HIPAA hosting for dental practices is usually discussed in terms of the practice management software, which is where the records obviously live. The three places that actually get missed are the practice website when it collects patient forms, imaging storage and its backups, and the recall and reminder tools. The first is the one nobody expects, because a website feels like marketing right up until it starts collecting a medical history.
HIPAA hosting for dental practices: the website question decides it
Ask one thing: does your website collect patient information?
If the site is opening hours, a phone number, a map and a few photographs, it is a brochure. Ordinary hosting is entirely appropriate and there is no PHI involved.
If the site has a new patient form, a medical history questionnaire, an online booking form that asks what the appointment is for, or a contact form where patients describe a problem, then the website is collecting protected health information. Those submissions typically land in two places at once – stored in the website’s database, and emailed to the practice inbox – which means both the hosting and the email are now handling PHI on your behalf.
That is what puts a web host in the position of a business associate, and it is why the answer to “do we need a BAA with our web host” is usually yes for a practice that takes forms online.
Imaging: a HIPAA hosting for dental practices storage and compliance problem
Radiographs, CBCT volumes and intraoral scans are protected health information, and they are also large. In a small practice that combination produces predictable trouble:
- Storage grows faster than anyone plans for. Imaging accumulates and is rarely deleted, for good clinical reasons.
- Backups are often local and untested. A drive in the practice is a backup against disk failure and nothing else – not against fire, theft or ransomware.
- Copies travel. Images go to specialists, laboratories and insurers by whatever route is convenient on the day, and convenient usually means email.
Three questions answer most of it: where are images stored, how are backups held and when was one last restored, and by what route do images leave the practice. If the answer to the third is “as an email attachment”, that is the same problem covered in our guidance on email and PHI – a document sitting in two mailboxes indefinitely, with no expiry and no access log.
Recall, reminders and where marketing crosses the line
Appointment reminders are treated as part of treatment communication and are permitted. Two practical limits are worth holding in mind.
Content matters. A reminder should get someone to the chair, not disclose clinical detail. “You have an appointment on Tuesday at 2pm” is different from a message naming a procedure.
Marketing is a different rule. Promoting services to your patient list is not the same category as reminding them of a booking, and the requirements differ. Practices routinely run both through the same tool without noticing they have crossed from one to the other.
In either case, a third-party texting or email platform is handling patient information on your behalf, which raises the usual business associate questions – and those questions apply to every vendor in the chain, not only the obvious ones.
What HIPAA hosting for dental practices can and cannot mean
There is no HIPAA certification. No government body certifies hosting providers, and any vendor advertising itself as “HIPAA certified” is describing something that does not exist. What genuinely exists is narrower and more useful:
| What to ask | What a good answer sounds like |
|---|---|
| Will you sign a BAA? | Yes, without hesitation or an enterprise upgrade attached |
| Who owns the hardware, and where is it? | A direct answer naming the country and the owner |
| Is data encrypted in transit and at rest? | Both, stated separately |
| Who can access it, and is that logged? | A short list, with logging you can request |
| How are backups held and tested? | A specific retention period and a restore process |
| What is the breach notification process? | A named route and a timeframe |
Those six answers, in writing, are worth more than any badge on a homepage – and they are what your own documentation needs to record about each vendor.
A proportionate HIPAA hosting setup for a one-to-three chair practice
- Decide what the website does. If it collects patient forms, treat it as a system holding PHI and put it with a host that will sign a BAA. If it genuinely does not, keep it simple and do not over-buy.
- Get form submissions out of the inbox. Submissions sitting in email are the least controlled copy of PHI a practice holds.
- Put email on the practice domain, with multi-factor authentication on every mailbox, and stop sending clinical detail by ordinary attachment.
- Sort imaging storage and backup, then restore one backup to prove it works.
- List every vendor touching patient information – practice software, imaging, recall tool, website host, email – and get a BAA from each that needs one.
- Write down what you decided and why. Documentation of a reasonable decision is much of what compliance actually looks like in a small practice.
