This is a syndicated repost. The canonical version (with live pricing and updates) lives at voltagegpu.com/blog.
TL;DR
- Most "HIPAA GPU clouds" are paperwork tiers, not technology tiers. Same H100, plus a contract and a 2–4× markup.
- Intel TDX changes the math. PHI stays sealed in encrypted memory and VRAM; even the cloud operator cannot read it.
- Real 2026 pricing: confidential H100 around
$2.77/hr, confidential H200 around$3.60/hron VoltageGPU — vs roughly$11–$14/hron Azure NCv5 confidential VMs. - 5–7% TDX overhead on H100/H200 LLM inference. Clinically invisible.
What changed for HIPAA in 2026
The December 30, 2024 HHS NPRM tightened the Security Rule's technical safeguards language for the first time since 2003. Three changes matter for AI workloads:
- Encryption is no longer "addressable" — it is required. The old rule let covered entities document why encryption was infeasible. The new rule eliminates that exception for ePHI.
- "In use" is named explicitly. Previous text covered PHI at rest and in transit. The proposal extends to PHI being processed — which is exactly what happens during LLM inference.
- Auditable technical evidence is expected. The OCR has signaled it will ask for proof — attestation logs, access reviews, hardware measurements — not just policies.
A vendor that says "we are HIPAA compliant" without producing a TDX attestation, a key release log, or a measured boot trace is selling 2018-era compliance.
Why Intel TDX is the evidence the OCR wants
HIPAA does not require Intel TDX by name. But it asks for a control that satisfies 45 CFR § 164.312(a)(2)(iv) — encryption of ePHI — and the new "in use" language. Intel TDX is currently the cleanest implementation of that control for GPU workloads:
- Memory encryption. AES-XTS encrypts the Trust Domain's RAM with a key the cloud operator never holds.
- Protected PCIe. Host↔GPU traffic flows through an authenticated, encrypted channel.
- Remote attestation. Intel signs a quote that proves the exact firmware, kernel, and container image the TD booted.
For an audit, the artifact you hand the OCR is a signed TDX quote tied to a measurement you control — not a vendor letter.
Real 2026 pricing — same workload, three providers
| Provider | Hardware | Hourly (USD) | BAA |
|---|---|---|---|
| Azure NCv5 confidential VM | H100 80GB | $11.00–$14.00 | Microsoft standard |
| AWS Nitro Enclaves slice | H100 (from p5.48xlarge) | $8.00–$10.00 | AWS standard |
| VoltageGPU TDX | H100 80GB | $2.77 | Pro plan |
| VoltageGPU TDX | H200 141GB | $3.60 | Pro plan |
The market clearing price for confidential H100 in 2026 is closer to $2.77 than to $14. The premium hyperscalers charge is a procurement legacy, not a hardware cost.
Implementation checklist
- Sign the BAA before the technical work — it scopes everything.
- Pin the TDX measurement (kernel + initrd + container) and refuse to release keys to anything that does not match.
- Verify the attestation quote in your code, not in your vendor's UI.
- Log every model invocation with workload UID, attestation hash, timestamp, and minimal PHI references.
- Run quarterly key release reviews. The OCR loves seeing this.
When you should not use a confidential GPU cloud for HIPAA
- If your data set is small enough to live on a single workstation, do that.
- If you cannot afford to rotate keys at workload boundaries, you are not ready for confidential compute.
- If your privacy counsel hates "novel" controls and prefers the Azure default, fine — pay 4×.
Full article (with FAQ, HITRUST/SOC 2 comparison, and links to attestation walkthrough): voltagegpu.com/blog/hipaa-compliant-gpu-cloud-2026.
Disclaimer: this is engineering analysis, not legal advice.
