Key Takeaways
- HIPAA in 2026 has stricter encryption-in-use language — the December 2024 NPRM explicitly references hardware-isolated execution. Audits now ask for evidence, not promises.
- Most "HIPAA GPU clouds" are paperwork tiers, not technology tiers. Same H100, same VRAM, plus a contract and a 2–4× markup.
- Intel TDX changes the math. PHI stays sealed in encrypted memory and VRAM; even the cloud operator cannot read it. The BAA scope shrinks because the data it covers is invisible to us.
- Real 2026 pricing: confidential H100 around $2.77/hr, confidential H200 around $3.60/hr on VoltageGPU — vs roughly $11–$14/hr on Azure NCv5 confidential VMs.
- 5–7% TDX overhead on H100 and H200 LLM inference. Clinically invisible.
Every healthcare team that wants to put a large language model near patient data hits the same wall in 2026: their GPU cloud will not sign a BAA, or will only sign one in exchange for a 2–4× markup. The markup pays for paperwork, not technology. The H100 you would rent for $2.69/hr off-the-shelf becomes the same H100 for $11/hr the moment you mention PHI.
That premium made sense in 2018, when "HIPAA-eligible" meant a different account, a different audit log, and an SRE on retainer. It stopped making sense in 2024, when Intel TDX confidential GPUs made the cloud operator structurally unable to read PHI, even with full root on the host. In 2026, paying 4× for a contract that papers over a problem the hardware already solves is just a bad procurement decision.
This guide is a practical map of the HIPAA-compliant GPU cloud market as of April 2026 — what changed, who actually signs a BAA, what evidence regulators want, and the real H100 / H200 pricing across Azure, AWS Nitro, and VoltageGPU TDX.
What Actually Changed for HIPAA in 2026
The December 30, 2024 HHS NPRM (Notice of Proposed Rulemaking) tightened the Security Rule's technical safeguards language for the first time since 2003. Three changes matter for AI workloads:
- Encryption is no longer "addressable" — it is required. The old rule let covered entities document why encryption was infeasible. The new rule eliminates that exception for ePHI.
- "In use" is named explicitly. Previous text covered PHI at rest and in transit. The proposal extends to PHI being processed — which is exactly what happens during LLM inference.
- Auditable technical evidence is expected. The OCR has signaled it will ask for proof — attestation logs, access reviews, hardware measurements — not just policies.
Translation: a vendor that says "we are HIPAA compliant" without producing a TDX attestation, a key release log, or a measured boot trace is selling 2018-era compliance. That gap is what this article is about.
How Major HIPAA GPU Clouds Map to the 2026 Encryption-in-Use Rule
Every "HIPAA-eligible" GPU cloud encrypts PHI at rest (disk) and in transit (TLS). The 2026 NPRM changes the bar: encryption in use — while the GPU is actually crunching the data — becomes a required technical safeguard. Most providers do not meet it. Here is the honest snapshot in April 2026:
| Provider | At rest | In transit | In use (HIPAA 2026) | Mechanism |
|---|---|---|---|---|
| Azure NCv5 confidential VM (H100) | Yes | Yes | Yes | Intel TDX + NVIDIA H100 confidential mode |
| AWS Nitro Enclaves (p5) | Yes | Yes | Partial | Nitro enclave for CPU; H100 not in confidential mode by default |
| CoreWeave HIPAA tier (H100/H200) | Yes | Yes | No | BAA + isolation, no TEE on the GPU path |
| Lambda Labs Reserved (H100) | Yes | Yes | No | Bare-metal isolation, no Intel TDX |
| Corvex.ai HIPAA | Yes | Yes | No | Single-tenant policy, no hardware-sealed memory |
| VoltageGPU TDX (H100/H200) | Yes | Yes | Yes | Intel TDX + protected PCIe + remote attestation per request |
The shortlist of providers that satisfy the new in-use language on a GPU path in 2026 is small: Azure NCv5 confidential, and confidential GPU clouds built on Intel TDX. The Azure version costs roughly 4× what a TDX specialist charges for the same H100 — which is what makes the Azure confidential computing alternative conversation interesting at all.
Who Actually Signs a BAA on GPU Workloads
The 2026 landscape, from the perspective of a clinic CISO:
- OpenAI / Anthropic. BAAs available only on specific enterprise tiers, typically with $60K+/year minimums. The default API contract still excludes PHI.
- Azure / AWS / GCP. Will sign BAAs, but only for specific HIPAA-eligible services. A vanilla EC2 with an A100 is out of scope; an Azure NCv5 confidential VM is in scope, at roughly $11–$14/hr.
- Most "decentralized" GPU networks. Cannot sign a BAA — there is no single legal entity to indemnify, and the trust model (open subnets, anonymous providers) is structurally incompatible with PHI handling.
