Best HIPAA Compliant Payment Processors in 2026

Most "HIPAA compliant payment processor" lists blur one thing on purpose: whether the processor actually needs a Business Associate Agreement (BAA) in the first place. The U.S. Department of Health and Human Services (HHS) says a financial institution processing an ordinary card payment is not automatically a Business Associate just because the underlying charge relates to healthcare. A processor only crosses that line when it creates, receives, maintains, or transmits Protected Health Information (PHI) on your behalf, which happens the moment a patient's name gets tied to a diagnosis, a treatment, or a service line on an invoice.

Here's what that looks like in practice: A patient swipes their card to pay a $150 balance and the receipt just says "Payment: $150." That's an ordinary card transaction, no PHI involved. But if that same receipt lists "Payment: $150 for physical therapy session, lower back" with the patient's name attached, the processor handling it is now touching PHI, and a BAA applies. Same card, same $150, different level of detail on the invoice, different HIPAA obligation.

That distinction changes which processor is actually right for you. Below, we rate every processor on five things, starting with BAA scope, meaning exactly which of a processor's products will sign a Business Associate Agreement and under what conditions, since some processors cover this automatically, some only on request, and some only for certain configurations. Beyond that, we also look at published pricing, electronic health record (EHR) integration, compliance documentation, and what real users say once the sales pitch is over.

Key takeaways

• A processor becomes a HIPAA Business Associate only when it handles PHI on a practice's behalf. Ordinary card processing by a financial institution can fall outside that definition entirely.
• Helcim provides a BAA on request at no added cost, backed by an internally reviewed annual HIPAA program and Trust Center that provides access to compliance reports.
• Enterprise platforms like InstaMed handle hospital scale insurance and patient billing together. A small or growing practice usually needs less than that.
• Jane App and similar practice management platforms embed payment processing rather than providing it directly, often through a white-labeled processor like Stripe.

How we evaluate HIPAA compliant payment processors

Six criteria drove this comparison:

1. How clearly the vendor documents BAA availability and exactly which products it covers
2. Pricing transparency: published rates versus custom quote required
3. Electronic health record (EHR) and practice management system (PMS) integration depth
4. Ongoing compliance documentation, including audits and PCI DSS certification level
5. Real user feedback from G2, Capterra, and Reddit
6. Contract terms and fees beyond the headline rate

Pricing and compliance claims were checked against each platform's own public legal, pricing, and documentation pages. Where a vendor does not disclose its BAA process or its pricing publicly, that gap is stated directly instead of guessed at.

Why practice management system (PMS) platforms like Jane App aren't in this comparison

Jane App, SimplePractice, TherapyNotes, and similar practice management platforms aren't included in the table above because they aren't payment processors in the same sense as Helcim, Square, or InstaMed. They're practice management software that embeds payment processing, typically by white-labeling an underlying processor like Stripe, rather than processing payments themselves.

That distinction matters for two reasons:

• You're not actually choosing the processor. Questions about BAA scope, pricing structure, or compliance documentation get answered by the PMS vendor's terms, not a direct processor relationship.
• Pricing is bundled, not standalone. It's folded into the software subscription rather than published as its own processing rate, which makes it harder to compare against Interchange Plus or flat-rate pricing on equal footing.

If your practice already runs on one of these platforms and its built-in payments work fine, there's no need to switch. But if you're evaluating payment processing on its own merits, or your PMS's embedded processor has ever given you an answer you couldn't verify directly, it's worth knowing you're one layer removed from whoever's actually handling the transaction.

Best HIPAA compliant payment processors

Helcim

Helcim is best for: Established, private healthcare practices that want low-cost transparent payment processing with documented compliance access.

Helcim is a payment processor built for small and mid-sized businesses, including dental offices, physio and chiro clinics, mental health practices, and independent medical clinics. Even though Helcim is not an EHR software, it's a HIPAA compliant payment processor. Through Helcim Payment Extension, Helcim connects directly into a number of EHR and practice management platforms, so a practice using one of those tools doesn't have to leave it to take a payment.

