Some links here are affiliate links — if you buy through them we may earn a commission at no extra cost to you. It never changes what we recommend. Full disclosure.
Disclosure: This article contains affiliate links. If you sign up through them, we may earn a commission at no extra cost to you. This is general information about hosting, not legal or compliance advice — talk to a qualified compliance professional about your specific obligations. Plan details were checked in October 2026.
"HIPAA compliant hosting" and "PCI compliant hosting" are two of the most misunderstood phrases in the hosting industry. Buyers often read them as "buy this plan and you are compliant." No hosting plan can do that. What a good compliance-ready host does is take responsibility for the infrastructure layer, so you start from a hardened, auditable baseline instead of building one yourself.
This guide explains the shared-responsibility model, what to look for in each type of plan, and two hosts with dedicated compliance products: Ultra Web Hosting for healthcare and KnownHost for card payments.
The Shared-Responsibility Model
Every compliance framework that touches hosting splits responsibility between you and your provider:
| Layer | Typically the host's job | Typically your job |
|---|---|---|
| Physical data center security | ✅ | |
| Server hardware and network | ✅ | |
| OS hardening and patching | ✅ on managed plans | ✅ on unmanaged servers |
| Firewalls and WAF | ✅ (provided) | Configure rules for your app |
| Encryption in transit (TLS) | ✅ (enforced/provided) | Use it everywhere, including forms |
| Your application and plugins | ✅ | |
| Access control and passwords | ✅ | |
| Policies, training, risk assessments | ✅ | |
| Contracts (BAA for HIPAA) | Signs if offered | ✅ obtain and keep it |
| Assessments (PCI SAQ, scans) | Helps you pass | ✅ complete and submit |
If a hosting page implies it handles everything, treat that as a warning sign rather than a selling point.
HIPAA Hosting: What You Actually Need
HIPAA applies to US healthcare providers, health plans and their business associates handling protected health information (PHI). If your website only lists opening hours and a phone number, it may not touch PHI at all. Once it collects intake forms, appointment details or patient messages, it likely does.
Look for These in a HIPAA-Ready Host
- Isolation. A dedicated virtual machine or server, not an account on a multi-tenant shared server.
- Encryption in transit on every page and form (TLS), and encryption at rest where PHI is stored.
- Access controls and logging so you can show who accessed what and when.
- Backups with defined retention and secure storage.
- A Business Associate Agreement (BAA). Under HIPAA, a vendor that stores or processes PHI on your behalf is generally a business associate and must sign a BAA. No BAA, no PHI. This is the single most important question to ask any host.
Ultra Web Hosting's HIPAA-Ready Plan
Ultra Web Hosting, a host operating its own hardware since 2002, sells a HIPAA-ready plan listed from $49.95/mo on its own comparison table. It runs on a dedicated virtual machine rather than shared cPanel hosting, with a dedicated IP, SSL/TLS on every page and form, VM-level isolation and server firewalls, on hardware Ultra owns and racks in its own facility — so the physical chain of custody is the host's, not a third-party cloud's.
Ultra is unusually clear that this is infrastructure only: its pages state that policies, training and the BAA remain your responsibility, and that the BAA is not included in the plan by default. That candour is useful — just make sure you arrange and sign a BAA before you put any PHI on the server, or use the site only for non-PHI content and keep patient data in a HIPAA-covered practice-management system.
(ad) Explore Ultra Web Hosting's HIPAA-ready hosting — isolated VM infrastructure for healthcare sites. Confirm BAA terms in writing first.
More on Ultra's wider lineup in our Ultra Web Hosting review.
A Common, Simpler Alternative
Many small practices keep their marketing website on ordinary hosting and send all patient interactions — intake, scheduling, messaging — through a dedicated HIPAA-compliant practice platform that signs a BAA. That keeps PHI off the website entirely. It is worth asking whether you need a HIPAA website at all, or just HIPAA-compliant tools linked from it.
PCI DSS Hosting: What You Actually Need
PCI DSS applies to anyone who stores, processes or transmits payment card data. How much of it applies to your hosting depends on how you take payments:
- Fully hosted checkout (customer is redirected to Stripe, PayPal or similar): card data never touches your server, and your compliance burden is much lighter.
