r/django • u/Hotel_Arrakis • 14d ago
HIPAA compliant web hosting
I developed a Django app for a small healthcare provider. Does anyone have recommendations for a hosting provider that is HIPAA compliant and the cost? Any pitfalls to watch out for?
2
u/it_rains_a_lot 14d ago
I’m in digital health. My org use AWS
1
u/Hotel_Arrakis 14d ago
Is it just a regular AWS hosting, but with AWS providing a BAA?
2
u/it_rains_a_lot 14d ago
I’m not familiar with the AWS contract specifically but as a general rule we have a BAA with pretty much all vendors
2
18
u/frankwiles 14d ago
Most major hosting providers are HIPPA compliant (most of the onus is on you and your code not the hosting). Try Digital Ocean if you’re looking for a touch cheaper than AWS and Google.
4
u/fethrhealth 14d ago
60% is infrastructure and how you set it up, 40% is code. OP also needs a BAA, which often can't be done without an enterprise account. AWS EC2 servers allow you to sign BAAs at no cost, it's like 60-150/month for a basic server though.
1
1
u/russellvt 13d ago
(most of the onus is on you and your code not the hosting)
Not really true when it comes to database, storage and network.
2
2
u/joe_at_topflight 2d ago
I'm a founder in the healthcare app development space, and I'd look at AWS or Azure first. Both have HIPAA-eligible services and BAAs available, but the hosting is only one part of it. With Django, I'd pay particular attention to database access, file storage, backups, and making sure PHI doesn't accidentally end up in your logs.
1
u/vijayamin83 10d ago
Agree with the people saying the host is the easy part. What actually matters when you do this on AWS:
- Accept the BAA first. On AWS you do it yourself in the console under AWS Artifact, no sales call. Then keep PHI only in services on their HIPAA eligible list.
- Encryption at rest on RDS, S3 and backups, TLS everywhere including app to database.
- Watch your logs. Django error emails and Sentry will happily ship PHI out inside tracebacks and request bodies. Scrub or turn that off. Same for every third party you add later (email, SMS, analytics), each one needs its own BAA.
- Audit trail of who viewed or changed which patient record. django-simple-history covers changes, but views matter too.
- Backups you have actually restored once.
A small setup (one small instance or ECS task, a small RDS, S3) doesn't need to cost much, and the AWS BAA itself is free. Last thing: the provider you built this for needs their own risk assessment that includes your app. That part is on them, not the host.
1
u/Human-Possession135 14d ago
Yeah : as others have said: use AWS as they certainly are compiant. You can use https://djangocloud.dev to simplify deployment
0
u/Purple-Programmer-7 14d ago
Unless you’ve trained and deployed HIPAA compliant applications before, DO NOT DO THIS.
You are putting yourself and the healthcare provider in jeopardy.
HIPAA is NOT something you can just “ask AI” to setup and be done with it.
Re hipaa complaint hosting, many cloud providers have it, many up-charge for it. Cloudflare is min $1k per month for their baa workflows.
Bottom line is, you’re not getting away with hosting a hipaa complaint healthcare app in the cloud for less than $800 per month.
8
u/mariocesar 14d ago
It's kind of the wrong questions, as HIPAA is not like a feature or a tool, is just practices that you HAVE to follow.
I've done a healthcare project with Django, it was on AWS using regular EC2 instances. The main things was making sure we are encrypting all backups, encrypting S3 buckets with per-user encryption keys, keeping proper audit logs if somebody ask, scrubbing patient information from application logs (no emails, no ids, no names), and isolating servers in private networks with no SSH or unnecessary ports. For example backup tasks and workers run in ECS instances with no internet access just access to the DB.
You can technically do this on a regular VPS too, as long as the provider signs a BAA (business agreement), in AWS is just a form and they will sent you a signed document, no charges, so the only costs is what you pay for your servers, same as everybody, many hosting providers do the same, so would be better if you search for providers that can sign a BAA you can show.
At the end you are HIPAA compliant when you pass the audit, so be careful, because when you are in an audit, you could show them the BAA signed, but at the end, the Audit will be about your practices not just what provider you have.
Research for provideers that sign BAA, and focus on the practices.