HIPAA 2026: Who Encrypts PHI in Use on GPUs

Companion long-form on X, read the X Article version

Selling into EU healthcare or fintech? The equivalent EU regime is DORA Article 28 for AI vendors , covers the same hardware-attestation evidence stack that HIPAA buyers now ask for.

Every healthcare team that wants to put a large language model near patient data hits the same wall in 2026: their GPU provider will not sign a BAA, or signs one only for specific HIPAA-eligible services. Azure's confidential H100 VM lists at $8.90/hr against $6.95/hr for ours (we do not sign a BAA yet).

That premium made sense in 2018, when "HIPAA-eligible" meant a different account, a different audit log, and an SRE on retainer. It stopped making sense in 2024, when Intel TDX confidential GPUs made the cloud operator structurally unable to read PHI in the guest's memory, even with full root on the host.

This guide is a practical map of the HIPAA-aligned GPU hosting market as of April 2026, what changed, who actually signs a BAA, what evidence regulators want, and the real H100 / H200 pricing across Azure, AWS Nitro, and VoltageGPU TDX.

What Actually Changed for HIPAA in 2026

The December 2024 HHS NPRM (Notice of Proposed Rulemaking) tightened the Security Rule's technical safeguards language for the first time since 2003. Three changes matter for AI workloads:

• Encryption is no longer "addressable" it is required. The old rule let covered entities document why encryption was infeasible. The new rule eliminates that exception for ePHI.
• "In use" is named explicitly. Previous text covered PHI at rest and in transit. The proposal extends to PHI being processed, which is exactly what happens during LLM inference.
• Documented technical evidence is expected. The proposal asks for written verification of technical safeguards, including from business associates, not just policies.

Translation: a vendor's "HIPAA-aligned" claim is worth more when it comes with technical evidence, such as a TDX attestation you generate yourself. That gap is what this article is about.

The HIPAA Security Rule clock. HHS released the proposal in December 2024. As proposed, covered entities and business associates would have 240 days after the final rule is published to comply. This page does not predict the date of the final rule.

How Major HIPAA GPU Providers Map to the Proposed Encryption-in-Use Language

Every "HIPAA-eligible" GPU provider encrypts PHI at rest (disk) and in transit (TLS). The NPRM raises the bar: encryption in use: while the GPU is actually crunching the data, becomes a required technical safeguard. Most providers do not meet it. Here is the honest snapshot in April 2026:

The shortlist of providers that satisfy the new in-use language on a GPU path in 2026 is small: Azure's confidential H100 VM, and confidential GPU providers built on Intel TDX. The Azure version (NCC40ads H100 v5, AMD SEV-SNP) lists at $8.90/hr, about 1.3× the $6.95/hr we charge for an Intel TDX H100 VM (Vantage catalog, 12 September 2026), which is what makes the Azure confidential computing alternative conversation interesting at all.

Who Actually Signs a BAA on GPU Workloads

The 2026 landscape, from the perspective of a clinic CISO:

• OpenAI / Anthropic. BAAs available only on specific enterprise tiers, typically with $60K+/year minimums. The default API contract still excludes PHI.
• Azure / AWS / GCP. Will sign BAAs, but only for specific HIPAA-eligible services. A vanilla EC2 with an A100 is out of scope; an Azure confidential H100 VM (NCC40ads H100 v5) is in scope, at $8.90/hr.
• Most peer-to-peer GPU marketplaces. Cannot sign a BAA: there is no single legal entity to indemnify, and the trust model (open subnets, anonymous providers) is structurally incompatible with PHI handling.
• VoltageGPU. No BAA yet: we do not sign one today, it is planned after SOC 2 Type I (live status on the Trust Center). When it exists, because Intel TDX prevents us from reading PHI in memory, its scope will be narrower than at a hyperscaler, which is exactly what your privacy counsel wants.

Why Intel TDX Produces Evidence You Can File

HIPAA does not require Intel TDX by name. But it asks for a control that satisfies 45 CFR § 164.312(a)(2)(iv), encryption of ePHI, and the new "in use" language. Intel TDX is currently the cleanest implementation of that control for GPU workloads:

• Memory encryption. AES-XTS encrypts the Trust Domain's RAM with a key the cloud operator never holds.
• trust-domain GPU isolation. Host↔GPU traffic flows through an authenticated, encrypted channel. The hypervisor cannot snoop.
• Remote attestation. Intel signs a quote that proves the exact firmware, kernel, and image the TD booted. Pin a measurement; refuse to send PHI to anything that does not match.

