The real problem with HIPAA hosting
The BAA is the easiest part. The controls are where most teams fall short.
Healthcare teams run into HIPAA compliance as a specific, concrete problem, usually when a deal, an audit, or a new customer requirement makes the gap impossible to ignore.
You got a BAA from your current host and assumed it meant you were covered
A BAA documents shared responsibility for PHI. It doesn't create encryption, enforce isolation, or generate audit trails. When a buyer or auditor asks how PHI is protected in your environment, the BAA doesn't answer that question. The controls do, and most hosting providers don't enforce them.
You're on Heroku or Render and a healthcare buyer just asked for evidence of HIPAA compliance
General-purpose platforms aren't designed for regulated workloads. They'll sign a BAA, but the underlying infrastructure shares tenancy, has limited audit logging, and puts compliance documentation on you. When a serious healthcare buyer sends a security questionnaire, the answers aren't there.
You built on AWS and compliance keeps slipping as the system grows
The initial setup was careful. IAM was scoped. Logging was configured. But as new services, engineers, and environments were added, policies widened, logging became inconsistent, and isolation assumptions quietly broke. The drift is invisible until an auditor or enterprise security team starts asking questions.
You're approaching a HITRUST or SOC 2 assessment and you're not confident the infrastructure will hold up
Compliance frameworks require documented, attributable evidence: who had access, what changed, when it happened. If that evidence wasn't captured continuously, you can't reconstruct it. Gaps in audit history become findings, and findings delay or block certification.
For a full breakdown of what HIPAA hosting technically requires, including encryption standards, access controls, audit logging, and how to evaluate providers, see our HIPAA Hosting Technical Guide →
HITRUST R2 and control inheritance
HITRUST assessments rely on control inheritance from infrastructure providers. Deploying directly on AWS provides limited inheritance from base cloud controls. Deploying on Aptible provides broader inheritance: encryption, access management, logging, network isolation, and backup procedures.
For teams preparing for HITRUST, this reduces assessment scope, lowers costs, and accelerates timelines.
Achieving hitrust on aptible
Establish compliant infrastructure before your first customer asks
Deploy on HITRUST R2-certified infrastructure from day one. The controls are already in place when a buyer's security team comes looking.
Pass the security review your enterprise deal requires
Pull audit logs, access records, and compliance documentation directly from the platform. Reviewers get attributable, complete answers, not a reconstruction effort.
Move off a general-purpose platform that can't answer compliance questions
Migrate from Heroku or Render onto infrastructure designed for regulated workloads. The security model is built in, not something you reassemble after the move.
Deploy AI features that touch PHI
Route LLM requests through Aptible AI Gateway to keep PHI inside controlled infrastructure. Logging, access controls, and PHI guardrails are enforced automatically.
FAQs
What exactly do I need to host PHI on Aptible, and does it cost more?
Three things: the Production plan, a dedicated stack, and an executed BAA, which an Aptible team member coordinates when you request your first dedicated stack.
Aptible’s HIPAA documentation explains that every PHI-handling app and database should run in that dedicated stack, where HIPAA-required infrastructure controls are enforced by default.
Production is \$499 per month as a base fee, with infrastructure usage billed on top. The dedicated stack is the cost driver; HIPAA controls come with that architecture rather than being sold as a separate compliance add-on. Standard support is included at no cost.
How is this different from signing a BAA with AWS directly?
An AWS BAA gives you contractual coverage for eligible AWS services. It doesn’t design, configure, monitor, or document your infrastructure for you.
Aptible gives you a managed platform on top of AWS with secure defaults, managed databases, continuous compliance evidence, monitoring, and a SRE team operating the platform. Aptible’s HIPAA documentation explains how required infrastructure controls are enforced on dedicated stacks, and Aptible’s reliability documentation describes platform operations.
The same distinction applies to a provider BAA from any vendor: the paperwork assigns liability, but the implemented controls and evidence are what a buyer or auditor will ask to review. Aptible’s LLM Gateway security and compliance documentation makes a similar distinction for AI provider BAAs.
How do I migrate off Heroku or Render?
Most migrations follow the same path: containerize the app, configure services and secrets, provision databases, migrate the data, set up endpoints, test, then cut over traffic. Aptible’s custom-code deployment guide covers the deployment foundation. We also have a guide specific to migrating from Heroku to Aptible.
For data, Aptible publishes database migration guides for dump and restore PostgreSQL and PostgreSQL logical replication, which minimizes downtime on large databases. Initial VPC, transit gateway, and VPN setup is in scope on every support plan.
What does dedicated, non-shared infrastructure mean technically?
A Dedicated Stack is a network-isolated VPC for a single customer.
When you provision a Dedicated Stack on Aptible, you receive your own private and public subnets, isolated from other Aptible customers, as described in Aptible’s architecture documentation.
Environments are logically isolated groupings of apps, databases, and related resources within that dedicated network boundary. You can use environments to organize resources, and you can run multiple Dedicated Stacks when you need stronger network-level separation inside your own organization.
Resources in one stack aren’t reachable from another unless you explicitly connect them. Dedicated Stacks are also where BAA coverage, VPC peering and VPN, and the host-level security suite apply.
Does seven-year retention apply to all logs?
No. Retention depends on the data type.
Activity records are retained for the life of the environment, and Activity Reports are generated weekly.
App and container logs stream live and need a log drain or S3 archive for long-term retention. Metrics need a metric drain. Backups follow your configured retention policy, which defaults to 30 daily, 12 monthly, and 6 yearly snapshots.
LLM Gateway request and response logs are retained by Aptible for 6+ years, with the last 7 days self-serve.
Can I host only my backend and database on Aptible and keep my frontend elsewhere?
Yes. Host backend APIs and databases on Aptible and point an externally hosted frontend at them through an HTTP(S) endpoint with managed TLS and a custom domain.
Add IP filtering or header authentication to restrict who can reach it.
If the frontend handles PHI, that frontend and its hosting provider may also be in scope for HIPAA, so include them in your compliance review.