Small law firm. 4 attorneys. Need hipaa hosting. Found 12 providers claim compliant. 0 offer BAA. Called 3; sales rep said BAA is extra. 1 said BAA not needed for cloud. Went down rabbit hole. Discovered firm does veterinary law. Patient data = pet records. Still need BAA? Confusion high. Help
Member
For real BAA is the line in sand. no signed BAA = no compliance theater matters.
# not legal advice obviously
grep -i "business associate" contract.txt || exit 1Vet records still PHI under state law some places btw
HIPAA is federal statute. "HIPAA compliant" marketing without BAA is meaningless. BAA required for any entity creating, receiving, maintaining, or transmitting PHI on behalf of covered entity. Vultr, RackNerd, none will sign standard BAA without enterprise tier. State veterinary confidentiality laws vary; California Civil Code 1798 et seq. Applies. Your "pet records" contain owner PII, payment data, sometimes human medical proxies. Still sensitive. Not a networking problem but compliance is not optional.
Our firm used Contabo for 5 years. They gave us the internet box with "HIPAA" sticker. I thought that was it? Then my nephew said we need the BAA thing. Spoke to DELL and they dont do BAA. Spoke to Microsoft they want $4000/month. Now our IT guy says pet records different? Very confused. Who is right here.
Provider BAA offered price/TB yabs disk yabs net
Contabo no €12 180 MB/s 400mbit
Vultr yes* $45 320 MB/s 890mbit
RackNerd enterprise $78 410 MB/s 1.2gbit
Hostinger "coming soon" $8 90 MB/s 200mbitBAA is only hard requirement. everything else is noise. Decent disk IO on Vultr, meh network on Hostinger — I got the numbers from https://github.com/masonr/yet-another-bench-script
Member
Bro server down not your problem here. BAA is Important document. Since 3 years I work with medical hosting. Pet records still need protection. State law. Dont trust sales. Get lawyer. Since you have 4 attorneys make one of them read the law. @minhmin Vultr has BAA I use them
RFC 2350 defines security practices but nobody reads it. AS-path to compliance runs through BAA, not marketing. Without signed BAA you're just another prefix in the swamp. Here's the topology:
[Covered Entity]
|
[BAA REQUIRED]
|
[Business Associate]
|
[Subcontractor BAA]Your "veterinary law firm" still handles PII. Pet owner address + SSN + payment = sensitive prefix. No ASN required to understand this. Get BAA or find different upstream.
No BAA = no deal
I don't buy that BAA not needed for cloud. Which state?