On this page
HIPAA compliant payment processing starts with an exemption: Section 1179 of HIPAA says the law's administrative simplification rules “shall not apply” to an entity that is “engaged in authorizing, processing, clearing, settling, billing, transferring, reconciling, or collecting payments, for a financial institution,” with respect to those activities, and that includes card payments for health care (Public Law 104-191). A billing or payment tool that does more than move money, such as invoicing or booking with visit details, can still need a business associate agreement (BAA), so check each vendor's own statement and keep diagnosis and treatment details out of payment descriptions. Curve Compliance, which signs a BAA on every plan, helps clinics count payments as ad conversions without a browser pixel on the checkout page.
Book a call. Is a payment the conversion your ads optimize for? Curve Compliance replaces the browser ad pixels on checkout and thank-you pages with one script, sends the conversion server-side with a neutral name and a fixed list of fields, and strips PHI before data reaches an ad platform. Curve's team does the setup, typically live in about a week. Book a call with Curve.
Does HIPAA apply to payment processing?
Two different jobs get called payment processing. The first is the card side: authorizing a charge, settling funds and moving money between banks. Section 1179 takes that work outside HIPAA's administrative simplification rules. The second is the practice's own billing: invoices, claims, payment plans and collections. HIPAA defines that as “payment,” which includes “Billing, claims management, collection activities” (45 CFR 164.501), and the practice stays a covered entity while it does it.
So the processor that runs the card is not your business associate for that charge, but a tool that handles billing for you with patient details can be. HIPAA's business associate definition covers anyone who handles PHI on a covered entity's behalf for activities “including claims processing or administration,” and names “billing, benefit management, practice management” among them (45 CFR 160.103). See what a business associate is and HIPAA TPO.
The Section 1179 exemption
Section 1179 was added to the Social Security Act by HIPAA in 1996 and is codified at 42 U.S.C. 1320d-8. It lists the activities it covers, starting with “The use or disclosure of information by the entity for authorizing, processing, clearing, settling, billing, transferring, reconciling or collecting, a payment for, or related to, health plan premiums or health care, where such payment is made by any means, including a credit, debit, or other payment card, an account, check, or electronic funds transfer.” It goes on to cover related work such as auditing, customer disputes and inquiries, and communications to a customer about their own transactions (Public Law 104-191).
The exemption applies “with respect to such activities.” It does not turn every feature a payments company sells into exempt work. Appointment books, invoices that list services, stored customer notes and analytics are separate activities, and that is where vendors draw their own lines.
What Stripe, Square, PayPal, Venmo and QuickBooks say
Each row quotes the vendor's own page, opened November 2, 2026. Linked names open the vendor's BAA Directory entry.
| Tool | Signs a BAA? | What the vendor says | Source |
|---|---|---|---|
| Stripe | No public statement offering one | About data Stripe accesses from your other service providers: “User must not provide Protected Health Information to Stripe as part of Third Party Data.” | Stripe Services Agreement |
| Square | Yes, for HIPAA-enabled services | “This HIPAA BAA applies only to the Services and configurations where Square is acting as your Business Associate, including when you use Square Appointments, Invoices, or other features that have been explicitly identified as HIPAA-enabled by Square.” Square adds: “Not all Services are HIPAA-enabled.” | Square HIPAA BAA |
| PayPal | No public statement offering one | A covered entity or business associate agrees it “will not use Invoicing in a manner that causes PayPal to create, receive, maintain or transmit Protected Health Information (PHI) on your behalf.” | PayPal Invoicing Terms |
| Venmo | No public statement | Venmo's User Agreement does not mention HIPAA or a BAA, and the BAA Directory found no statement in its Privacy Statement. | Venmo User Agreement |
| QuickBooks Online | No | Intuit says QuickBooks Online “is not compliant with the HIPAA standards for privacy.” | Intuit help article |
Square also says that if a covered entity uses Square “in a manner that causes Square to create, receive, maintain, or transmit Protected Health Information (PHI) on your behalf, then you agree to the HIPAA Business Associate Agreement” (Square Support Center). For a deeper look at Stripe, see Is Stripe HIPAA compliant?. The messaging and payments list in the BAA Directory covers more tools.
PCI DSS and HIPAA
PCI DSS and HIPAA protect different data. The PCI Security Standards Council says “The PCI DSS defines security requirements to protect environments where payment account data is stored, processed, or transmitted” (PCI SSC). HIPAA protects health information that identifies a patient. A processor can meet PCI DSS for card data and still not sign a BAA, and a BAA says nothing about card security. A practice that takes cards needs to think about both.