Helcim key features

Five things are worth understanding in detail, since how Helcim handles each one differs meaningfully from the rest of this comparison:

• A BAA on request, backed by an internal compliance program: Helcim provides a Business Associate Agreement at no additional cost, based on a government BAA template, and reviews its HIPAA compliance program internally at least once a year. Practices can request access to compliance and audit reports through the Trust Center, plus a bridge letter if they're between audit periods.
• Payment Extension for EHR and practice management platforms: Helcim Payment Extension connects Helcim's processing directly into SimplePractice, Jane App, TherapyNotes, Carepatron, CharmHealth, Noterro, Athenahealth, and more. Healthcare clinics can take a card payment at the end of a session using Helcim Payment Terminal or Virtual Terminal without leaving their EHR software.
• Automatic volume discounts: Helcim Interchange Plus pricing passes the true payment processing costs to merchants, and the fees are automatically lowered as monthly processing volume grows, with no renegotiation call required. In contrast, most healthcare payment processors charge a flat expensive payment processing fees with no volume discounts.
• Compliant surcharging tool: Helcim Fee Saver lets eligible practices pass credit card processing fees to patients who choose to pay by card, with the fee disclosed before the patient confirms and the surcharge cap applied automatically based on location.
• Encrypted card on file and recurring billing: Helcim's Customer Vault stores patient cards with encrypted tokenization at no extra monthly fee.Helcim Recurring payments supports automated installment plans with retry on failed payments.

Helcim Processing fees

Helcim uses Interchange Plus pricing: the real network cost banks and credit card companies charge, plus one transparent margin, with automatic volume discounts as monthly processing grows. Full detail is in Helcim's U.S. fee disclosures; the table below covers the base tier.

Other fees worth knowing, per Helcim's fee disclosure:

• Chargeback: $15, or $0 if resolved in the merchant's favor
• Recurring payments: additional 0.4% per transaction
• Tap to Pay on iPhone: additional 10 cents per transaction
• Level 2/3 interchange optimization: 30% of the savings generated

Helcim's pricing page illustrates an effective rate of roughly 1.83% + $0.08 for a $300 in-person transaction under its stated assumptions. That figure is one scenario, not a fixed rate. Real cost depends on the card type and interchange category, and readers can run their own numbers with Helcim's processor comparison tool.

Helcim Strengths

• Pricing you can check before you sign up: Helcim publishes its Interchange Plus rates for both the U.S. and Canada. There's no monthly fee, setup fee, PCI compliance fee, statement fee, or cancellation fee.
• Costs that fall as your practice grows: Helcim's margin is automatically reduced up to 70%, with no renegotiation or plan upgrade. For practices that take business or corporate cards, such as clinics billing employers, Helcim's Level 2/3 optimization can bring those payments as low as 1.45%.
• Compliance you can verify upfront: Helcim's BAA is free on request, and practices can request audit reports through the Trust Center, plus a bridge letter between audit periods, before they commit. Helcim reviews its HIPAA compliance program internally at least once a year, is PCI DSS compliant, and replaces stored card numbers with AES-256 encrypted tokens.
• Works with the software a practice already runs: Helcim Payment Extension connects Helcim to SimplePractice, Jane App, TherapyNotes, Carepatron, CharmHealth, Noterro, Athenahealth, and more, and reconciles each payment back into that software automatically. Helcim also connects directly to QuickBooks Online and Xero.
• Every payment tool included at no extra cost: Clinics can access all HIPAA compliant payment tools at no monthly costs or contract, such as invoicing, payment requests sent by text or email, payment pages, virtual terminal, customer vault, a branded patient portal, Fee Saver surcharging, and Fraud Defender. Clinics can accept HSA and FSA cards with Helcim.

Helcim Limitations

Helcim doesn’t offer EHR features, claims management, or revenue cycle functionality. However, clinics can use Helcim Payment Extension to connect Helcim payment processing to EHR platforms. With this connection, clinics can process payments with Helcim low rates without sacrificing any EHR features.

