Is Your Payment Processor HIPAA Compliant? What Telehealth Must Know

On this page 9 sections

1. What HIPAA Compliant Payment Processing Actually Means
2. The HIPAA Payment Processing Exemption Explained
3. When a Payment Processor Needs a Business Associate Agreement
4. How PHI Leaks Through Line Items, Metadata, and Receipts
5. Billing Descriptors That Protect Patient Privacy
6. Telehealth HIPAA Billing for Subscriptions and Recurring Payments
7. HIPAA vs. PCI DSS: Two Different Compliance Jobs
8. Questions to Ask Payment Vendors Before Signing
9. Next Steps for Telehealth Teams

Key takeaways

• HIPAA treats core payment activity differently from other uses of health information, but that does not make every payment service PHI-safe.
• A processor or gateway may need a business associate agreement once it stores or handles health information beyond what a payment requires.
• Many telehealth privacy leaks come from your own setup: line items, gateway notes, receipts, descriptors and dispute evidence.
• HIPAA and PCI DSS protect different data, and meeting one does not satisfy the other.

"Is your payment processor HIPAA compliant?" is one of the first questions telehealth founders ask, and one of the most misunderstood. Whether you have HIPAA compliant payment processing depends less on which processor you pick and more on what data you send it. This guide covers four things:

• How HIPAA's payment processing exemption fits into your setup
• When a processor or gateway needs a business associate agreement (BAA)
• Where telehealth companies accidentally leak protected health information (PHI) through line items, descriptors, receipts and dispute evidence
• What to ask vendors before you sign

This article is general information, not legal advice. Whether HIPAA applies to you, and which vendors need a BAA, depends on your business model. Confirm your obligations with a qualified healthcare attorney or privacy professional.

What HIPAA Compliant Payment Processing Actually Means

HIPAA has no certification for payment processors. A vendor that calls itself "HIPAA compliant" usually means one of two things:

• It believes its core payment activity falls outside the business associate rules.
• It will sign a BAA for certain services.

Those are very different claims.

Start with your own status. HIPAA applies to covered entities, which include certain health care providers, and to their business associates. Some cash-pay telehealth models may fall outside HIPAA entirely. Many do not, especially those that bill insurance or partner with covered providers or pharmacies. Even when HIPAA does not apply, state privacy laws and federal consumer protection rules can. Have counsel determine your status before you design your payment flow.

The HIPAA Payment Processing Exemption Explained

HIPAA treats core payment activity differently from other handling of health information. You will often see this described as the HIPAA payment processing exemption.

What it does not do is make your entire payment stack HIPAA-free. Do not assume it extends to:

• Extra health information you choose to push through payment systems
• Added services such as billing, data storage, analytics or CRM syncing
• Payment features built into platforms that also handle clinical records

If your checkout sends a diagnosis, medication name or consult notes to a vendor, you have created a privacy question that a payment exemption may not answer. The precise scope is a legal matter, so have counsel review it against your actual data flows.

Practical rule: Design your payment flow so the processor receives only what a payment needs. That usually means the amount, card data, billing details and a non-descriptive order or patient reference.

When a Payment Processor Needs a Business Associate Agreement

A payment processor business associate agreement becomes a real question when the vendor does more than move money. Common triggers include:

• Billing services. The vendor manages patient invoices, statements or collections that include treatment details.
• Storage of health data. You use gateway customer profiles, invoice descriptions or custom fields to store information about the patient's care.
• Integrated platforms. A payment feature sits inside a practice management system, EHR or patient portal that handles PHI.
• Analytics and CRM syncing. Payment webhooks feed a CRM or marketing tool along with intake answers or prescription data.

Make this decision vendor by vendor and service by service. A company may decline a BAA for card processing but offer one for a separate billing or records product. The reverse is also possible.

Is Stripe HIPAA Compliant? Ask a Better Question

Searches like "is Stripe HIPAA compliant" are common, and people ask the same question about every processor and gateway. We do not describe any vendor's current BAA policy here. Policies change, so check each provider's own documentation and terms.

These questions are more useful:

1. What data will my integration send to this vendor?
2. Does that data go beyond what payment processing requires?
3. If it does, will the vendor sign a BAA for that specific service, or can I remove the data instead?

Often the cleanest answer is to keep PHI out of the payment system entirely.

How PHI Leaks Through Line Items, Metadata, and Receipts

Many telehealth payment privacy problems are self-inflicted. They tend to come from default settings and well-meaning teams rather than from the processor itself.

Line Items and Product Names

Online pharmacies and prescription programs often sync their product catalog straight into checkout. The result is a card transaction with a line item that names a specific medication, dosage or condition.

Some payment setups can also pass item-level detail along with the transaction, so that detail may travel further than you expect. Use generic SKU names in the payment layer, such as "Monthly program" or "Consultation." Keep clinical names in your pharmacy or EHR system.

