Dental Web Hosting and HIPAA: What Your Site Really Needs

A dental practice has two different hosting problems, and only one of them is ordinary web hosting. Your public marketing site is a normal website: opening hours, location, the list of treatments, team bios, a phone number, a contact form that asks nothing medical. Anything that touches protected health information is a different animal entirely, and that includes online intake forms, appointment records, a patient portal, treatment notes and imaging. Under the HIPAA Rules, a provider that stores or processes that information on your behalf is a business associate, and a signed business associate agreement has to exist before any of it moves.

Devoster holds no HIPAA certification, does not execute business associate agreements, and publishes no data processing agreement, third-party audit report or availability commitment. So the honest answer, up front: we are a reasonable place to run a dental practice's marketing website, and the wrong place for anything holding patient data. If you need the second thing, buy it from a provider that signs the agreement. The rest of this guide is about telling the two apart, because practices almost never cross that line on purpose. They cross it because somebody added a symptoms box to a contact form.

Key Takeaways

• Split the estate before you shop. A marketing site carrying no health information is ordinary hosting. A system that receives, stores or transmits patient information is a regulated workload and usually belongs with a different vendor.
• A host that maintains electronic protected health information on your behalf is a business associate. HHS states that using such a provider without entering into a business associate agreement puts the covered entity in violation of the HIPAA Rules.
• There is no HIPAA certificate. The government does not issue, endorse or recognise one. What actually exists is a signed agreement, your own documented risk analysis, and the controls the Security Rule requires.
• The most common accident is a request-an-appointment form. Add symptoms, insurance details, a date of birth or an upload for a previous X-ray, and a marketing page quietly becomes a patient information system.
• Encryption does not exempt a host. HHS says lacking the decryption key does not remove business associate status, and the conduit exception covers transmission-only services, not storage.
• Devoster does not sign business associate agreements. Use us for the public site if you like it, and use a provider that signs one for anything else. That section is repeated near the end and it is not a soft sell.

Two Websites, One Domain: Where the Line Actually Falls

Most dental practices think of their web presence as a single thing because it sits behind a single domain name. Regulators do not see it that way. They see individual flows of information, and each one is either in scope or out of it.

The test is not whether a page looks medical. It is whether the information is individually identifiable health information created or received by a health care provider, relating to an individual's past, present or future health, the provision of health care to them, or payment for it. That test comes from the definitions at 45 CFR 160.103. A page describing your implant pricing is marketing. A submitted form saying that Dana wants to be seen on Thursday about a cracked molar is health information about an identified person, sitting on a disk somewhere.

Part of your web presence	Handles patient information?	Where it can reasonably live	What you need from the provider
Home, services, hours, team bios, blog, before-and-after gallery with consent	No	Ordinary shared or managed WordPress hosting	TLS certificate, patching, daily backups, sane access control
Contact form: name, phone, email, general message	Usually not by design, but visitors volunteer symptoms in free text	Ordinary hosting plus a written purge routine	The ability to delete submissions, and backups you can reason about
Appointment request with reason for visit, symptoms, insurance, date of birth or an upload	Yes	A provider that signs a business associate agreement, or a third-party intake service that does	Signed agreement, encryption, audit logging, incident notification terms
Patient portal, treatment records, recall and reminder lists	Yes	Your practice management vendor or a compliance-specialist host	Signed agreement, per-user access control, defined retention
Imaging, intraoral scans, DICOM files	Yes	A specialist imaging platform	Signed agreement, storage location, return and destruction on exit
Card payments for treatment	Card data is a PCI matter, and the surrounding context can still be health information	Your processor's hosted payment page or iframe	Card numbers never reach your server
Analytics, advertising tags, chat widgets	Depends entirely on which pages they run on	Marketing pages only, never intake or portal pages	Vendor terms you have actually read, and a tag inventory

Read that table as a purchasing decision rather than a legal opinion. Row one is the only row where a general-purpose host is unambiguously the right answer, and it also happens to be the row that covers most of the pages a dental practice actually publishes.

What HIPAA Actually Requires of a Hosting Provider

Business associate is a status, not a product tier

Vendors sell HIPAA as though it were a feature you can add to a plan. It is not. A company that creates, receives, maintains or transmits protected health information on behalf of a covered entity is a business associate by operation of the definition, whether or not anybody says the word out loud, and whether or not the vendor markets itself that way. Your dental practice is the covered entity. Your host, your intake form vendor, your backup provider and your web agency can all become business associates the moment patient information passes through them.

