We’ve been reaching out to dental practices in our backyard of San Francisco recently and we’ve run across some of them using Bluehost for their email service. Bluehost was founded in 2003 and is located beneath the Wasatch Mountains in Utah. They employ more than 700 people. If a HIPAA entity is using Blue Host for their web hosting and Blue Host also handles their email, the question naturally arises: Is Bluehost a HIPAA Compliant Email provider?
We’ve covered in previous posts that a Business Associate Agreement is a written contract between a covered entity and a Business Associate. It is required by law for HIPAA compliant email. We searched the Bluehost website and we quickly found an answer about their support for HIPAA entities: Is Bluehost HIPAA Compliant "You may NOT use our Services for hosting “protected health information” under the federal HIPAA law and related regulations. Other hosting providers may specifically price and offer “HIPAA compliant” hosting services, which typically are more expensive, and involve the hosting company signing a “Business Associate Agreement.” We do not offer such a product at this time. We do not sign Business Associate Agreements. Storing “protected health information” on our servers constitutes a breach of our User Agreement and is an unauthorized use of our Services. Our Services are not represented to be HIPAA compliant, and you may not use them for such purposes"
Thanks to their thorough website, this is pretty straightforward: Bluehost is not in the business of providing HIPAA compliant email.