HIPAA Compliant Payment Processing Guide & Best Practices

A doctor treating a patient who is paying for his treatment via HIPAA-compliant payment processing.

Healthcare practices often prioritize securing patient records and communications, but may underestimate the need for HIPAA compliance in their payment platforms. While payment processing is exempt from HIPAA, many payment providers offer secondary services to merchants, making them a potential source of HIPAA compliance risk if not properly managed. This guide explores HIPAA-compliant payment processing, the most suitable payment methods for healthcare practices, and other related topics.

Key Takeaways

Although payment processing is exempt from HIPAA, payment providers offering additional services can still pose compliance risks if not carefully managed.
Since many financial institutions and payment processors are exempt from HIPAA, healthcare providers can generally accept credit card payments without additional compliance concerns.
Healthcare organizations that accept credit card payments must comply with both PCI DSS to protect payment data and HIPAA to safeguard patient information.
Some widely-used payment apps are not HIPAA compliant.

What Is HIPAA Compliance?

The Healthcare Insurance and Portability and Accountability Act (HIPAA) was passed by Congress passed in 1996.^[1]104th Congress (1995-1996). “H.R.3103 – Health Insurance Portability and Accountability Act of 1996.” Accessed November 10, 2025. The act provided regulations for a range of healthcare and health insurance-related activities. It’s most notable for its stringent privacy regulations, which outline the protection and disclosure of patient data. Namely, it prevents healthcare providers from disclosing a patient’s healthcare information to third parties without their permission.

This creates significant compliance requirements for healthcare organizations and any of their “business associates,” such as accountants and software providers. Business associates of healthcare providers exposed to protected health information (PHI) must sign business associate agreements (BAA), which outline their responsibilities to adhere to HIPAA privacy regulations.^[2] U.S. Department of Health and Human Services. “Business Associates.” Accessed November 10, 2025.

While HIPAA compliance helps healthcare organizations protect their patients, the increasing frequency of cyberattacks means that healthcare records remain vulnerable to breaches. In 2023, the Department of Health and Human Services’ (HHS) Office for Civil Rights (OCR) received reports of 725 data breaches, which contained a total of more than 133 million exposed records.^[3]The HIPAA Journal. “Healthcare Data Breach Statistics” Accessed November 10, 2025.

How Is HIPAA Connected to Credit Card Processing?

Accepting credit card payments from patients and clients is a fundamental aspect of managing a healthcare practice. So, what happens when a healthcare provider uses a third-party payment processor? Does HIPAA come into play?

A doctor in scrubs holding a clipboard in front of a checklist for HIPAA-compliant payment processing requirements

Fortunately, in most cases, this isn’t a concern. Financial institutions and payment processors are typically exempt from HIPAA’s Administrative Simplification Regulations, resulting in simpler compliance.

However, if a payment processor uses an intermediary, such as a third-party security tool, this may negate the payment processor’s exemption from HIPAA regulations. Likewise, if a payment processor provides additional services to a healthcare practice, such as billing, invoicing, or practice management tools, it may need to comply with HIPAA regulations.

As payment processors continue to evolve their services and add ancillary features to their payment products, healthcare practices need to ensure they don’t receive non-HIPAA-compliant services by mistake.

HIPAA Compliant Payment Methods

Not all payment providers or apps are HIPAA-compliant, but healthcare providers still have several secure options to choose from. Let’s explore HIPAA-compliant payment methods below:

SimplePractice

SimplePractice is a healthcare-specific payment platform that offers fully HIPAA-compliant payment tools and services. For healthcare organizations seeking an all-in-one payment and practice management platform, SimplePractice provides a range of benefits. Notable features include scheduling, billing, insurance claim tools, and documentation. Additionally, SimplePractice offers a range of specialty-specific tools for healthcare providers, including those designed for counselors, social workers, chiropractors, and other professionals.

