HIPAA Compliant Payment Processing: What Is Exempt and What Is Not
HIPAA exempts the card transaction and still governs what travels around it. A field-by-field map for a telehealth checkout, with the questions to put to any processor.
- By the OpenGate underwriting desk
- Updated
- 12 min read
HIPAA compliant payment processing means taking a patient’s payment without disclosing more health information than the payment needs. Section 1179 of HIPAA puts a financial institution’s payment activities, such as authorizing, clearing and settling a card payment for health care, outside the HIPAA rules, and HHS says no business associate agreement is required for them. The exemption stops at funds processing. The exposure sits around the transaction, in descriptors, invoices, order fields and receipts. This article maps both sides for a telehealth checkout.
In this guide
What HIPAA exempts: the payment transaction itself
HIPAA does not apply to a financial institution, or to a company acting for one, to the extent that it authorizes, processes, clears, settles, bills, transfers, reconciles or collects a payment for health care. That is section 1179 of the statute (42 U.S.C. 1320d-8), and it covers payments made by credit, debit or other payment card, by check or by electronic funds transfer. The same section covers what follows a payment: customer disputes and inquiries, audits and responses to subpoenas.
HHS applies the section in its guidance on business associates, last reviewed in July 2026. A business associate agreement is not required when a financial institution processes consumer-conducted transactions by debit, credit or other payment card, clears checks or processes electronic funds transfers. The reasoning HHS gives is that the institution is providing its normal financial services to its customers and is not performing a function on behalf of the provider. The 2013 Omnibus Rule says the same: the HIPAA Rules, business associate provisions included, do not apply to banking and financial institutions for the payment processing activities listed in section 1179.
For a telehealth merchant, the consequence is direct: the card payment itself does not call for a business associate agreement with the bank that processes it. Whether another payment company in the chain, a gateway for instance, counts as acting for a financial institution in your setup is a question for your counsel. The exemption also leaves your own duties as a provider where they were: what you disclose along with a payment is still governed by the Privacy Rule.
Where the exemption stops and a processor becomes a business associate
The exemption covers moving funds and stops where a payment company starts doing your administrative work. HHS has said so twice. In the preamble to the Privacy Rule it stated that financial institutions are business associates when they receive protected health information for activities other than funds processing, and gave back-office billing and accounts receivable as the example. In 2013 it repeated that a bank may be a business associate when it performs functions above and beyond payment processing for a provider.
| Activity | Inside the payment exemption? | What it means for you |
|---|---|---|
| Authorizing, clearing and settling a card payment | Yes, when a financial institution or a company acting for one does it | HHS requires no business associate agreement for this activity |
| Handling a chargeback or a cardholder inquiry on that payment | Yes, section 1179 lists customer disputes | Send only what the dispute needs |
| Preparing itemized patient statements or running your back-office billing | No, HHS names this as business associate work | An agreement is required when patient information is involved |
| Managing accounts receivable or collections for you | No | The same |
| Storing visit notes, intake answers or prescriptions in a payment tool | No | Keep them out, or use a vendor that signs an agreement |
HHS defines a business associate by function: a company that creates, receives, maintains or transmits protected health information on your behalf. A product name does not change the answer. One company can be exempt for its card processing and a business associate for its invoicing module.
What HIPAA compliant payment processing keeps out of payment fields
Only what the payment needs should travel with it. HIPAA’s minimum necessary standard applies to disclosures for payment, and HHS described what that means for a payment transaction when it wrote the Privacy Rule. In the preamble to the final rule it said the information generally needed is the individual’s name and address, the name and address of the payor or provider, the amount of the charge, the date of service, the expiration date of the payment mechanism, the signature and the relevant identification and account numbers. It agreed with commenters that sending diagnostic and specific treatment information to financial institutions may be inconsistent with the minimum necessary requirement.
HHS also conceded something merchants should hear: even that minimal information can reveal a condition, since a payment to a provider shows that care was given. A telehealth brand built around one condition makes this sharper. If the business name is the treatment, the statement line is a disclosure.
Health details leak into a payment flow in six places. The table shows what goes wrong in each and what to send instead.
| Where | What goes wrong | What to send |
|---|---|---|
| Billing descriptor | A drug, condition or program name on the bank statement | A neutral legal or brand name the patient saw at checkout |
| Line items and plan names | The medication and dose used as the product name | An internal plan or order code |
| Order description, metadata, custom fields | Intake answers, diagnosis codes or prescriber notes copied from the clinical system | An order ID that only your system can resolve |
| Invoices and payment links | A memo naming the treatment | Amount, date and reference |
| Receipts by email or text | The treatment spelled out in a message that sits on a lock screen | The same neutral wording as the descriptor |
| Dispute evidence | Chart notes or lab results attached to a representment | Proof of purchase, consent, delivery and contact history |
Phone payments carry the same risk. Staff who key a card into a virtual terminal tend to type what they hear into the notes field, so give them a script for that field.