That matters because status brings direct liability. A business associate answers for its own Security Rule failures and its own breach notification obligations, not merely for whatever it agreed to in a contract with you.

The signed agreement is the gate

The Privacy Rule lets you disclose protected health information to a business associate only where you have obtained satisfactory assurances, in writing, that the information will be appropriately safeguarded. The required contents of that contract are spelled out at 45 CFR 164.504(e): the permitted uses and disclosures, a prohibition on anything the covered entity could not do itself, appropriate safeguards, reporting of unauthorised use or disclosure, cooperation with patient access and amendment requests, and a flow-down obligation requiring any subcontractor that touches the data to accept the same restrictions.

The Department of Health and Human Services states the consequence of skipping it about as plainly as a regulator ever does. From its guidance on cloud computing and HIPAA:

If a covered entity (or business associate) uses a CSP to maintain (e.g., to process or store) electronic protected health information (ePHI) without entering into a BAA with the CSP, the covered entity (or business associate) is in violation of the HIPAA Rules.

There is no workaround in that sentence. Not a good firewall, not a strong password policy, not a reassuring email from a salesperson. Either the provider executes the agreement or the workload cannot go there. This is the single most useful filter you have when evaluating hosts, because it converts a fuzzy security conversation into a yes-or-no question with a document attached.

Encryption does not get a host out of it

A common sales line is that encrypted storage makes the provider a mere conduit. HHS addressed that directly. Lacking an encryption key for data it receives and maintains does not exempt a provider from business associate status, and a provider maintaining encrypted health information on your behalf remains a business associate even where it cannot view the data. HHS calls that arrangement no-view services, and it changes which controls the provider has to implement, not whether the agreement is required.

The conduit exception vendors reach for is narrow. HHS describes it as limited to transmission-only services, including any temporary storage incidental to that transmission. A network carrier qualifies. A web host with your intake submissions sitting in a MySQL table does not.

There is no such thing as a HIPAA certificate

No federal body certifies hosting providers under HIPAA. The Office for Civil Rights states in that same guidance that it does not endorse, certify or recommend specific technology or products. Every certified badge in this market therefore comes from a private assessor applying its own criteria, which may be perfectly rigorous and is still not the thing your obligations rest on.

What you can actually collect from a serious vendor is a short, dull list: the executed agreement, a description of which service it covers, a current independent audit report you may read under a non-disclosure agreement, a sub-processor list, and a written incident notification window measured in hours. If a provider offers a logo instead, you have your answer.

The Appointment Form Trap

This is where ordinary dental websites go wrong, and it is worth being specific, because no amount of hosting choice fixes a form that collects the wrong things.

Fields that move the line

A form asking for a name, a phone number and a preferred callback time sits close to the boundary but survives most readings. The following additions push it firmly over.

• A reason for visit, a symptoms box, or a pain description, even as an optional free-text field.
• Insurance carrier, policy number or a question about coverage, because payment for health care is inside the definition.
• Date of birth combined with a request to be seen, which is what turns an enquiry into an identified patient record.
• File uploads, which in dentistry almost always means somebody attaching a panoramic X-ray from a previous practice.
• Anything that echoes a clinical selection back, such as a treatment dropdown listing root canal, extraction and denture fitting.

A practical mitigation many practices miss: keep the form, and move the clinical questions to the phone call or to a separate, properly hosted intake step after the appointment is agreed. The marketing site collects an intention to book. The regulated system collects the clinical detail.

Where the data actually lands

The fields are only half the question. The other half is where the submission ends up, and this is the part almost every buying guide skips.

• Stored in the site database. Most WordPress form plugins save every submission into the site's own tables by default, often silently, even when they also send an email. That puts patient information on your web host's disk and inside every backup.
• Emailed to a practice mailbox. If the mailbox is on the same hosting account, the host is now storing it. If it is on an external mail service, that service becomes the vendor in question instead.
• Posted directly to a third-party intake service. If nothing is written to your host and nothing is emailed through it, your host is not maintaining that information at all. Verify the form uses POST rather than GET, because a GET request puts every field into the URL and therefore into server access logs.
• Sitting in log files. Debug logging, error handlers and analytics scripts have all been known to capture form payloads. Check before you assume.

