The question comes up early in every healthcare project: what does it cost to host this properly?
The answers people find online are unhelpful in both directions. Vendors quote enterprise packages. Forum replies say “just use a cheap VPS.” Neither reflects what a small application handling protected health information actually needs.
Here is the honest shape of it.
First: HIPAA does not certify hosting
There is no such thing as a HIPAA-certified server. HIPAA is a set of obligations on you, the covered entity or business associate. Infrastructure providers help you meet them, but no provider makes you compliant by taking your money.
What a provider must do is sign a Business Associate Agreement. Without one, you cannot legally put PHI on their infrastructure regardless of how secure it is. This is the first filter, and it eliminates a lot of cheap options immediately — several popular budget hosts will not sign one at any price. It is also the first of the four technical decisions that decide whether software can hold protected health information, and the one that cannot be undone cheaply.
The major clouds (AWS, Azure, Google Cloud) all offer a BAA, most at no additional charge on standard accounts. Some managed platforms offer one only on higher tiers, which is where a surprising amount of the “HIPAA is expensive” reputation comes from.
What actually drives the bill
For a small application — a web portal, an API, a database, a few thousand users — the recurring infrastructure cost breaks down roughly like this.
Compute. Unremarkable. A HIPAA workload does not need more CPU than the same workload without PHI. This is usually the largest line item and the least HIPAA-specific one.
Database with encryption at rest and automated backups. Managed database services include encryption and point-in-time recovery on standard tiers. You are paying for managed infrastructure, not for a compliance feature.
Audit logging and retention. This is the line people forget. You need records of who accessed what, and you need to keep them for years — six is the common figure for HIPAA documentation. Log storage is individually cheap and cumulatively real, because it only ever grows.
Backups, retained and tested. Retention has the same compounding property as logs. The cost that matters is not storing backups; it is that most teams never verify a restore works until the day they need it.
Encrypted, monitored file storage. If the application handles documents or images, this grows with usage in a way compute does not.
The costs that are not infrastructure
This is the part that surprises people, and it is the honest answer to “what does it cost.”
A risk assessment. Written policies and procedures. Staff training with records proving it happened. Access reviews performed on a schedule. Breach notification procedures written before you need them. An inventory of every place PHI lives.
None of that appears on a cloud bill, and all of it is required. For most small healthcare projects, the operational and documentation burden costs more over the first year than the servers do — and it is the part that gets skipped, because it does not block a launch.
Where teams overspend
Buying a compliance platform before having a product. Automated compliance tooling is genuinely useful when you are pursuing SOC 2 or handling enterprise procurement. It is premature for an application with no users.
Over-provisioning “for compliance.” Multi-region redundancy and expensive architecture are availability decisions, not HIPAA decisions. Decide them on the question of what happens when the system is down, and price them honestly rather than filing them under compliance.
Paying a premium tier purely to obtain a BAA. Worth checking. If a platform gates its BAA behind a much higher plan, moving that component to a provider that signs one on standard terms can remove a large recurring cost with no security difference.
Where teams underspend
Backups they have never restored. An untested backup is a belief, not a control. Restore one on a schedule and record the result.
Access control that never gets reviewed. People change roles and leave. Accounts outlive them. Reviewing who has access to PHI on a defined schedule costs nothing but attention, and it is among the most commonly cited failures.
Anywhere PHI leaks outside the system. Error tracking that captures request bodies. Analytics on authenticated pages. Support tools where staff paste patient details. Spreadsheets. This is where real breaches happen — not through the infrastructure everyone is busy hardening.
The short version
For a small healthcare application, HIPAA-appropriate hosting on a major cloud is not dramatically more expensive than hosting the same application without PHI. The architecture is standard practice: encryption, access control, audit logs, tested backups.
The real cost is operational — assessments, policies, training, reviews, and the discipline to keep PHI inside the systems you designed for it. Budget for that honestly and the infrastructure question stops being the hard one.
We build and host healthcare applications with these controls in place from the start. If you are scoping one, tell us what you’re handling.