Who should choose Helcim

Helcim fits healthcare practices that want transparent pricing and a documented compliance process they can point to, especially once monthly card processing reaches around $25,000, the general threshold where Interchange Plus pricing starts to outperform flat-rate alternatives.

That said, the right number varies by card mix and volume, so we'd always encourage a practice to run its own numbers through Helcim's comparison tool rather than go by a rule of thumb alone. The onboarding friction some users report is worth weighing against the pricing and compliance transparency competitors in this list rarely publish. See Helcim's guide to hidden credit card fees for what to watch for elsewhere.

Square

Square is best for: Very small practices or solo practitioners wanting the simplest setup

Square is a general purpose payment and point of sale platform. It earns a spot in this comparison because it does maintain a HIPAA BAA, and it is the processor most independent practices compared against a healthcare focused option like Helcim.

Square key features

• A BAA built into Square's Terms of Service: If a practice uses a HIPAA-enabled Square product in a way that causes Square to handle PHI, the BAA applies automatically for that product, with nothing to request. It doesn't cover every Square product by default. In contrast, Helcim's BAA is requested rather than automatic, and it comes with audit reports through Helcim's Trust Center.
• Free, Plus, and Premium plans: Square's rate depends on the plan you pay for, not your volume. Helcim has no monthly fee, and its rate falls automatically as volume grows.
• A broad small-business toolkit: Square offers Point of sale software, invoicing, and payment links for clinics to start accepting payments. However, Square doesn't connect to healthcare EHRs or practice management software.

Square Processing fees

Square processing fees for U.S. healthcare clinic:

Businesses processing more than $250,000 a year can ask Square about custom pricing.

Square processing fees for Canadian healthcare clinic:

Square Strengths

• Free to start, with no contract: Square's Free plan has no monthly fee and no long term contract, so a new or solo practice can sign up and take its first payment quickly.
• A BAA with no paperwork: Practices don't have to request or pay for Square's BAA. Square provides a BAA for HIPAA-related tools like Square Appointments and Invoices.
• Booking and billing in one app: Square Appointments handles scheduling, and the same account covers point of sale, invoicing, and payment links. For a small practice that doesn't run a dedicated EHR, Square booking feature can be useful.
• Keep working when the internet drops: Square's offline payments let a practice keep taking cards during a Wi-Fi or service outage, with offline payments stored for up to 24 hours.

Square Limitations

• Square cannot connect with practice management software like Jane App or SimplePractice. In contrast, Helcim Payment Extension can connect with several EHR software so clinics can collect payments at Helcim’s low rates without leaving the software.
• Square publishes its BAA and its HIPAA enabled product scope, but it does not publish the kind of ongoing compliance reporting, like annual audit access, that Helcim does.
• Square flat rate pricing can cost more than Helcim Interchange Plus for practices that process high volume of credit card transactions.

Our take

Square is a legitimate, BAA covered option for a very small or solo practice that values simplicity over rate optimization. Confirm which specific Square product a workflow uses, since the BAA does not blanket cover every feature.

InstaMed

InstaMed is best for: Large health systems managing insurance claims and patient billing on one platform

InstaMed is a JPMorgan Chase company built for hospital scale healthcare payments. It connects payer side insurance reimbursement with patient facing billing, so billing teams are not reconciling payments across separate systems. InstaMed markets itself as a HIPAA-compliant healthcare platform, though unlike Helcim or Square, it does not publicly document its BAA request process or scope.

InstaMed key features

• Real-time eligibility verification: InstaMed checks insurance eligibility during scheduling, registration, or before a claim is submitted.
• Claims submission and remittance tracking: InstaMed automates payment posting through electronic remittance advice, a real time-saver for billing teams reconciling hundreds of claims a month.
• Payment plans tied to claims data: For balances left after insurance adjudicates, InstaMed links the payment plan to remittance data, so the plan reflects what insurance paid and what the patient owes.
• Omnichannel payment collection: Online, phone, in-person, digital wallet, and ACH payments all feed back into the same claims record, so one compliance posture covers every channel.

InstaMed Processing fees

A custom quote is required. No public pricing schedule exists on InstaMed's site or in third party reviews.

