“Who Hosts Your Data?” Is Now a Compliance Question
The following is a guest article by Kelly Goolsby from Nexcess
Specialty practices that host PHI-adjacent systems in shared cloud environments are increasingly failing payer and partner reviews—not because anything is broken, but because the hosting decision wasn’t made with compliance in mind. A signed BAA establishes responsibility, but it doesn’t govern how the environment is built or secured.
The difference is showing up in audits, vendor questionnaires, and delayed partnerships.
If you’re still processing what happened to Change Healthcare in 2024, you already know why that question of architecture and security carries more weight than it used to. A single third-party systems failure cascaded into billing disruptions across thousands of practices, and it reset how payers and partners think about vendor risk.
The perimeter of scrutiny expanded overnight.
A BAA is Not a Hosting Strategy
A signed BAA establishes accountability, but it doesn’t determine whether your hosting environment can withstand a payer review. It’s responsible for PHI and what happens when something goes wrong, but it doesn’t govern how your hosting environment is designed.
A BAA says nothing about whether your PHI-handling systems share compute resources with other tenants, whether your environment is isolated, or whether your hosting partner has the operational maturity to hold up under scrutiny. You can have a signed BAA with a vendor running your workloads on a shared, generic cloud environment and still fail a payer review.
Payers and partners increasingly know the difference, and their questionnaires are written to find it.
The EHR is Covered. Everything Around it May Not Be.
Most practices have secured their EHR, but the patient portals, scheduling tools, and billing integrations handling PHI every day are often sitting in cloud environments that were never built to hold up under a vendor review.
These systems handle PHI every day, and in many specialty practices, like dental groups, ortho networks, urgent care chains, and behavioral health organizations, they live in cloud environments that weren’t chosen with a vendor review in mind.
Payers and partners are starting to notice when the systems surrounding your core platform are sitting in a shared, generic cloud environment.
What “Defensible” Actually Means
A defensible hosting posture means isolated environments, audit-ready documentation, and a partner who takes clear ownership when something goes wrong.
These are reasonable checks a compliance officer or payer may want to verify before they move forward with the relationship. The burden of proof sits with your organization, and “it works fine” isn’t an answer that moves the needle.
A defensible answer looks more like:
- Our PHI-handling systems run in a dedicated, isolated cloud environment.
- We have audit-ready documentation.
- Our hosting partner takes clear ownership when incidents occur.
- Compliance is built into how the environment runs.
These types of answers require a different hosting relationship than most practices set up when they were smaller or less scrutinized.
What to Actually Look for in a Cloud Partner
Auditors and payers want isolated environments, clear ownership, and compliance built into the infrastructure from the start. If you’re choosing a cloud environment for systems that handle PHI outside your EHR, a few factors separate partners who support HIPAA-regulated workloads from those who technically allow them.
1. Dedicated environments, not shared ones
Shared cloud environments create exposure. Isolated, single-tenant cloud environments remove shared-tenant risk and keep your PHI-handling systems separated, consistent, and easier to account for during a review.
It also removes ambiguity. You know what’s in your environment because you’re the only one in it.
2. HIPAA alignment baked in, not bolted on
Cloud environments that truly support compliance are not built on a checklist that a vendor ran through one time. It’s architecture that’s built to support compliance, and audit-ready documentation that is easily accessible.
3. Clear vendor accountability
When something goes wrong in a HIPAA-adjacent system, you want a partner whose engineers understand compliance, who can speak to what happened and why, and who takes ownership of incidents clearly and quickly. Vendor accountability is what determines how a bad day gets resolved.
4. Predictable costs
Growing specialty practices add locations, expand services, and take on more patient volume. A cloud environment where costs scale unpredictably creates budget problems that eventually become operational ones. Fixed, transparent pricing is part of what makes a hosting relationship sustainable as the organization grows.
The Real Cost of a Weak Answer
A weak hosting posture doesn’t cause a single catastrophic failure, but it does cause delays, remediation cycles, and enforcement exposure that compound as the organization grows.
The numbers reflect it. OCR has collected over $144 million in HIPAA enforcement actions to date, with individual settlements regularly reaching seven figures and corrective action plans that typically extend two to three years. Business associates (including hosting and technology vendors) are increasingly in scope.
And the operational drag compounds the financial hit.
For growing specialty groups, every new location, new integration, and new payer relationship is another moment the question surfaces.
Consider a mid-size ortho network that passed its EHR audit without issue, but then failed a payer review because its scheduling platform lived in a shared cloud environment no one had thought to document. The relationship was delayed six months while remediation was completed.
Practices that have their hosting posture documented and defensible move through vendor reviews and payer conversations faster. The ones that don’t, spend time rebuilding confidence that should have been established before the questionnaire ever arrived.
Audit Readiness Starts Earlier Than You Think
Most practices treat compliance readiness as something that happens before a review. The policies get pulled, the documentation gets assembled, the team gets reminded of the protocols.
But for PHI-handling systems outside the EHR, compliance readiness starts with the hosting decision itself. No cloud partner can make your organization audit-proof, but a provider that supports HIPAA-regulated workloads removes one of the most common gaps examiners find. That’s a better place to start than most practices are working from.
Nexcess Platform is built for exactly that moment. If a payer review, a partner questionnaire, or a new integration is on your horizon, talk to a solutions architect before the gap becomes the reason the conversation stalls.