- VoltageGPU. BAA available on the Pro plan. Because Intel TDX prevents us from reading PHI in memory, the BAA scope is narrower than at a hyperscaler — which is exactly what your privacy counsel wants.
Why Intel TDX Is the Evidence the OCR Wants
HIPAA does not require Intel TDX by name. But it asks for a control that satisfies 45 CFR § 164.312(a)(2)(iv) — encryption of ePHI — and the new "in use" language. Intel TDX is currently the cleanest implementation of that control for GPU workloads:
- Memory encryption. AES-XTS encrypts the Trust Domain's RAM with a key the cloud operator never holds.
- Protected PCIe. Host↔GPU traffic flows through an authenticated, encrypted channel. The hypervisor cannot snoop.
- Remote attestation. Intel signs a quote that proves the exact firmware, kernel, and container image the TD booted. Pin a measurement; refuse to send PHI to anything that does not match.
For an audit, the artifact you hand the OCR is a signed TDX quote tied to a measurement you control — not a vendor letter. See our step-by-step attestation guide for the exact process.
Real 2026 Pricing for HIPAA-Eligible GPUs
I priced the same workload — a 70B-class LLM on a single H100 or H200 with a HIPAA BAA and confidential computing — across the three providers that can credibly serve it in April 2026. Numbers are list prices per on-demand GPU-hour, before discounts.
- Azure NCv5 confidential VM, H100 80GB: ~$11.00–$14.00/hr, BAA via Microsoft's standard agreement, 1-year reserved discount available.
- AWS Nitro Enclaves, H100 (p5.48xlarge slice): ~$8.00–$10.00/hr attributable per H100, BAA via AWS, but Nitro enclave size limits make 70B-class models painful.
- VoltageGPU TDX, H100 80GB: $2.77/hr on demand, BAA on the Pro plan.
- VoltageGPU TDX, H200 141GB: $3.60/hr on demand, BAA on the Pro plan, fits a quantised 70B in a single GPU.
The market clearing price for confidential H100 in 2026 is closer to $2.77 than to $14. The premium hyperscalers charge is a procurement legacy, not a hardware cost. Live numbers for every confidential GPU we offer live on our live-prices page.
HIPAA vs HITRUST vs SOC 2 — What Your Procurement Actually Wants
Healthcare procurement teams routinely ask for all three. They are not interchangeable:
- HIPAA is federal law. It is a floor, not a certification. There is no "HIPAA certificate". A vendor is HIPAA-aligned because the BAA + technical controls satisfy the rule.
- HITRUST CSF is a certifiable framework that maps HIPAA + ISO 27001 + NIST controls. Hospital systems often require it for vendors that touch PHI.
- SOC 2 Type II is an attestation about security/availability controls over a 6–12 month period. Useful for procurement, irrelevant for HIPAA on its own.
On VoltageGPU, the HIPAA path is BAA + TDX evidence on day one. SOC 2 Type II is in progress for confidential compute. HITRUST is on roadmap if a customer asks.
A Practical Implementation Checklist
- Sign a BAA with your GPU cloud and any inference framework provider in the path. No BAA, no PHI — full stop.
- Pin a TDX measurement for the exact image you want to run. Refuse to accept attestation quotes that do not match.
- Disable logging of prompts and completions at the inference layer (
no_log: trueon our API). Retain only non-PHI metadata for billing. - Run inference inside the TD — bring your own OCI image or use a vendor-attested image. Mount sealed storage for weights.
- Document the data flow for your privacy officer: where PHI enters, which TDs touch it, where outputs go, how long anything is retained.
- Run a tabletop incident response drill twice a year. The OCR notices.
When You Should Not Use a Confidential GPU Cloud for HIPAA
Three honest cases where the simpler option wins:
- You only handle de-identified data. If your pipeline does not touch PHI, HIPAA does not apply — rent a normal GPU and save the time.
- You need on-premise control for a different reason. Some research institutions have policies that forbid any cloud, regardless of TDX. Those policies are a procurement question, not a compliance one.
- You are using a cloud-hosted model with native BAA (Azure OpenAI, Bedrock with Claude on AWS) and the latency/cost works for your use case. That is a legitimate path for many SOAP-note workflows.
Getting Started in 2026
If you are a healthcare team putting an LLM near PHI for the first time, the path is:
- Read our deep-dive on the BAA trap for the contractual story.
- Read the attestation step-by-step to see what evidence you will keep on file.
- Compare confidential GPU pricing on our live-prices page against your current quote.
- Email contact@voltagegpu.com for a BAA template — we typically turn one around in a single business day.
HIPAA in 2026 is not a paperwork problem dressed up as a technology problem. It is a technology problem that hardware finally solves — and the cloud operator that bills you 4× for paperwork is the one that has not caught up.