OpenMetal HIPAA Compliance for Healthcare

Q: Is OpenMetal HIPAA compliant for healthcare workloads?

OpenMetal is HIPAA compliant at the organizational level. For workloads involving protected health information, OpenMetal may be able to sign a Business Associate Agreement (BAA) with covered entities; BAA availability is confirmed with the OpenMetal sales team.

Explore data center locations

OpenMetal maintains HIPAA compliance at the organizational level. The platform, operational processes, and support workflows are designed to meet HIPAA requirements for handling protected health information (PHI). Covered entities that need a BAA arrange one with the OpenMetal sales team.

Servers deployed in Ashburn, Virginia are hosted in a facility (NTT DATA VA1) that holds its own HIPAA attestation, along with SOC 1/2 Type II, ISO 27001, and PCI DSS. These facility-level certifications are held by the data center operator, not by OpenMetal. The Los Angeles, Amsterdam, and Singapore facilities hold SOC, ISO, and PCI certifications but do not carry facility-level HIPAA; at those locations HIPAA coverage is OpenMetal’s organizational-level compliance.

All OpenMetal bare metal servers and Hosted Private Cloud clusters run on dedicated single-tenant hardware with no shared components, customer-specific VLANs, and full IPMI access. This physical isolation model provides a stronger compliance posture than shared-tenancy cloud environments where HIPAA eligibility varies by individual service.