Gateway Metadata and Custom Fields

Gateways typically offer description fields, order notes and custom metadata. Support and operations staff tend to fill them with whatever helps them find a record, sometimes including notes like "follow-up for [condition]." Two fixes help:

• Adopt a written policy that payment fields hold only internal IDs.
• Audit existing customer profiles and remove any health details.

Receipts, Emails, and Text Messages

Automated receipts are a frequent source of leaks. Watch for:

• Email subject lines that name the treatment
• SMS payment confirmations that land on a shared phone or show on a lock screen
• Receipt templates that copy the full line item description
• Refill or renewal reminders sent from payment tools rather than your patient communication system

Chargeback Evidence

When a patient disputes a charge, it is tempting to send everything: intake forms, visit notes and prescription records. Dispute evidence goes to your processor and the card issuer.

Send only what you need to prove the patient authorized and received the service. Examples include:

• Timestamps
• Login or IP records
• Signed consent to the charges and refund policy
• Proof of delivery

Ask counsel where to draw the line on clinical documentation.

Billing Descriptors That Protect Patient Privacy

The billing descriptor is the name a patient sees on a card statement. That statement may be seen by a spouse, a parent or an employer's expense system. A descriptor that names a condition or medication discloses health information to anyone who reads it.

Card networks and processors generally expect descriptors to identify your business accurately, and customers who don't recognize a charge tend to dispute it. Confirm the specific requirements with your processor. Aim for a descriptor that is neutral but truthful. It should never disguise who you are.

Illustrative examples:

Your descriptor should match your registered business name or DBA, and your website and underwriting file should be consistent with it. Descriptors have a limited character count, so confirm the format with your processor before launch.

Telehealth HIPAA Billing for Subscriptions and Recurring Payments

Many telehealth companies run memberships, refill programs or monthly care plans. Recurring billing multiplies every leak above, because one bad template repeats the same disclosure every month. For telehealth HIPAA billing on a recurring model:

• Give plans generic names in the billing system, such as "Care membership – monthly."
• Send renewal notices through your patient communication platform, provided it is covered by the appropriate agreements.
• Use tokenized card-on-file storage so card data stays with the gateway.
• Keep failed-payment retries and card updates in the payment system without clinical context.

Recurring telehealth also carries card network and state rules that have nothing to do with HIPAA. Our guide to automatic renewal laws by state covers consent and cancellation requirements. Our overview of the card account updater for subscription billing explains how to reduce involuntary churn when cards expire.

HIPAA vs. PCI DSS: Two Different Compliance Jobs

Telehealth teams sometimes assume a PCI-validated gateway covers HIPAA, or that a BAA covers card security. Neither is true.

The two overlap in one useful way: both reward data minimization. Hosted checkout fields keep card numbers out of your systems, which reduces your PCI scope. Generic line items and clean metadata keep PHI out of payment systems, which reduces your HIPAA exposure.

Fraud tools matter too. 3-D Secure authentication for card-not-present payments can help verify the cardholder at online checkout, which matters in an industry with frequent disputes.

Questions to Ask Payment Vendors Before Signing

Use this checklist with any processor, gateway or billing platform, including MannyPay:

1. What data fields does your integration require, and which are optional?
2. Can I turn off item-level detail and product names on transactions and receipts?
3. Where are customer profiles, notes and metadata stored, and who can access them?
4. Will you sign a BAA, and for which specific services?
5. Do you offer hosted payment fields or tokenization to limit card data in my systems?
6. Can I customize or disable automated receipts and notifications?
7. How do you handle dispute evidence, and can I limit what I upload?
8. Which descriptor formats are allowed, and can I include a support phone number or URL?
9. Do you underwrite telehealth and online pharmacy merchants, and what documentation do you require?

The last question matters as much as privacy. Telehealth is often treated as high risk because of prescribing models, recurring billing and dispute exposure. Our guide to telehealth merchant accounts and getting approved walks through underwriting. If you prescribe or compound weight-loss medications, read why processors drop compounded GLP-1 clinics before you apply.

Next Steps for Telehealth Teams

Start with an internal audit:

• Run a test purchase and review everything it produces: the statement descriptor, the receipt email, the SMS, the gateway record and any CRM entry.
• Remove clinical details from anything that does not need them.
• Have counsel confirm your HIPAA status and which vendors need a BAA.

MannyPay works with telehealth and online pharmacy businesses through high-risk merchant accounts and online payment gateways, including Authorize.net and NMI. Bring the questions above to that conversation. To review your setup, request a free quote from MannyPay, and a specialist will respond within one business day.

ME

About the author

MannyPay Editorial Team

Beyond the Swipe's editorial desk researches the publication's guides and news and cites its sources in every article. Articles reviewed by a named MannyPay editor carry that editor's byline.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.