- Embedded payment fields (iframes or JavaScript from the processor): card data still goes to the processor, but your site serves the page, so its security matters more.
- Direct card handling on your server: the heaviest burden. Most small businesses should avoid this.
Even with hosted checkout, many processors and acquirers require quarterly external vulnerability scans of your site. A host built for PCI exists largely to make those scans pass.
Look for These in a PCI-Ready Host
- Account isolation so another customer's compromised site cannot affect yours
- Hardened OS and network configuration to PCI DSS standards
- Enforced modern TLS (1.2/1.3) and a dedicated IP
- A web application firewall active by default
- Managed patching of the OS and server software
- Help passing scans, including after migration
KnownHost PCI Compliant Hosting
KnownHost, a managed-hosting specialist, sells a PCI product built on its LiteSpeed/NVMe/cPanel platform and marketed around passing PCI scans out of the box. Each account runs in its own isolated (LVE) environment on servers configured to PCI DSS standards at the OS and network level, with ModSecurity WAF active on all plans, TLS 1.2/1.3 enforced, a dedicated IPv4 address included, SSH access, daily backups, and OS and security patches managed by KnownHost. It is available in Atlanta, Seattle and Amsterdam.
At the time of writing, the plans on annual billing were:
| Plan | Annual price | Renews at | Resources |
|---|---|---|---|
| Entry | $20.92/mo | $24.95/mo | 1 site, 2 cores, 2 GB, 50 GB NVMe |
| Business | $29.30/mo | $34.95/mo | 1 site, 4 cores, 4 GB, 100 GB NVMe |
| Corporate | $67.03/mo | $79.95/mo | 1 site, 6 cores, 6 GB, 150 GB NVMe |
KnownHost also migrates your existing store free and tests it afterwards so it is ready to run PCI scans.
(ad) Running an online store that needs to pass PCI scans? See KnownHost's PCI compliant hosting — isolated accounts, WAF, enforced TLS and a dedicated IP on every plan.
Questions to Ask Any Compliance Host
Copy these into your pre-sales chat:
- Will you sign a BAA (for HIPAA)? Is it included or an extra cost?
- Is my account on a dedicated VM/server, or isolated on a shared server?
- Which data center certifications do you hold (for example SOC 2 or ISO 27001)?
- Who applies OS and security patches, and how quickly?
- Is a WAF included and active by default?
- Where are backups stored, how long are they kept, and are they encrypted?
- What logs do you keep, and can I access them for an audit?
- Will you help if a PCI scan flags something at the server level?
Common Mistakes
- Assuming a "compliant" plan makes the whole business compliant
- Putting PHI on a server before a BAA is signed
- Collecting card numbers directly on your own forms when a hosted checkout would remove most of the burden
- Ignoring plugins and themes — most breaches start in the application, not the server
- Forgetting staff access hygiene: shared logins, no two-factor authentication, ex-employees with active accounts
Frequently Asked Questions
Is there such a thing as HIPAA-certified hosting?
There is no official government HIPAA certification for hosts. Providers can offer HIPAA-ready infrastructure and sign BAAs; compliance is assessed for your organization as a whole.
Do I need PCI hosting if I use Stripe or PayPal checkout?
Your burden is much lighter with a fully hosted checkout, but you may still need to complete a self-assessment questionnaire and pass external scans. A hardened, scan-friendly host makes that easier.
Can shared hosting be PCI compliant?
It can, if accounts are properly isolated and the servers are hardened — which is what products like KnownHost's PCI hosting are designed around. Ordinary bargain shared hosting typically is not.
The Bottom Line
Compliance hosting is about starting from a secure, documented baseline and knowing exactly where the host's responsibility ends and yours begins. For healthcare sites, Ultra Web Hosting's isolated HIPAA-ready VMs are a strong infrastructure choice once a BAA is in place. For stores that need to pass PCI scans, KnownHost's PCI hosting handles the server-side work so you can focus on your checkout and your plugins.
Want help matching a host to your project? Try SeoWolf's Hosting Recommender.