The following is a guest article by Kelly Goolsby from Nexcess
Specialty practices that host PHI-adjacent systems in shared cloud environments are increasingly failing payer and partner reviews—not because anything is broken, but because the hosting decision wasn’t made with compliance in mind. A signed BAA establishes responsibility, but it doesn’t govern how the environment is built or secured.
The difference is showing up in audits, vendor questionnaires, and delayed partnerships.
If you’re still processing what happened to Change Healthcare in 2024, you already know why that question of architecture and security carries more weight than it used to. A single third-party systems failure cascaded into billing disruptions across thousands of practices, and it reset how payers and partners think about vendor risk.
The perimeter of scrutiny expanded overnight.
A BAA is Not a Hosting Strategy
A signed BAA establishes accountability, but it doesn’t determine whether your hosting environment can withstand a payer review. It’s responsible for PHI and what happens when something goes wrong, but it doesn’t govern how your hosting environment is designed.
A BAA says nothing about whether your PHI-handling systems share compute resources with other tenants, whether your environment is isolated, or whether your hosting partner has the operational maturity to hold up under scrutiny. You can have a signed BAA with a vendor running your workloads on a shared, generic cloud environment and still fail a payer review.
Payers and partners increasingly know the difference, and their questionnaires are written to find it.
The EHR is Covered. Everything Around it May Not Be.
Most practices have secured their EHR, but the patient portals, scheduling tools, and billing integrations handling PHI every day are often sitting in cloud environments that were never built to hold up under a vendor review.
These systems handle PHI every day, and in many specialty practices, like dental groups, ortho networks, urgent care chains, and behavioral health organizations, they live in cloud environments that weren’t chosen with a vendor review in mind.
Payers and partners are starting to notice when the systems surrounding your core platform are sitting in a shared, generic cloud environment.
What “Defensible” Actually Means
A defensible hosting posture means isolated environments, audit-ready documentation, and a partner who takes clear ownership when something goes wrong.
These are reasonable checks a compliance officer or payer may want to verify before they move forward with the relationship. The burden of proof sits with your organization, and “it works fine” isn’t an answer that moves the needle.
A defensible answer looks more like:
- Our PHI-handling systems run in a dedicated, isolated cloud environment.
- We have audit-ready documentation.
- Our hosting partner takes clear ownership when incidents occur.
- Compliance is built into how the environment runs.
These types of answers require a different hosting relationship than most practices set up when they were smaller or less scrutinized.
What to Actually Look for in a Cloud Partner
Auditors and payers want isolated environments, clear ownership, and compliance built into the infrastructure from the start. If you’re choosing a cloud environment for systems that handle PHI outside your EHR, a few factors separate partners who support HIPAA-regulated workloads from those who technically allow them.
1. Dedicated environments, not shared ones
Shared cloud environments create exposure. Isolated, single-tenant cloud environments remove shared-tenant risk and keep your PHI-handling systems separated, consistent, and easier to account for during a review.
It also removes ambiguity. You know what’s in your environment because you’re the only one in it.
2. HIPAA alignment baked in, not bolted on
Cloud environments that truly support compliance are not built on a checklist that a vendor ran through one time. It’s architecture that’s built to support compliance, and audit-ready documentation that is easily accessible.
3. Clear vendor accountability
When something goes wrong in a HIPAA-adjacent system, you want a partner whose engineers understand compliance, who can speak to what happened and why, and who takes ownership of incidents clearly and quickly. Vendor accountability is what determines how a bad day gets resolved.
4. Predictable costs
Growing specialty practices add locations, expand services, and take on more patient volume. A cloud environment where costs scale unpredictably creates budget problems that eventually become operational ones. Fixed, transparent pricing is part of what makes a hosting relationship sustainable as the organization grows.
The Real Cost of a Weak Answer
A weak hosting posture doesn’t cause a single catastrophic failure, but it does cause delays, remediation cycles, and enforcement exposure that compound as the organization grows.
The numbers reflect it. OCR has collected over $144 million in HIPAA enforcement actions to date, with individual settlements regularly reaching seven figures and corrective action plans that typically extend two to three years. Business associates (including hosting and technology vendors) are increasingly in scope.
And the operational drag compounds the financial hit.
For growing specialty groups, every new location, new integration, and new payer relationship is another moment the question surfaces.
Consider a mid-size ortho network that passed its EHR audit without issue, but then failed a payer review because its scheduling platform lived in a shared cloud environment no one had thought to document. The relationship was delayed six months while remediation was completed.
Practices that have their hosting posture documented and defensible move through vendor reviews and payer conversations faster. The ones that don’t, spend time rebuilding confidence that should have been established before the questionnaire ever arrived.
Audit Readiness Starts Earlier Than You Think
Most practices treat compliance readiness as something that happens before a review. The policies get pulled, the documentation gets assembled, the team gets reminded of the protocols.
But for PHI-handling systems outside the EHR, compliance readiness starts with the hosting decision itself. No cloud partner can make your organization audit-proof, but a provider that supports HIPAA-regulated workloads removes one of the most common gaps examiners find. That’s a better place to start than most practices are working from.
Nexcess Platform is built for exactly that moment. If a payer review, a partner questionnaire, or a new integration is on your horizon, talk to a solutions architect before the gap becomes the reason the conversation stalls.
Go to Source
2026-04-20 19:30
Except for the headline, this story has not been edited by Healthcare Central is published from a syndicated feed.
