentials;
- multi-factor authentication on every administrative account;
- audit logging of access to the instance, retained for at least 6 years where the rule requires it;
- no PHI in email, ticket attachments, or chat — support requests must reference records, not contain them;
- your own backups, tested, unless you have bought backups from us;
- a documented patch process for the software you run, which is your responsibility, not ours.
6. What the BAA says
Our BAA is a standard business associate agreement. In summary, we agree to: use and disclose PHI only as the BAA and your instructions permit, or as the law requires; implement the safeguards in section 5; report a breach of unsecured PHI to you without unreasonable delay and within 72 hours of discovery; ensure our subcontractors that touch PHI sign equivalent terms; make our internal practices available to HHS for compliance review; return or destroy PHI at the end of the arrangement where feasible, and if not feasible, extend the protections to any retained PHI; and tell you about any request for PHI from a third party within 5 business days unless the law forbids us to.
What the BAA is not. It is not a warranty that we are a compliance service, not a substitute for your own HIPAA programme, and not an assumption of your obligations. You remain the covered entity (or the business associate of one) and you remain responsible for your risk analysis, your policies, your workforce training, and your own use of the service.
7. What we do not do
- We do not sign a BAA that makes us responsible for your own application's security.
- We do not accept PHI in email, support tickets, or chat.
- We do not provide a HIPAA “certification” — there is no such thing. Anyone offering you one is selling you something that does not exist.
- We do not sign a BAA for shared hosting, for email hosting, or for services listed as excluded in section 3.
8. If you store PHI without a BAA
If we discover PHI on a service with no BAA, we will contact you, ask you to remove it, and may suspend the affected service until it is removed. We will not read the data to check; we act on what we are told or what is visible in a support context. We would much rather have the conversation before you upload than after.
9. Other regulated data
HIPAA is not the only regime with contractual requirements. If you handle payment card data, GLBA, FERPA, CJIS, ITAR, or EU/UK personal data, tell us before you sign up: legal@lasthourhosting.org. For EU/UK personal data our Data Processing Addendum applies and is available without a negotiation.
10. Questions
Email legal@lasthourhosting.org. We answer BAA questions within 2 business days.