Where we fit in HIPAA hosting for dental practices
We host on hardware we own and operate in the United States, and we sign a Business Associate Agreement – which is the question that matters most for a practice website that takes forms. Hosting includes free SSL and cPanel, where multi-factor authentication is configured. Liberation Email from $1.95 per user per month keeps practice mail on your own domain with nothing scanned for advertising, and Hub For Teams from $7.49 per user adds secure file sharing, which is the practical answer to sending images and documents to a specialist.
What we do not do is certify your practice, write your policies, or claim that buying hosting makes you compliant. See how we work with healthcare practices, or ask us the six questions above and file the written answers with your documentation.
Forms: the HIPAA hosting fix is usually straightforward
If the website collects patient information, the goal is to stop submissions accumulating in places nobody controls. Three practical changes cover most of it:
- Stop emailing the submission content. Send a notification that a form has arrived, and keep the content behind a login rather than in the body of an email that will sit in an inbox indefinitely.
- Set a retention period on stored submissions, and actually delete them. A website database quietly holding three years of medical histories is a liability with no upside.
- Ask for less. The most reliable way to protect information is not to collect it. A booking form rarely needs a clinical history – that can happen at the appointment, or through the practice software where it belongs.
The third is the one practices overlook, and it is the cheapest. Every field you remove is a field that cannot be breached.
A HIPAA hosting for dental practices vendor inventory template
Most of what a small practice needs to document is a list. For each vendor touching patient information, record five things: what it does, whether it holds or transmits PHI, whether a BAA is in place and where the signed copy is, what the breach notification route is, and when you last reviewed it.
That list usually runs to five or six rows for a dental practice – practice software, imaging, recall tool, website host, email, and often a payment provider. Assembling it takes an afternoon and it is the single most useful compliance document a small practice can have, because it is also the thing you will be asked for first if anything ever goes wrong.
The imaging question, in more detail
Of the three places PHI hides, imaging is the one that most often outgrows whatever arrangement a practice started with, and it is where HIPAA hosting for dental practices stops being an abstract topic and becomes a storage bill.
The volume is genuinely large. A full-mouth series, cone beam scans and intraoral photography add up quickly, and dental records are typically retained for years after a patient’s last visit – the exact period is set by your state board, not by HIPAA, and it is worth confirming yours rather than assuming. Multiply the per-patient figure by an active list of a couple of thousand and the storage requirement becomes a real line item.
Which is why imaging drifts. When the server fills up, someone moves older studies to an external drive, a spare workstation, or a consumer cloud account. Each of those moves creates a copy of PHI in a place with no agreement behind it, and it happens without any decision being taken. Asking where imaging older than three years currently lives is one of the more revealing questions a practice can put to itself.
The vendor may already be a business associate. If your imaging software stores studies in the manufacturer’s cloud, that manufacturer is handling PHI on your behalf and needs a signed agreement. Many will provide one on request; the issue is usually that nobody asked. Check your account portal before assuming there is a gap.
Backups multiply the problem. Imaging backups are large, so they are frequently the ones excluded from encryption or shipped to whatever storage was cheapest. Every copy carries the same obligation as the original, and an unencrypted external drive of X-rays in a desk drawer is a reportable breach waiting to be a stolen drawer.
Plan for growth rather than reacting to it. Decide the retention period, size storage for it deliberately, put the agreement in place with whoever holds it, and encrypt the backups. That is a morning’s work, and it prevents the drift that causes the actual problems. The HHS cybersecurity guidance for covered entities is a reasonable reference point when deciding how much is proportionate for a practice your size.
Handled deliberately, imaging is simply a storage decision with an agreement attached. Left to drift, it becomes the largest uncontrolled collection of patient data the practice owns.
What a dental practice should ask a web developer
Most dental websites are built by agencies that specialise in dental marketing rather than in healthcare compliance, and the two are not the same skill. Four questions sort the ones who have thought about it from the ones who have not.
“Where do the form submissions go?” If the answer is “they email to the front desk”, the practice has a problem, because a new patient form carrying a medical history is PHI travelling by ordinary email. The fix is straightforward – forms posting into a secure portal or an encrypted submission service – but it has to be asked for. This single question resolves the most common failure in HIPAA hosting for dental practices.
“Will you sign a business associate agreement?” If the agency builds the site, hosts it, and receives form data, it is handling PHI on your behalf. A developer who has not heard the question before is not disqualified, but their answer tells you how much of this they have considered.
