- Home
-
Hosting
Shared HostingWeb HostingPowerful affordable hostingWordPress HostingOptimized for WordPressNginx HostingFaster hosting with NginxAI Coding HostingBuild with Code with AISpecializedNode.js HostingServer-side JavaScriptHIPAA HostingCompliance readyReseller HostingStart your own brandVPS & DedicatedFull control, more power
- Domains
- Easy Transfer
- About
Client Login
HIPAA Hosting for Therapists & Counselors
Secure Website Hosting for Solo Practitioners, Group Practices & Telehealth Therapists
Your practice website needs hosting that takes client confidentiality as seriously as you do. Whether you are a solo therapist running a private practice, a group counseling office, or a telehealth provider, the website where prospective clients first find you should rest on infrastructure built for sensitive data.
Ultra's HIPAA-ready hosting plan provides dedicated IP addressing, SSL/TLS encryption for every page and form, CloudLinux CageFS isolation that keeps your account fully separated from other sites on the server, server-level firewalls, and full physical chain-of-custody over the hardware that stores your data. Everything runs on servers we own and operate in our own data center near Seattle, not rented rack space in a third-party facility.
Important: This plan does not include a Business Associate Agreement (BAA). Ultra provides the server infrastructure and physical safeguards that support HIPAA compliance, but a BAA is a separate legal agreement that must be arranged independently. Most therapists work with a compliance consultant or healthcare attorney to establish BAAs with the vendors that handle PHI in their practice (typically the EHR or practice management system, not the public-facing website). Contact us with any questions about what our infrastructure covers.
HIPAA-Ready Hosting Plan for Therapy Practices
The same secure hosting infrastructure trusted by medical practices, scoped and priced for therapists and counselors.
HIPAA Hosting for Therapy Practices
Secure infrastructure for therapist websites & intake
Security Features That Matter for Therapy Practices
The technical, physical, and operational safeguards built into every hosting account.
SSL Encryption on Every Page
Every account includes a free SSL certificate for encrypted HTTPS connections across your entire site. Contact forms, scheduling links, and any prospective-client form submissions are protected with TLS encryption in transit, meeting the encryption expectations of the HIPAA Security Rule.
CloudLinux CageFS Isolation
Your practice website runs inside its own CloudLinux CageFS container, completely isolated from every other account on the server. Neighboring sites cannot access your files, databases, or any client information stored on the server, even if another account on the same machine is compromised.
Dedicated IP & Firewall
Your practice gets a dedicated IP address, so you are not sharing network identity with unrelated websites. Server-level firewalls and intrusion detection systems monitor for unauthorized access attempts and block suspicious traffic automatically before it ever reaches your site.
Audit Logging & Monitoring
All server access and administrative actions are logged for audit and compliance purposes. Our monitoring systems track login activity, file changes, and access patterns. Detailed logs are maintained and available if your compliance consultant or auditor needs to verify infrastructure-level controls.
Physical Security & On-Site Staff
Ultra's support team works on-site at our data center. Our staff members are the only personnel with physical access to the servers. Most hosting providers cannot offer this because they rent rack space in third-party facilities where strangers, contractors, and other tenants share the building. We control the physical perimeter.
Trained Staff & Access Controls
Our technicians are trained in data protection, security policies, and incident response. Access to server infrastructure is restricted to authorized personnel only. Password policies, audit logging, and secure procedures keep your hosting environment protected at every layer.
On-Site Hardware & Drive Control
Your practice website lives on physical hard drives that we own and control inside our own data center, not on shared cloud infrastructure managed by a third party. We handle all hardware deployment, maintenance, and secure drive destruction in-house, giving us full chain-of-custody over the physical media. For a therapist concerned about where data actually sits and who can touch it, this is the answer.
What This Means in Plain English for Your Practice
You are not running a hospital. You are running a private practice, a group, or a telehealth panel. The infrastructure questions still matter, just at a different scale. Your prospective-client landing page, your bio page, your contact form, your blog about coping skills and treatment approaches: all of that lives on a website. That website lives somewhere. With Ultra, it lives on hardware we own, in a facility we control, behind isolation that keeps neighboring accounts out.
