InterServer HIPAA Hosting: BAA and Shared Responsibilities

If your hosting environment will store or process electronic protected health information (ePHI), you need to understand both the hosting provider’s role and your own security responsibilities. InterServer’s Business Associate Agreement (BAA) describes that relationship for dedicated physical server hosting, including customer-owned servers and dedicated bare-metal servers.

To request an InterServer BAA, open a support ticket in the InterServer customer portal. Include your organization name, the server or service involved, and a short description of your intended use. Support can coordinate the agreement and confirm the applicable service scope before you place ePHI on the service.

Download the BAA and provisioning checklist

• Download the InterServer Business Associate Agreement, v7 (PDF, 10 pages). Includes the service description, security controls, shared responsibility matrix, provisioning checklist, and signature pages.
• Download the InterServer HIPAA Hosting Provisioning Checklist, v3 (PDF, 2 pages). A separate checklist covering InterServer’s infrastructure and onboarding responsibilities.

Both documents use periodic wording for access reviews and unsuccessful-incident summaries. Downloading a blank BAA does not execute an agreement or activate coverage for a service. Your signed BAA, applicable order, and any signed Statement of Work (SOW) define the agreed services and responsibilities.

What are HIPAA and a BAA?

HIPAA stands for the Health Insurance Portability and Accountability Act. Its Security Rule addresses administrative, physical, and technical safeguards for ePHI held by regulated entities. Hosting infrastructure is one part of that environment; your applications, users, procedures, and data handling also matter. See the HHS summary of the HIPAA Security Rule.

A Business Associate Agreement establishes obligations when a business associate handles protected health information on behalf of a covered entity. It addresses matters such as permitted uses, safeguards, incident reporting, and handling information when services end. HHS provides an overview of business associate contract requirements.

Encryption alone does not remove the need for the appropriate agreement. HHS explains that a hosting or cloud provider maintaining ePHI can be a business associate even when the information is encrypted and the provider does not hold the decryption key. Its HIPAA cloud computing guidance also explains why a BAA and technical safeguards must work together.

Which InterServer services do these documents cover?

The attached BAA describes physical hosting of customer-owned servers or dedicated bare-metal servers, with the customer managing the operating system and applications. The scope can include private networks and connectivity, plus contracted network services such as DDoS protection or optional edge security.

InterServer does not provide routine operating system or application administration under this default hosting model. Managed services must be expressly included in a separate signed SOW. The documents do not establish blanket BAA coverage for every InterServer product, shared hosting plan, VPS, backup service, or third-party application. Ask support to confirm the specific service and configuration you intend to use.

You can review InterServer dedicated servers when planning the infrastructure, then use the support ticket to discuss the BAA and any additional requirements.

Who is responsible for security?

The BAA’s Exhibit D divides responsibilities between InterServer and the customer. The following summarizes the default customer-managed server arrangement:

InterServer’s infrastructure responsibilities

• Physical hosting: Facility access controls, power, cooling, racks, cabling, and hardware lifecycle and media-handling processes within the service scope.
• Provider networking: Network segmentation, provider management-network security, and contracted network-edge protections.
• Provider systems: Staff access controls, periodic access reviews, logging, time synchronization, and vulnerability management for InterServer-controlled systems.
• Operations: Workforce security procedures, infrastructure incident response, and the reporting and cooperation obligations set out in the BAA.

The customer’s server and application responsibilities

• Operating system: Harden the server, apply patches, restrict administrative access, and remediate vulnerabilities.
• Accounts: Manage users, service accounts, permissions, privileged access, and multifactor authentication on servers and applications.
• Encryption: Configure server-side encryption at rest, manage encryption keys, and secure application connections.
• Applications and databases: Secure the software, data access, configurations, and integrations that handle ePHI.
• Monitoring and recovery: Maintain appropriate endpoint protection, collect and review server and application logs, back up data, and test restores.
• Organizational controls: Assess risks, document procedures, train your workforce, and manage any vendors involved in your workflow.

For example, InterServer’s management-network controls do not configure MFA inside your application. Network-edge protection does not patch the server’s operating system, and a backup plan needs an identified owner and tested recovery process.

How to request a BAA through a support ticket

1. Sign in to the InterServer customer portal and open a support ticket. Use a clear subject such as “HIPAA hosting and BAA request.”
2. Identify your organization and service. Provide the legal organization name, your account or service identifier, and the dedicated server or customer-owned hardware involved. If you are planning a new deployment, describe the proposed service.
3. Describe the scope without including patient data. Explain the application type, the general kinds of data it will handle, the preferred hosting location, and any requested managed services. Do not attach patient records, production database exports, passwords, or encryption keys to the request.
4. Review the documents with your security or compliance team. Confirm the service description, shared responsibilities, notice addresses, security contacts, and any additional SOW.
5. Complete execution and onboarding before using the service for ePHI. Have authorized representatives complete the agreement, retain the executed copy, and verify the agreed infrastructure and customer-side safeguards.

If your organization acts as a business associate for another organization, explain that relationship in the ticket so support can coordinate the appropriate agreement and service review.

What does the provisioning checklist cover?

The checklist is specific to InterServer’s responsibilities. It covers contracting, dedicated hardware assignment, management-interface isolation, media sanitization, network segmentation, provider access controls, logging, encryption within the provider’s scope, risk management, and the customer handoff.

During onboarding, confirm that your team receives the assigned network and management details, the shared responsibility information, and the support and emergency-access procedures. The checklist describes authorized, ticketed, auditable emergency access rather than routine logical access to customer data.

Customers still need a separate implementation plan for their own operating system, applications, encryption keys, backups, monitoring, and incident handling. Completing the provider checklist does not complete those tasks.

Managed services and optional controls

The documents describe optional services such as managed backups, edge firewall/WAF/VPN services, endpoint protection and vulnerability scanning, log shipping, and hardening or patching. Discuss the services you need in your support ticket. Availability, configuration, ownership, and any changes to the responsibility split must be confirmed in the applicable signed SOW.

For backups in particular, clarify what data is protected, who manages encryption and keys, retention, whether immutability is included, and who performs and verifies restores. Do not assume that purchasing a server includes managed backup or application security.

Incident reporting and ongoing reviews

The downloadable BAA sets out separate obligations for security incidents and breaches of unsecured PHI. Section 6.2 specifies notification without unreasonable delay and no later than three business days after discovery of a breach of unsecured PHI. This is a term of the InterServer agreement; it should not be confused with a general summary of every HIPAA notification deadline.

The documents also describe periodic access reviews and periodic reporting of unsuccessful incidents, with the applicable request and reporting provisions in the agreement. Keep your security contacts current and review the BAA and service scope when your deployment or vendors change. The BAA includes insurance requirements and provides for a Certificate of Insurance on request; support can coordinate that request.

Common questions

Does signing a BAA make my server HIPAA compliant?

A signed BAA establishes responsibilities, but your deployment still needs the appropriate safeguards and operating procedures. In the default arrangement described here, the customer remains responsible for the operating system, applications, access management, encryption at rest, and server-data recovery.

Can I use these documents for a shared hosting account or VPS?

The attached documents describe dedicated physical hosting. Open a support ticket to discuss a different service; do not assume that the same agreement or configuration applies.

Are the downloadable PDFs signed agreements?

No. They are reference documents for review and onboarding. A BAA must be completed and executed for the agreed service. The signed agreement and any signed SOW govern the actual engagement.

Where do I start?

Download the InterServer BAA and provisioning checklist, then open a support ticket with your organization and service details. This article explains the hosting arrangement and request process; it does not replace the signed agreements or your organization’s compliance assessment.