A decision tree you can run in five minutes

• If the form collects only a name and a contact method, and nobody replies with clinical content through it, then ordinary hosting is fine, and you should still purge submissions on a schedule you write down.
• If the form collects a reason for visit, symptoms, insurance, date of birth or an upload, then it is a patient information system. Move it to a vendor that signs the agreement, or delete the fields.
• If the form posts straight to an intake service that signs the agreement, and your host neither stores nor emails the content, then the host is out of scope for that flow. Confirm the request method and read your access logs once to be sure.
• If submissions land in your site database or in a mailbox on the hosting account, then the host is storing patient information regardless of how innocent the form looks.
• If you cannot tell, then assume it is in scope and ask whoever advises you. The cost of being wrong is not symmetrical.

Keeping the Marketing Site Genuinely Out of Scope

Splitting the estate is cheaper than lifting everything into an expensive environment, and it makes the scope statement you eventually write far shorter. A workable pattern looks like this.

• Public site on ordinary hosting. Pages, blog, gallery, map, phone number. No forms that ask clinical questions, and no file uploads.
• Booking handled by a vendor that signs the agreement. Link out or embed, but let their infrastructure receive the data.
• No third-party tags on regulated pages. Keep analytics and advertising scripts off intake, booking and portal pages. Tracking technologies on pages where patients identify themselves have been an active area of enforcement attention and litigation in the United States, so treat that boundary as real and get advice specific to your practice.
• Email discipline. Never route clinical detail through a general practice inbox on shared hosting. Reply asking the patient to call, or use the portal.
• Backups you can reason about. Our shared plans keep daily backups with seven-day retention. That is a good property for a marketing site and an awkward one if patient information ever leaks into the database, because you then hold copies you did not plan for.
• Ordinary security hygiene still applies. A defaced dental website is a reputational incident even when no patient data was involved. The website security best practices guide covers the application layer, and the VPS security hardening checklist covers the server if you run one.

What to Ask a Prospective Host, and How to Read the Answer

Send these before you look at a single price. The replies will shorten your shortlist faster than any feature comparison.

Ask this	A real answer sounds like	A non-answer sounds like
Will you execute a business associate agreement, and may I read the template before buying?	Here is the template, it is signed at onboarding, and here is who signs it	We take security extremely seriously, our platform is built for healthcare
Exactly which product does the agreement cover?	The named plan, in writing, with exclusions listed	Our infrastructure is compliant
Where is the data stored, and which sub-processors touch it?	A named location and a list you can review, with notice before it changes	Enterprise-grade global infrastructure
How quickly will you notify me of a security incident, in hours?	A number, written into the contract	Promptly, without undue delay, and nothing further
What happens to my data and my backups when I leave?	A defined return window, then documented deletion including backups	A link to the cancellation article
May I see the audit report rather than the badge?	The report under a routine non-disclosure agreement, usually within a day or two	A trust page with logos, or certification is in progress
Who patches the operating system, and who owns log retention?	An unambiguous split, in writing, matching the product you are buying	It is fully managed, without saying what that covers

One more thing worth knowing before you negotiate. The breach notification timing that applies to you as a covered entity sits at 45 CFR 164.404, which requires notification to affected individuals without unreasonable delay and in no case later than sixty calendar days after discovery. A vendor who will only commit to telling you promptly has handed you their risk. Ask for hours.

Where Devoster Fits, and Where It Does Not

You are reading this on a hosting company's blog, so here is the version without the marketing.

We sell shared hosting with cPanel, managed WordPress, Node.js hosting, unmanaged KVM virtual servers with full root access, reseller hosting, dedicated servers and domain registration. Shared and managed WordPress plans include staging, free SSL, unlimited bandwidth, PHP 8.3 by default, and daily backups with seven-day retention. Virtual servers run on Intel Xeon Gold 6138 processors with NVMe storage in a single US-South location, with DDoS protection and free migration available across the range. Shared hosting starts at $2.90 per month for Lite, $5.90 for Standard and $9.90 for Pro.

