No — and we would rather tell you that than sell you something on a premise that is not true.
The Security Rule requires technical measures to protect health information moving across a network. TLS, which every plan has, satisfies that. Encryption in transit is an addressable implementation specification, and the rule does not mention VPNs at all.
We do offer one, for a different and better reason: it lets you restrict the sensitive parts of your site — the admin login, the database, your staging environment — to devices you control, while your public site stays public. That is a genuinely good security decision on its own merits.
It is $79/month for up to ten users, plus setup. Worth having if several people log in to your admin; not something you need to buy to be compliant.