InstaMed Strengths

Deep payer connectivity is the real differentiator here, and it's also where InstaMed's compliance surface area is largest: for a multi-site health system billing across dozens of insurance plans, having eligibility, claims, remittance, and patient payments in one place means PHI moves through a single documented system instead of being reconciled by hand across separate tools, which is itself a risk reduction that a practice stitching together Helcim or Square with a separate billing system doesn't get.

InstaMed Limitations

• BAA process isn't publicly documented. Unlike Helcim's request-based process or Square's published scope, InstaMed doesn't detail how or when a BAA gets signed, which means a practice has to raise it directly in the sales conversation rather than verify it in advance.
• Contract terms aren't fully public. InstaMed's Terms of Use state that users are required to enter into a separate commercial license agreement with InstaMed, but the publicly available terms don't disclose a standard contract length, automatic-renewal period, or early-termination fee. InstaMed's Provider Support Portal confirms that provider agreements are managed individually rather than under one published set of terms. Practices should confirm the initial term, renewal provisions, and termination costs directly during the sales process.
• No published pricing means no way to check cost before a sales call.
• The platform is built around insurance-heavy workflows that a practice with little or no insurance billing will not use.

Our take

InstaMed makes sense for multi location systems with real insurance volume. A smaller clinic that only needs to collect co-pays and balances will be paying for infrastructure it does not need, and the thin review record is worth factoring in.

Phreesia

Phreesia is best for: High volume practices collecting payment during digital intake and check in

Phreesia is a patient access and engagement platform. Payments are one part of a broader registration, eligibility, and check in workflow that runs before the clinical encounter begins.

Phreesia key features

• Card on file collected during intake: Patients save a card while checking in before the visit, and Phreesia tokenizes it so the practice can charge the remaining balance once the insurer adjudicates the claim. It's a smart fit for insurance-driven practices.
• Eligibility checks before the patient arrives: Phreesia runs an average of three automated eligibility and benefits checks per patient before the visit, at no software charge, so the copay the front desk asks for reflects current coverage.
• Strong third-party certifications: Phreesia holds HITRUST CSF certification (2024), SOC 2 Type 2, and PCI DSS Level 1 Service Provider status, and its Bluefin-validated P2PE card readers cut a practice's PCI scope by more than 80%, according to Phreesia.

Phreesia Processing fees

Phreesia states it offers clients simple, flat processing rates. Specific rate figures are not published on its site.

Phreesia Strengths

Phreesia's front desk workflow is the most complete in this comparison.

• Patients get a text or email link before the visit and complete registration, insurance details, and consent forms on their own phone, with no app to download and no portal password.
• Phreesia writes demographics, insurance updates, balances, and screening scores back into the EHR software. It has certified two-way integrations with more than 16 EHR and practice management systems.
• Phreesia offers operational features like self-scheduling, appointment reminders, after-hours call triage, and clinical screeners such as the PHQ-9 for depression.

Phreesia Limitations

• Phreesia doesn’t publish the payment processing fees: Unlike Phreesia, Helcim publishes its Interchange Plus rates for both the U.S. and Canada, and the margin steps down automatically as monthly volume grows. A practice holding a Phreesia quote can upload it to Helcim's Merchant Statement Comparison Tool for a side-by-side.
• Hardware that only works with Phreesia: The clinic can’t use Phreesia card readers when switching payment processors. In contrast, the Helcim Smart Terminal offers an API so healthcare clinics can integrate it with third-party POS systems for a smoother setup.
• Contract and rollout complaints: Some recent reviews describe Phreesia pricing and contract issues, integration problems, and rocky implementations. In contrast, Helcim is month-to-month with $0 cancellation, and offers a Buyout Program that helps cover early-termination fees when a practice switches from Phreesia to Helcim.

Our take

Phreesia is a strong patient intake platform that includes payments. For a multi-provider specialty practice or health system that bills insurance on most visits and struggles with missed copays and a backed-up front desk, Phreesia is a great fit. Most independent clinics don't need that much platform, though. A therapy, physio, or dental practice running SimplePractice or Jane App won't find either on Phreesia's integration list, and Helcim's Payment Extension connects to both with published rates and no subscription to renew.