Ivy Pay

Ivy Pay is a therapist-specific platform designed to simplify the process of accepting client payments. The platform stores your client’s credit card details, allowing you to automate the payment process after each session. It can also generate superbills to make it easier for clients to submit claims for services if your practice is outside their insurance network. However, while Ivy Pay is convenient, it has limited features. It won’t be sufficient if you’re looking for an all-in-one payment and practice management tool.

Square

As with all payment processors, Square’s payment processing services aren’t subject to HIPAA requirements. However, Square also provides business associate agreements (BAAs) to healthcare providers for some of its secondary services. Square provides a draft BAA with its terms on its website. It’s your responsibility to review the draft before engaging in any actions subject to HIPAA compliance.^[4]Square. “HIPAA Business Associate Agreement“. Accessed November 10, 2025.

Square doesn’t offer extensive support regarding the HIPAA compliance of its secondary services. It may be worthwhile to seek advice from a compliance expert if you choose to use Square for any services aside from credit card processing.

HIPAA-Compliant Merchant Account Providers

Suppose you want more control over your payment ecosystem. In that case, a dedicated merchant account is a great option. A merchant account provides healthcare practices with a merchant ID (MID), reducing the chances of account freezes or closures. Additionally, many merchant account providers offer advanced payment features, including subscription payments, payment links, and enhanced reporting.

Another advantage of partnering with a merchant account provider is access to more competitive pricing models. Popular payment providers, such as Square and Ivy Pay, typically offer flat-rate pricing. While flat-rate pricing simplifies fee structures, it can include hidden markups. In contrast, merchant account providers commonly use tiered or interchange plus pricing, offering greater transparency and more cost-effective processing fees.

ACH Transfers

Credit card processing isn’t the only payment type exempt from HIPAA. Electronic funds transfers (EFTs) are also exempt from HIPAA compliance. In fact, there is a specific type of ACH transfer designated for medical payments. The National Automated Clearing House Association (NACHA) offers a healthcare EFT that complies with HIPAA requirements.^[5]NACHA. “Healthcare EFT.” Accessed November 10, 2025.

ACH transfers are often more cost-effective than credit card transactions and other digital payment methods, making them a viable option for healthcare providers. If your merchant account provider supports ACH payments, you can streamline payment processing by securely accepting direct bank transfers from patients or insurers, reducing transaction fees and improving cash flow efficiency.

Cash

Lastly, you can accept cash and remain HIPAA compliant. The benefit of cash is that it eliminates the need for a third-party payment partner, thereby reducing exposure to data breaches. However, even if a patient pays in cash, your practice must still follow HIPAA rules for recording transactions and securely storing patient data.

Understanding HIPAA Compliant Credit Card Processing Exemption

The primary takeaway for medical providers is that credit card processing is not subject to HIPAA rules. HIPAA compliance is not a concern if your payment provider focuses solely on processing payments and handling transactions internally. However, if the provider involves intermediaries or offers additional services, such as invoicing or business management tools, it may not meet HIPAA standards.

a medical patient with their casted arm in a sling and their head wrapped in bandages holding a medical bill that they'll pay with a HIPAA-compliant payment

Payment Card Industry Data Security Standard (PCI DSS) is a security standard designed to protect customers and businesses from payment-related fraud and data breaches. Major card brands, including Visa, Mastercard, and American Express, helped establish these standards to address security issues in the payment ecosystem. PCI DSS compliance is a mandatory requirement for any merchant accepting credit card payments in the United States, regardless of whether they operate in the healthcare industry.

On the other hand, HIPAA compliance only applies to healthcare providers and companies handling PHI on their behalf. Therefore, healthcare practices accepting credit card payments must adhere to both PCI and HIPAA compliance requirements.

When Does Your Practice Need a Business Associate Agreement?

Whenever your healthcare organization partners with a third party that gains access to patient data, they must sign a business associate agreement (BAA) guaranteeing HIPAA compliance. A BAA is necessary if you’re using secondary services from the payment provider, such as practice management tools or invoicing solutions. If you’re concerned about BAAs and how they may impact your business, speak with a compliance consultant to ensure your healthcare practice is on the right side of regulation.

