Best HIPAA Compliant Payment Processing

Does a payment processor need to be HIPAA compliant?

Usually not — and that surprises most practice managers. HIPAA's statute (section 1179) carves out financial institutions when they authorize, process, clear, settle, bill, transfer, reconcile, or collect payments for health care, whether by card, check, or electronic funds transfer. HHS confirmed in the 2013 Omnibus Rule preamble that the business-associate provisions do not apply to banking and financial institutions for those payment activities. In other words: swiping a patient's card is treated like any other retail charge, not a PHI disclosure that needs a Business Associate Agreement.

The Privacy Rule reinforces this from the other side: 45 CFR §164.501 defines “payment” to include billing, claims management, and collection activities, so a practice may disclose the minimum necessary information to get paid without patient authorization. The exception is narrow, though. It protects the transaction, not everything you happen to send alongside it. Where your setup falls determines whether you need any of the platforms below to sign a BAA:

A practical test: could a stranger reading the processor's records learn anything about a patient's care beyond “they paid this clinic $180 on June 3”? If yes, you have left the exception. This matters most for self-pay workflows — the amounts on a good faith estimate or an Advance Beneficiary Notice are fine to charge, but the service descriptions on them do not belong in your processor's invoice fields.

Is Square HIPAA compliant?

Yes — with conditions, and the answer changed in 2026. For years the standard advice was that Square was fine for card-present payments under the payment exception but could not be trusted with anything touching PHI because it would not sign a BAA. That advice is now out of date: Square (Block, Inc.) publishes a HIPAA Business Associate Agreement, last updated March 16, 2026, incorporated into its service terms for healthcare sellers.

Practical read for a practice: Square is now a legitimate option even when appointment types and invoice descriptions carry PHI — provided you stay inside the HIPAA-enabled products and confirm the BAA applies to your account configuration before the first charge. Security-wise, Square tokenizes card data, encrypts in transit, and maintains PCI DSS certification. If you use Square Appointments as your scheduler, note that dedicated healthcare schedulers still handle intake and reminders better — see our HIPAA-compliant scheduling comparison.

Fees are Square's standard retail rates (as of Aug 2026): 2.6% + 15¢ in person, 2.9% + 30¢ online, and 3.3% + 30¢ for card-not-present invoice payments on the free plan. No monthly fee is required, which keeps it the cheapest entry point on this page.

Is Stripe HIPAA compliant?

No. Stripe does not sign Business Associate Agreements, and as of August 2026 its publicly documented position is unchanged: it does not consider itself a business associate under HIPAA. Unlike Square, there is no healthcare carve-out to opt into.

If you keep Stripe — common for practices whose website builder or membership platform is welded to it — enforce these rules on every field your integration can write:

Document this in your risk assessment as a deliberate control, the same way you would scope any vendor that touches your revenue cycle. If your invoices genuinely need clinical detail — itemized superbills, statement history, balances by visit — Stripe is the wrong tool; use a healthcare-native platform below that signs a BAA. Sending PHI to a vendor with no BAA is one of the most common HIPAA violations OCR sees.

Which payment platforms are worth comparing in 2026?

Two of these are general-purpose processors that healthcare borrowed (Square, Stripe); four are healthcare-native platforms built around the revenue cycle. The native platforms cost more but do the thing general processors cannot: touch PHI under a signed BAA and post payments back into your practice-management ledger.

How do the payment platforms compare side by side?

The BAA row is the one that decides whether a platform may see PHI at all. “Partial” there means a BAA exists but is scoped (Square: HIPAA-enabled products only) or is not stated publicly and must be confirmed in the contract (PayGround, Clearent).

Legend: ✓ = Yes · – = Partial / scoped / confirm in contract · ✗ = No. Verified Aug 2026 against vendor sites.

PCI DSS vs HIPAA: where do they overlap?

Every processor on this page is PCI DSS compliant — that is the floor for accepting cards at all. Vendors love to blur the two, but PCI compliance says nothing about HIPAA, and vice versa. The controls overlap; the obligations, regulators, and penalties do not.

The practical win: a PCI-scoped payment terminal on its own network segment, with tokenization so no card numbers touch your EHR, also shrinks your HIPAA attack surface. Fold both into one risk assessment rather than running two, and align your encryption standards to the stricter of the two (usually PCI).

What does HIPAA compliant payment processing cost?

Published rates as of August 2026. Healthcare-native platforms price on volume and card mix, so treat “custom quote” as a negotiation: a practice running $50k/month in cards should be quoting interchange-plus, not a flat rate.

Rates change; confirm on the vendor's pricing page before signing. Hardware, chargeback fees, and PCI non-compliance fees are extra on every platform.

Which payment processor should your practice choose?

Start from your billing workflow, not the processor's marketing. The right answer depends on whether payments need to land in a clinical ledger and how much PHI your invoices carry.

Whichever you choose, the processor is only one link in the revenue cycle. Verify coverage up front with an insurance verification form, and run the billing compliance checklist annually so the data feeding the terminal is clean before it ever reaches a card network. Text-to-pay features also pull you into SMS rules — see our HIPAA compliant texting comparison for the consent side.