A worked example
Take an illustrative weight loss program billing a second month of medication. The names are invented.
- The leaking version sends the descriptor EXAMPLE SEMAGLUTIDE RX, a line item reading compounded semaglutide refill, month 2, and a metadata field holding the patient’s starting weight.
- The clean version sends the descriptor EXAMPLE HEALTH GROUP, a line item reading plan M2, and the reference order 48213.
Both versions carry the same card data and settle the same amount. The second keeps the diagnosis inside the clinical system, where your HIPAA safeguards already apply, and it gives a bank employee, a household member reading a statement or a breached log nothing to learn.
Is Stripe HIPAA compliant, and does the label mean anything?
No processor is HIPAA compliant in the way a system is PCI validated, because HIPAA has no official certification. HHS says it does not endorse or recognize private certifications of Security Rule compliance. What a vendor can do is sign a business associate agreement for the services that need one and build those services to the Security Rule. What Stripe, Square and PayPal each publish is compared side by side in Is Stripe HIPAA compliant?
On Stripe specifically, we report what its own agreement says and nothing beyond it. The Stripe Services Agreement, last modified on September 28, 2026, mentions protected health information in one clause. A user must not provide it to Stripe as part of third-party data, meaning data from the user’s other service providers that Stripe is given access to, and the user is liable for any such disclosure. The text we read does not use the word HIPAA. Whether Stripe signs a business associate agreement for a given product is for Stripe to answer, so ask in writing if your integration needs more than card processing.
Shopify’s Acceptable Use Policy speaks from the platform side. As of October 2026 it names uploading protected health information subject to HIPAA as an activity the platform does not support.
A second issue stops prescribing platforms before HIPAA does. Stripe and PayPal both make telemedicine and prescription products subject to their approval, and a processor’s position on health data is irrelevant if its acceptable use policy excludes your model. How that review works for each telehealth model is in the telemedicine payment processing guide.
PCI DSS and HIPAA cover different data
PCI DSS protects cardholder data and HIPAA protects health information, and passing one says nothing about the other. PCI DSS, the card industry’s security standard, governs the card number, the expiration date and the systems that touch them. A gateway that tokenizes cards and runs on PCI DSS Level 1 infrastructure has addressed the card side.
That is the scope OpenGate publishes. Our capabilities page lists PCI DSS Level 1 infrastructure, tokenization, a hosted checkout and pay-by-link. It lists no HIPAA attestation, and we do not describe the gateway as a HIPAA service. Treat it, and any gateway that says the same, as a payment-only system: card data goes in, clinical data stays in your own platform. If your workflow needs a payment vendor to hold patient information, raise it before you integrate, because the honest answer may be that the workflow has to change. How payment links behave on a high-risk account is covered in pay by link for high-risk merchants.
Are you a covered entity at all?
Some telehealth companies are outside HIPAA, which changes the rules that apply and leaves the duty of care in place. HHS treats a health care provider as a covered entity only if it transmits information electronically in connection with a standard transaction, the insurance claim being the usual one. A cash-pay program that never bills a health plan may therefore fall outside HIPAA and under the Federal Trade Commission and state privacy laws instead. Have counsel decide which regime applies. The field map above is worth following in either case, and acquirers will ask to see your privacy notice whatever the answer.
Questions to ask any processor before you sign
Ask what the processor does with data beyond the card, and ask in writing. Eight questions separate a payment-only relationship from one that needs an agreement.
- Which of your services go beyond authorizing, clearing and settling payments?
- For those services, do you sign a business associate agreement? If you do not, which features must we keep patient information out of?
- What do you store from description, metadata and custom fields, for how long, and who can read it?
- What will the billing descriptor show, and can we set it per product line?
- What appears on your receipts, hosted pages and payment links by default?
- In a dispute, what do you forward to the card issuer, and can we review it first?
- Which subprocessors receive transaction data?
- Do you accept prescribing telehealth at all, and do you expect a certification such as LegitScript?
The last question saves the most time. A processor that excludes your model makes the first seven moot. The certification itself is covered in the LegitScript certification guide.
What to prepare before you apply
Prepare a one-page data map before you send a merchant file: every field your checkout, your invoices and your virtual terminal pass to the payment system, with an example value for each. Add the descriptor you propose, screenshots of the checkout and of a receipt, your privacy notice, and the usual documents for a telehealth merchant account: licenses, the prescribing flow, processing history and corporate records.
An underwriter who can see that nothing clinical reaches the payment fields has one less question to ask, and disputes are easier to defend with evidence that was clean from the start. The dispute side is covered in the chargeback ratio guide.
Then send the data map with your telehealth application. An underwriter goes through it with the rest of the file and answers within 1 business day: a written offer, the items still missing, or a refusal that says why. The review is free. Nothing in this article is legal advice. Have counsel confirm your HIPAA status and your obligations before you rely on any of it.