What a hospital website needs from hosting
A hospital site needs 99.9% uptime, HTTPS everywhere, automated backups you can restore, and a form that collects the minimum. Patient records belong in the hospital system, not the website. WebJi hosts the site and claims no HIPAA certification or DPDP audit.
The public site has one job: help a patient or attendant find the right department, doctor and phone number. Everything else — records, reports, billing — belongs in the hospital management system, which is a different application on different infrastructure.
The public site and the patient record system are separate
The website publishes departments, doctors, timings, insurance empanelment and contact details. The hospital management system holds records. Putting both on one shared hosting account puts clinical data on the same server as the marketing site.
That is the single most useful design decision on this page. If a portal needs to show a report, the portal queries the hospital system through an API. The web host never becomes the record store.
What DPDP Act 2023 asks of the hospital
The Digital Personal Data Protection Act 2023 makes the hospital a data fiduciary. It must give a notice, take consent for a stated purpose, collect only what that purpose needs, secure the data, and report a breach to the Data Protection Board and the affected people.
Those duties stay with the hospital. A host can provide Indian servers, access control, encrypted transport and backups, and can answer questions about them in writing. A host cannot give consent on the hospital's behalf, and a hosting invoice is not a compliance certificate.
Uptime and emergency information
Aim for 99.9%, which allows about 43 minutes of downtime a month. That is a target, not a promise that clinical services stay available.
Keep emergency numbers, the address and visiting hours as static text in the page template. If a plugin or database fails, the phone number still renders, which is the part a patient needs at 2 a.m.
Appointment forms and the minimum-data rule
Ask for a name, a phone number, a preferred department and a time window. That is enough for staff to call back and book.
- No diagnosis, symptoms or test results in a web form.
- No Aadhaar, PAN or insurance numbers in a web form.
- Send the form to a mailbox the hospital controls, not to a personal Gmail address.
- Say in one line what the data is used for and who can see it.
A form that collects less is easier to secure and easier to defend if a patient asks what was stored.
Security controls that matter here
Five controls cover most of the risk, and all five are checkable before you sign.
- TLS on every page, with an automatic renewal and no mixed-content warnings.
- A web application firewall in front of the CMS, so known plugin exploits are blocked before they reach PHP.
- Daily backups stored off the account, with one restore actually tested.
- Timely updates for the CMS, theme and plugins, and removal of anything unused.
- Two-factor login for every administrator, and no shared admin password.
Where the data sits: Indian servers
Keeping the website and any form data on Indian servers simplifies DPDP handling and keeps latency low for patients across India. Ask for the data-centre country in writing, not a marketing phrase like "India-ready".
If the hospital also uses an overseas booking service, that service is another data processor and needs its own mention in the privacy notice.
Shared, VPS or dedicated for a hospital site
A brochure site with an appointment form fits shared hosting. A portal with logins, an HIS integration or a large media library needs a VPS with dedicated resources, because a shared account caps concurrent PHP processes.
| Site type | What fits | Why |
|---|---|---|
| Brochure, departments, contact form | Shared hosting | Low traffic, no logins, static pages |
| Blog plus appointment form | Shared hosting | Same profile with a CMS |
| Patient portal with logins | VPS | Isolated resources and access control |
| HIS or teleconsult integration | VPS or dedicated | API load and a security boundary |
Where WebJi fits
WebJi hosts hospital and clinic sites on Indian servers. L-Basic is ₹300 a month and L-Unlimited is ₹400, before 18% GST, both with cPanel, automatic SSL and daily backups. A portal or HIS integration is a VPS, quoted by email before payment.
We are the host, not the compliance auditor. We do not claim HIPAA certification, we do not sign a business associate agreement, and we do not audit a hospital against DPDP. What we can do is state where the data sits, who can access the account and how a restore works. The DPDP compliance page covers the paperwork, website security services covers cleanup and hardening, and VPS hosting covers the portal case.
Support is by email at support@webji.services, 24/7 in Hindi and English, with an average first reply under 60 minutes. The office phone is not a support line.
Frequently Asked Questions
Which hosting is best for hospital websites in India?
Shared Linux hosting with cPanel, HTTPS, daily backups and Indian servers covers a hospital brochure site and an appointment form. A portal with patient logins or a hospital management system integration needs a VPS, which is quoted by email.
What are the hosting requirements for a hospital website?
HTTPS on every page, a 99.9% uptime target, restorable daily backups, a patched CMS, a web application firewall and an appointment form that collects only what the staff needs to call the patient back.
Is patient data storage regulated in India?
Yes. The Digital Personal Data Protection Act 2023 makes the hospital a data fiduciary, with duties on notice, consent, purpose limitation, security and breach reporting. The host supports those duties but the hospital remains responsible.
Can hospital websites take online appointments?
Yes. A form that collects a name, phone number, preferred department and time window is enough. Do not ask for diagnosis, test results or identity numbers in a web form; collect those in person or in the hospital system.
What uptime do hospital websites need?
Aim for 99.9%, which allows about 43 minutes of downtime a month. Keep emergency numbers and visiting hours as static text so they survive a plugin or database failure.
Does WebJi provide HIPAA-compliant hosting?
No. HIPAA is United States law and WebJi does not claim HIPAA certification or sign a business associate agreement. For Indian patients the DPDP Act applies, and WebJi is the host, not the hospital compliance auditor.