“What tracking is on the site?” Analytics and advertising pixels on pages where patients book appointments or complete forms have been the subject of enforcement attention, because they can transmit identifiable information to third parties. Ask what is installed, on which pages, and what it sends.
“Where is it hosted, and can we get a full backup?” The site, the form data and the backups all sit somewhere. Knowing where, and being able to take a copy, is the difference between a website you own and one you rent from whoever built it.
Then write the answers down. Add the developer, the host and the form handler to the vendor inventory alongside the imaging and recall vendors. Good HIPAA hosting for dental practices is mostly this: knowing every party that touches patient data, having an agreement with each, and being able to show the list.
None of these questions requires the practice to understand the technology. They require only that somebody asks them before the site goes live rather than after a patient complaint.
What HIPAA hosting for dental practices costs, realistically
Practices frequently postpone this because they assume it means an enterprise contract. For a small practice it does not, and the numbers are worth stating plainly.
The website and forms. Ordinary business hosting with a provider that will sign a business associate agreement, plus a secure form handler. This is the cheapest part of HIPAA hosting for dental practices and the one that removes the largest share of the risk.
Email on your own domain. Per mailbox, per month, with a signed agreement. Replacing a free consumer account with business email on the practice domain is a small recurring cost and closes the second-commonest gap.
Imaging storage. The largest line, driven by retention period and patient volume rather than by compliance. You would be paying for this storage anyway; the compliance element is the agreement and the encryption, not a premium on the gigabytes.
The written work. Free, in the sense that it costs time rather than money – a risk analysis, a vendor inventory, an incident response plan and a training record. An afternoon a year for a small practice.
What you should not be paying for. A large premium purely for the word HIPAA on the invoice, a compliance certification that does not exist, or a consultant for a three-chair practice with four vendors. HIPAA hosting for dental practices at this scale is ordinary infrastructure bought from someone willing to sign an agreement and tell you where the data lives.
Set against a single reportable breach – the notification costs, the time, the reputational effect in a local patient community – the recurring cost is modest. But the honest reason to do it is not fear of enforcement. It is that patients hand over their medical history on the assumption that somebody in the practice has thought about where it goes.
If the practice takes one thing from this page, let it be the order of work. HIPAA hosting for dental practices is not a product you buy and then stop thinking about; it is a short list of places patient data ends up, each with an owner and an agreement. Fix the website forms this week, move email onto the practice domain next, then deal with imaging and the recall vendor. Approached that way, HIPAA hosting for dental practices is a handful of decisions rather than a project, and every one of them is reversible if you later change provider.
Frequently asked questions
Does a dental practice need HIPAA compliant hosting?
If the practice website collects patient information – new patient forms, medical histories, or a booking form asking about symptoms – then the website is holding protected health information and the hosting arrangement is in scope. A brochure site with only a phone number and opening hours is not.
Is there such a thing as HIPAA certified hosting?
No. HIPAA has no certification scheme and no government body certifies hosts. What exists is whether a vendor will sign a Business Associate Agreement and can describe the safeguards it maintains.
Do we need a BAA with our web host?
If the host stores, transmits or has access to protected health information on your behalf, yes. A website collecting patient forms puts the host in that position. LiberationTek signs a Business Associate Agreement.
Are appointment reminders allowed under HIPAA?
Appointment reminders are treated as part of treatment communication and are permitted, but the content matters – a reminder should not disclose clinical detail. Where reminders are sent through a third-party tool, that vendor is handling PHI on your behalf.
Where does dental imaging fit?
Radiographs, CBCT volumes and intraoral scans are protected health information and are also large, which makes storage and backup a practical problem as well as a compliance one. Answer where images are stored, how backups are held and tested, and what happens when copies are sent to a specialist.
Related reading
- HIPAA Hosting for Small Practices: 5 Essential Basics
- HIPAA Compliant Email: 5 Essential Requirements
- HIPAA Business Associate Agreement: 5 Vendor Checks
- HIPAA Compliant Email With a Signed BAA — What a BAA-backed mailbox actually includes.
- HIPAA Compliant Hosting for Healthcare — Where the rest of a practice’s data lives.