Is WebFaction HIPAA compliant?

The laws involved have no one answer, but in general no hosting service can be for the stricter things because of the requirement of security,

Facility Access and Control. A covered entity must limit physical access to its facilities while ensuring that authorized access is allowed.21

Workstation and Device Security. A covered entity must implement policies and procedures to specify proper use of and access to workstations and electronic media.22 A covered entity also must have in place policies and procedures regarding the transfer, removal, disposal, and re-use of electronic media, to ensure appropriate protection of electronic protected health information (e-PHI).23

Not that our data-centers are not secured, the issue is it is not secured by your staff.

http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/index.html

However these more strict rules only apply if you are a certain entity.

In all reality you would have to look up all the technical details that your entity would have to adhere to and research each one. If you have any particular questions we would be happy to clarify here or in a support ticket.