Now the part that decides this article. We hold no HIPAA certification and no other security certification. We do not execute business associate agreements. There is no audit report to request, no published data processing agreement, and no published availability commitment or service credit scheme. Our virtual servers are unmanaged, which means operating system patching, hardening, log retention and key handling belong to you.

The practical consequence for a dental practice in the United States is unambiguous. Your marketing website is welcome here, and there is nothing unusual about running it on a shared hosting plan or a managed WordPress plan. Your intake forms, your patient records, your portal and your imaging are not, and no configuration on our side changes that, because the missing piece is a signature rather than a feature. Buy those from a provider that signs the agreement as a routine part of onboarding, and keep the two estates separate on purpose.

If you are weighing that decision more broadly, our guide to choosing a hosting provider for sensitive data walks through the documents to collect and how to read them across HIPAA, PCI DSS, GDPR and SOC 2.

If Your Practice Is Not in the United States

HIPAA is United States law and binds covered entities and their business associates there. A dental practice in Israel, the United Kingdom or the European Union is not governed by it merely because a patient once lived in Ohio. You are governed by your own framework, and the structure of the problem is identical even though the vocabulary changes.

In Israel the operative rules are the Protection of Privacy Law and the Protection of Privacy (Data Security) Regulations, which require a written arrangement with any external party processing personal data on your behalf and which place a database holding medical information above the lightest handling. The Hebrew version of this article works through that framework properly rather than translating the American one. In the European Economic Area, Article 28 of the GDPR plays the role the business associate agreement plays under HIPAA: a written processor contract, a sub-processor list, and prior authorisation for changes.

The conclusion travels intact. Wherever you practise, somebody has to sign something before patient data lands on a third party's disk, and a provider who will not sign is not a candidate for that workload.

Frequently Asked Questions

Can I host patient data on Devoster?

No. Storing protected health information on behalf of a covered entity makes the host a business associate, and that requires a signed business associate agreement. We do not execute one, so there is no lawful arrangement to build on. Use us for the practice's public marketing site, and buy your patient-facing systems from a provider that signs the agreement.

Is my dental marketing website subject to HIPAA?

Not by itself. Pages describing your hours, treatments, team and location carry no patient information and are ordinary web content. The site comes into scope the moment it receives, stores or transmits information about an identified individual's health, their care, or payment for that care, which in practice usually means a form.

Does a contact form make my site a HIPAA system?

It depends on the fields and where submissions land. A name and phone number for a callback is a weak case. A reason for visit, symptoms, insurance details or an uploaded X-ray is a strong one. If the plugin also saves submissions to your site database or emails them to a mailbox on the same account, the host is storing that information.

Is there such a thing as HIPAA-certified hosting?

No government certification exists. The Office for Civil Rights states that it does not endorse, certify or recommend specific technology or products, so any certified badge in this market comes from a private assessor. What counts is the signed agreement, the provider's willingness to show a real audit report, and your own documented risk analysis.

If the data is encrypted and the host cannot read it, do I still need an agreement?

Yes. HHS is explicit that lacking the decryption key does not exempt a provider from business associate status, and that a provider maintaining encrypted health information remains a business associate. The conduit exception is limited to transmission-only services with temporary incidental storage, which does not describe a web host.

Can I keep my marketing site and my patient systems with different providers?

Yes, and for most practices it is the cheaper and cleaner answer. Run the public site on general-purpose hosting, hand booking and records to a vendor that signs the agreement, and link between them. Splitting the estate shrinks what you have to document and stops one inexpensive plan from carrying obligations it was never built for.

What should I do if patient information is already on my web host?

Stop the flow first by disabling the form or removing the offending fields, then export what you need, delete the stored submissions, and ask the host in writing when backups containing them expire. Then talk to whoever advises you on compliance, because a breach assessment and possible notification duties may already be in play.

Your Next Step

Open your own website and read every form on it out loud, field by field. That five-minute exercise settles the hosting question for most dental practices, because it tells you whether you are shopping for ordinary web hosting or for a vendor that will sign a business associate agreement, and those are two different purchases with two different price tags.

If the answer is the marketing site alone, a straightforward web hosting plan with daily backups and disciplined access control will serve you well, and we would be glad to have you. If patient information is involved anywhere, buy that part from a provider that signs the agreement, and come back to us for the pages that are genuinely out of scope. Our team is happy to help you work out which is which, including when the answer is that we are not the right fit.