For an audit, the artifact you hand the OCR is a signed TDX quote tied to a measurement you control, not a vendor letter. See our step-by-step attestation guide for the exact process.

Real 2026 Pricing for HIPAA-Eligible GPUs

I priced the same workload, a 70B-class LLM on a single H100 or H200 with a HIPAA BAA and confidential computing, across the three providers that can credibly serve it in April 2026. Numbers are list prices per on-demand GPU-hour, before discounts.

• Azure NCC40ads H100 v5 confidential VM (AMD SEV-SNP, H100 NVL): $8.90/hr (Vantage catalog, 12 September 2026), BAA via Microsoft's standard agreement, 1-year reserved discount available.
• AWS Nitro Enclaves, H100 (p5.48xlarge slice): ~$8.00–$10.00/hr attributable per H100, BAA via AWS, but Nitro enclave size limits make 70B-class models painful.
• VoltageGPU TDX, H100 80GB: $6.95/hr on demand (Confidential VM, October 2026), no BAA offered yet.
• VoltageGPU TDX, H200 141GB: $8.08/hr on demand (Confidential VM, October 2026), no BAA offered yet, fits a quantised 70B in a single GPU.

The premium hyperscalers charge is a procurement legacy, not a hardware cost. Live numbers for every confidential GPU we offer live on our live-prices page.

HIPAA vs HITRUST vs SOC 2, What Your Procurement Actually Wants

Healthcare procurement teams routinely ask for all three. They are not interchangeable:

• HIPAA is federal law. It is a floor, not a certification. There is no "HIPAA certificate". A vendor is HIPAA-aligned because the BAA + technical controls satisfy the rule.
• HITRUST CSF is a certifiable framework that maps HIPAA + ISO 27001 + NIST controls. Hospital systems often require it for vendors that touch PHI.
• SOC 2 Type II is an attestation about security/availability controls over a 6–12 month period. Useful for procurement, irrelevant for HIPAA on its own.

On VoltageGPU, no BAA is offered yet (planned after SOC 2 Type I; Type II follows after a 12-month observation window, see the Trust Center). The technical evidence available today is the TDX quote and the NVIDIA report you generate yourself.

A Practical Implementation Checklist

1. Sign a BAA with your GPU provider and any inference framework provider in the path. No BAA, no PHI, full stop.
2. Pin a TDX measurement for the exact image you want to run. Refuse to accept attestation quotes that do not match.
3. Disable logging of prompts and completions at the inference layer. Retain only non-PHI metadata for billing.
4. Run inference inside the TD: install your stack on the attested VM over SSH and keep weights and PHI inside it. If your policy requires a measurement of an image you built yourself, check that your provider can boot one (we cannot yet).
5. Document the data flow for your privacy officer: where PHI enters, which TDs touch it, where outputs go, how long anything is retained.
6. Run a tabletop incident response drill twice a year. The OCR notices.

When You Should Not Use Confidential GPUs for HIPAA

Three honest cases where the simpler option wins:

• You only handle de-identified data. If your pipeline does not touch PHI, HIPAA does not apply, rent a normal GPU and save the time.
• You need on-premise control for a different reason. Some research institutions have policies that forbid any cloud, regardless of TDX. Those policies are a procurement question, not a compliance one.
• You are using a cloud-hosted model with native BAA (Azure OpenAI, Bedrock with Claude on AWS) and the latency/cost works for your use case. That is a legitimate path for many SOAP-note workflows.

Getting Started in 2026

If you are a healthcare team putting an LLM near PHI for the first time, the path is:

1. Read our deep-dive on the BAA trap for the contractual story.
2. Read the attestation step-by-step to see what evidence you will keep on file.
3. Compare confidential GPU pricing on our live-prices page against your current quote.
4. Email contact@voltagegpu.com if a BAA is a hard requirement: we do not sign one today, and we will tell you when that changes.

HIPAA in 2026 is not a paperwork problem dressed up as a technology problem. It is a technology problem that hardware now helps solve.