Keeping PHI off payment pages and receipts
Card data is only part of the picture: the words a practice adds around a payment can also carry health details. Check four places:
- Statement descriptors. Stripe says descriptors “explain charges or payments on bank statements,” and a dynamic suffix lets you “specify details about the product, service, or payment on bank or card statements” (Stripe Docs). Keep the descriptor to the practice name. A treatment name on a card statement is visible to anyone who sees that statement.
- Item names, invoices and receipts. Use neutral service names, such as office visit or consultation, instead of a condition, procedure or drug name, especially in any tool that does not sign a BAA.
- Patient requests. Providers must accommodate reasonable requests to receive communications at another address or by other means, and may condition that accommodation on “information as to how payment, if any, will be handled” (45 CFR 164.522). The same section says a covered entity must agree to a patient's request not to disclose information to a health plan about an item or service the patient “has paid the covered entity in full” for, when the disclosure is for payment or operations and not otherwise required by law.
- Checkout and thank-you pages. HHS says tracking technologies can disclose “information that the individual types or selects when they use regulated entities' websites or mobile apps” (HHS). A purchase event from a pixel can carry the page address, the product name and the value. See subscription billing leak points.
Which payment tools and wording fit your practice depends on your services and your state, so talk to your counsel.
Counting payments as ad conversions
For a cash-pay clinic or a telehealth brand, the payment is often the conversion that matters most, and ad platforms bid better when they see it. Meta and Google Ads don't sign a BAA (Meta; Google Ads), so the event they receive needs a neutral name and only the fields each platform needs. See conversion value and value-based bidding for how platforms use what you send, and the HIPAA compliant website checklist for the rest of the site.
How Curve Compliance helps
Curve Compliance replaces the browser ad pixels on your checkout and thank-you pages with one script and sends conversions server-side from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, and Event Logs show what Curve sent to each platform and what it accepted.
When a patient leaves your site to book in Square, IntakeQ, Calendly, Acuity, Jane App and other schedulers, Curve keeps the ad attribution. Outcomes from booking systems, CRMs and call tracking arrive through incoming webhooks or offline conversion uploads and are credited to the original ad click, and Campaign Reporting puts Meta and Google Ads spend next to those conversions. Curve is SOC 2 Type II and signs a BAA on every plan (Directory entry). Curve's team does the setup, typically live in about a week.
Sources, checked November 2, 2026: Public Law 104-191, Section 262 (Social Security Act Section 1179); 45 CFR 160.103; 45 CFR 164.501; 45 CFR 164.522; PCI Security Standards Council, Standards; Stripe Services Agreement; Stripe Docs, Statement descriptors; Square HIPAA Business Associate Agreement; Square Support Center, HIPAA requirements; PayPal Invoicing Terms and Conditions; Venmo User Agreement; Intuit, Is QuickBooks Online HIPAA compliant?; HHS, Use of Online Tracking Technologies.
Frequently Asked Questions
Does HIPAA apply to payment processing?
Not to the payment itself: Section 1179 says HIPAA's administrative simplification rules do not apply to authorizing, processing, clearing or settling payments for a financial institution, including card payments for health care (Public Law 104-191). A practice's own billing is still covered, and a billing tool that handles PHI for it can need a BAA.
Is Stripe HIPAA compliant?
The BAA Directory found no public statement from Stripe offering a BAA, and Stripe's Services Agreement says “User must not provide Protected Health Information to Stripe as part of Third Party Data” (Stripe; Directory entry). Card processing itself falls under Section 1179, so keep diagnosis and treatment details out of what you send Stripe; see Is Stripe HIPAA compliant?.
Is Square HIPAA compliant?
Square offers a HIPAA BAA that it says “applies only to the Services and configurations where Square is acting as your Business Associate,” such as Square Appointments and Invoices, and notes that not all services are HIPAA-enabled (Square; Directory entry).
Does a payment processor need a BAA?
Not for processing the payment itself, which Section 1179 exempts (Public Law 104-191). A vendor that handles PHI for your billing or practice management is a business associate and needs one (45 CFR 160.103).
Is PCI compliance the same as HIPAA compliance?
No. PCI DSS protects “payment account data” (PCI SSC), while HIPAA protects identifiable health information. A tool can meet one and not the other.
What should not appear on a patient's receipt?
Diagnoses, condition names, procedure names and drug names, in line items or in the card statement descriptor. Use the practice name and neutral service names, and honor a patient's request to receive bills at another address.
Can I put the Meta Pixel on my checkout page?
HHS says a tracking vendor that receives PHI from a covered entity's site needs a BAA (HHS), and Meta does not sign one (Directory entry). Send the purchase as a neutral, server-side conversion instead.
Talk to Curve Compliance
Book a call. Want paying patients counted in your ad platforms without a pixel on the checkout page? Curve Compliance sends conversions server-side, strips PHI before data reaches an ad platform and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.