For the parts of your practice that handle PHI directly — session notes, billing, secure messaging, video sessions — you almost certainly already use a HIPAA-compliant practice management platform like SimplePractice, TherapyNotes, Jane App, Counsol, or similar. Those platforms have BAAs and handle PHI inside their systems. Ultra hosts the public website that points clients to your scheduling link or intake form on those platforms. The two layers complement each other. Have questions about your specific workflow? We are happy to talk through it.
Who This Plan Is Built For
Therapists, counselors, and mental-health-adjacent organizations that need their website on infrastructure they can trust.
Solo Therapists & Counselors
Private practice LMFTs, LCSWs, LPCs, LMHCs, psychologists, and counselors building or moving their practice website.
Group Counseling Practices
Multi-clinician offices, group practices, and partnerships hosting a shared practice website with bios, services, and intake.
Telehealth Therapy Providers
Virtual-first practices and telehealth panels whose public website routes clients to a HIPAA-compliant video platform.
Psychologists & Psychiatrists
Doctoral-level clinicians, neuropsychologists, and prescribing psychiatrists running a private or group practice website.
Frequently Asked Questions From Therapists
If your website collects, transmits, or stores protected health information (PHI) and you are a HIPAA covered entity, you generally need a Business Associate Agreement with any vendor that touches that PHI, including your web host. Ultra does not currently offer a BAA. Many solo therapists work with a compliance consultant or healthcare attorney to determine which of their vendors need BAAs and to draft the agreements. We focus on providing the secure infrastructure layer; the BAA itself is a separate legal arrangement.
You can host the form on Ultra's hosting with SSL/TLS encryption protecting data in transit. For HIPAA-compliant intake forms that store PHI, most therapists either keep the public-website form simple (basic contact info only) and direct sensitive intake to a HIPAA-compliant practice management system like SimplePractice, TherapyNotes, Jane App, or Counsol that already has BAAs in place, OR work with a compliance consultant to ensure the full intake workflow including the BAA chain is covered. The hosting infrastructure supports it; the workflow design is a separate decision based on your practice setup.
For the marketing, scheduling-link, and informational pages of a telehealth therapy practice, yes. The actual video session platform is typically a separate HIPAA-compliant service like Doxy.me, SimplePractice Telehealth, Zoom for Healthcare, or VSee, each of which provides its own BAA. Ultra hosts your practice website that links out to the video platform; we do not provide the video conferencing layer itself.
Yes. Ultra's hosting plays well alongside any practice management or EHR platform. Your website lives on Ultra and links to your scheduling page, client portal, or intake form hosted on your EHR vendor's domain. The two systems integrate at the link/redirect level. Most therapists run their public-facing website on Ultra and route confidential workflows (notes, billing, secure messaging) through their EHR provider, which is a clean separation of responsibilities.
Standard shared hosting plans share IP addresses with potentially dozens or hundreds of other websites, lack account-level isolation, and run on cloud infrastructure where the provider has no physical control over the hardware. For a therapy practice handling client information, that is a poor fit. This plan gives you a dedicated IP, CloudLinux CageFS isolation so other accounts cannot see your files, and hosting on hardware we physically own and operate in our own facility. Our staff are the only people with access to the servers.
No. Ultra does not currently offer a BAA. We are transparent about this because we believe it is important for therapists to understand exactly what they are getting. Our plan provides the server-level infrastructure and physical safeguards that support compliance, but a BAA is a separate legal agreement. Most therapists work with a compliance consultant or healthcare attorney to establish BAAs with the vendors that actually handle PHI in their practice.
Yes. Ultra offers free website migration with annual or longer plans. Our migration team handles cPanel transfers, WordPress sites, database moves, and email setup. We take extra care to ensure secure handling of all data during the transfer process. Just submit a support ticket after signing up with your current host's login details.
For appointment scheduling that involves PHI, route clients to your EHR's scheduling page (SimplePractice, TherapyNotes, Jane App, etc.) which carries its own BAA. For general contact forms on your hosted website, encrypted form submission over HTTPS is included by default via the free SSL certificate. If a prospective client sends sensitive information through a basic contact form, your standard practice should be to respond by directing them to a secure intake method through your EHR rather than continuing the conversation by email.
Looking for general HIPAA hosting? If your organization is broader than a therapy practice — a medical clinic, dental office, billing company, or health-adjacent business — see our main HIPAA Hosting page for the full overview of our healthcare hosting infrastructure.
