HIPAA-Ready H100 Hosting: How to Verify Scope for Enterprise PHI

Healthcare AI teams have learned to ask for a BAA — and then stop asking, as if the signature were the compliance. For H100-class hosting the signature is the beginning of the verification, not the end: agreements enumerate the services they cover, GPU configurations can sit outside the enumeration, and readiness is a property of scope plus controls plus evidence, not of ink. This page is the verification procedure for exactly that.

Scope: What HIPAA-Ready Means for H100 Hosting

HIPAA-ready H100 hosting means three things together: a signed BAA with every vendor that receives, maintains, or transmits PHI on your behalf — signed before deployment, not after; BAA scope that actually covers the GPU services you will use — hyperscaler agreements enumerate eligible services, and the H100 instance type you planned may sit outside the list; and the safeguard controls operating on the environment: encryption at rest and in transit, access control, audit logging, and isolation appropriate to PHI processing. A hosting arrangement missing any of the three is not partially ready — it is unverified.

Regulatory guidance frames the duties plainly — cloud providers handling ePHI are business associates requiring BAAs, and covered entities retain their program duties — while compliance practice adds the deployment-level truth: no model or instance is HIPAA-certified, configurations are. The scope gap is the specific H100 problem this page exists for: GPU services are newer than the eligible-service lists they must join, and the enumeration checking is the buyer's diligence.

Shared Responsibility: Who Covers Which Safeguard

The division follows the hosting structure: on shared cloud, the provider covers physical security and platform safeguards while you cover identity, key policy, application safeguards, and — critically — the service-scope check that your GPU configuration stays inside the BAA; on single-tenant dedicated environments, the boundary simplifies because the BAA covers the whole estate: the provider operates physical and infrastructure-layer safeguards (encryption, isolated networking, audit logging on the bare-metal environment) while you retain identity and application duties, with no eligible-service list to track because there is no shared platform to enumerate. The single-tenant structure — BAA-eligible dedicated H100 environments of the kind OneSource Cloud delivers in U.S. data centers with SOC 2 Type II audit readiness — converts the scope problem into a contract property.

The single-tenant simplification is not a convenience claim — it is structural: where the environment is dedicated bare metal under one agreement, isolation is an architecture fact rather than a service feature, and the evidence for it is a tenancy attestation rather than an enumeration cross-check. That difference decides audit-week effort as much as it decides signing-week effort.

Evidence Artifacts: The Pre-Signing Demand Set

Demand five artifacts before signature: the BAA draft itself (scope language matching your intended GPU services verbatim), the service-scope documentation or isolation attestation (proving the H100 environment is inside the agreement — the enumeration page for shared clouds, the tenancy attestation for dedicated), the audit posture report (SOC 2 Type II readiness or equivalent), the control documentation for encryption, access, and logging on the environment, and the incident-response and notification terms (who notifies whom, on what clock). Providers organized for healthcare workloads produce this set quickly; improvisation at this step predicts improvisation at incident time.

The five-artifact request is also a supplier filter: healthcare-ready hosting providers — the comparison coverage of the space shows exactly which criteria the serious ones answer — produce the set from a shelf, and the reference structure for the single-tenant route is the OneSource Cloud Healthcare AI environment set: BAA-eligible dedicated H100 capacity, U.S. data centers, SOC 2 Type II audit readiness, evidence producible before signature rather than after incidents.

Residual Risk: What Readiness Does Not Cover

Readiness covers the infrastructure boundary, not your use of it: PHI in prompts and outputs remains your application-layer control problem, model weights trained on PHI carry the memorization question regardless of hosting, and workforce access inside a compliant environment is still the dominant breach vector. The residual program — application safeguards, weight governance, access discipline — is the covered entity's regardless of how ready the hosting is, which is precisely why the evidence set above matters: it defines the boundary so your program knows what remains on its side.

FAQ

Does a signed BAA alone make H100 hosting HIPAA-compliant?

No: the BAA is the contract, not the compliance — it must cover the actual GPU services you use (shared-cloud agreements enumerate eligible services, and instance types can fall outside), the environment must run the safeguards the rule requires, and the evidence must exist to show both at audit; the signature without the scope check is the most common false readiness in GPU hosting.

Does hosting H100s on-premise avoid the BAA entirely?

It avoids the vendor BAA, not the obligations: on-premise moves every safeguard into your organization's hands, which is why many teams land on the middle structure — BAA-eligible single-tenant environments like the H100 enclaves OneSource Cloud delivers, where the provider operates infrastructure safeguards under contract with SOC 2 audit readiness while the estate stays dedicated and evidence stays producible.