Are Payment Apps HIPAA Compliant?

Let’s take a look at some of the leading payment apps and whether they meet HIPAA requirements:

Venmo

Venmo is primarily considered a payment platform, although it also functions as a social networking platform. As such, it is not HIPAA compliant. Due to the potential privacy issues posed by a payment provider serving as a social network, it is ultimately not a suitable option for healthcare providers.

Zelle

Unlike Venmo, Zelle does not include any social networking components. As payment providers are exempt from HIPAA compliance, Zelle may be a suitable option for payment providers. However, many payment apps, including Zelle, operate according to different rules than many traditional payment processors.

PayPal

If your practice uses PayPal solely for processing payments, it does not violate HIPAA compliance. However, because PayPal also provides services such as invoicing and peer-to-peer transfers, we recommend consulting a compliance advisor before using the platform.

Cash App

Like Zelle, Cash App lacks the same social media features as Venmo, making it a suitable option for medical payment processing in particular. However, it’s worth consulting with a compliance advisor before using this platform to accept payments.

How to Accept HIPAA-Compliant Payments

How can you make sure your practice’s payments are HIPAA-compliant? Follow these steps:

Choose a HIPAA-Compliant Payment Processor

While most payment processors are HIPAA compliant, it’s always worth double-checking. If a payment provider uses outside intermediaries, they may be violating HIPAA compliance requirements. Ask your payment processor about their HIPAA compliance before entering into a merchant agreement.

Assess Secondary Services, Add-Ons, and Integrations

Even if your payment provider’s payment processing services are HIPAA compliant, its secondary services, add-ons, and integrations may not be.

Stay Educated

As healthcare technology evolves, staying informed about changes in HIPAA compliance approaches is essential. Stay up-to-date and ensure that all staff members maintain HIPAA-compliant payment processing procedures.

Best Practices for Maintaining HIPAA Compliance

Medical records are ten to forty times more valuable than credit card numbers on the black market.^[6]CyberPolicy. “Why Medical Records are 10 times More Valuable Than Credit Card Info“. Accessed November 10, 2025. Maintaining HIPAA compliance across an entire practice is essential for healthcare organizations to avoid financial or criminal repercussions. Below are some best practices for maintaining HIPAA compliance for you to follow:

Do…

Obtain a business associate agreement (BAA) if you’re receiving any secondary services from your payment processor.
Ensure all staff members have up-to-date knowledge of their responsibilities.
Confirm whether your payment processor is HIPAA compliant, as there’s a chance they may use intermediaries in the payment process.
Work with payment providers that also provide PCI DSS compliance.

Don’t…

Include any personal, private, or otherwise delicate information on payment descriptions when processing credit card payments.
Use payment apps that incorporate social media elements, which may expose patient information. Venmo is one example of such a platform.

Want to know more about HIPAA-compliant healthcare payment processing? Reach out to talk to an account manager with industry-specific experience.

HIPAA-Compliant Payment Processing FAQs

Is Stripe HIPAA compliant?

Stripe is HIPAA compliant if you use it exclusively to process credit card transactions. Credit card processors are excluded from HIPAA regulation. However, Stripe’s other services, such as invoicing or business management tools, may not be HIPAA compliant. If you need practice management tools in addition to payment processing, it’s best to seek another payment provider.

Do payment processors need to be HIPAA compliant?

Payment processors are not subject to HIPAA compliance if they are only providing payment processing services. However, if they provide secondary services or utilize third-party intermediaries, they may find themselves in violation of HIPAA. For example, if a payment provider also offers invoicing or other business management tools, it must be HIPAA compliant to service healthcare providers.

Are ACH payments HIPAA compliant?

ACH payments are HIPAA compliant as long as they are “healthcare EFTs,” which are healthcare-specific funds transfers that utilize the ACH network. Nacha, the organization that manages the ACH network, is also responsible for overseeing Healthcare EFTs.