EBizCharge

EBizCharge is best for: Medical practices needing native accounting and ERP integrations

EBizCharge is a payment processor built around deep integration with accounting and ERP platforms, and it advertises HIPAA compliant payment processing specifically for medical and dental practices.

EBizCharge Key features

• Large ERP integrations: EBizCharge integrates with accounting and ERP systems, including QuickBooks (Desktop and Online), Microsoft Dynamics, NetSuite, Sage, SAP, Acumatica, Oracle, Salesforce, and WooCommerce. When a payment clears, it's applied to the matching open invoice automatically, which is a real time-saver for finance teams. However, EBizCharge's published integrations don't include any EHR or practice management system. In contrast, Helcim Payment Extension connects directly to QuickBooks Online and Xero, and other EHR software like SimplePractice and Jane App.
• Automated invoicing and a branded payment portal: Invoices go out from the accounting system with a pay link, followed by scheduled reminders, and payers can log in to a branded portal to see open balances and manage saved cards.
• Built-in surcharging: EBizCharge offers automated surcharge settings so a merchant can pass card fees on to payers where surcharging is allowed.
• Every major payment channel: Card and ACH processing, a browser-based virtual terminal with 3D Secure, in-person EMV terminals, and a mobile app that takes cards by Bluetooth reader, camera scan, or manual entry.

EBizCharge Processing fees

A custom quote is required. EBizCharge advertises a "no long-term contract" pledge as part of its standard marketing.

EBizCharge Strengths

For a practice whose books live in an ERP, EBizCharge removes a lot of manual reconciliation. A multi-location group running NetSuite or Dynamics gets payments posted to the right invoice without anyone keying them in from a processor report.

• EBizCharge is built into the accounting or ERP system rather than integrated through a third-party connector. Its integrations include certified apps for Microsoft Dynamics 365 Business Central, Sage Intacct, and Acumatica, plus QuickBooks, NetSuite, SAP, and Oracle.
• Similar to Helcim, clinics can send EBizCharge Invoices as pay links and the patients can log into the customer portal to view the paid invoices.
• Card and bank details are tokenized and stored off-site rather than in the ERP database. Online and phone payments add 3D Secure verification and address verification alerts to cut down on fraudulent chargebacks.

EBizCharge Limitations

• EBizCharge advertises HIPAA compliant processing for medical and dental practices, but its BAA is arranged through a sales or compliance rep during contract drafting, not through a request process on its public legal pages. In contrast, Helcim provides a BAA on request at no extra cost and lets practices request compliance and audit reports through its Trust Center.
• EBizCharge doesn’t offer EHR connection. In contrast, Helcim Payment Extension lets healthcare clinics take a payment inside SimplePractice, Jane App, TherapyNotes, and other platforms and reconciles it back automatically, while the QuickBooks Online and Xero connections handle the books.
• EBizCharge doesn’t publish its fees, such as processing rates, gateway licensing, ERP integration add-ons, and setup fees. In contrast, every Helcim rate and fee is public, with $0 setup and $0 monthly fees. Helcim also applies Level 2/3 optimization automatically, so qualifying business card payments can drop to as low as 1.45%.

Our take

EBizCharge is a good option for a practice whose finance team works in an ERP like NetSuite, Dynamics, or Sage. However, most clinics run their businesses in an EHR and their books in QuickBooks or Xero. For these clinics, Helcim covers both sides, connecting to the EHR through Payment Extension and to the accounting software directly, with published rates and a BAA available on request.

TrustCommerce (a Sphere company)

Best for: Healthcare organizations needing integrated, multi channel patient payments

TrustCommerce is a healthcare focused payment platform providing integrated patient payment processing with EHR integration, used by large healthcare systems.

TrustCommerce Key features

• Deep Epic integration: TrustCommerce runs payments inside Epic Resolute billing, MyChart, Welcome check-in kiosks, Tapestry, and Willow Ambulatory pharmacy, where it supports IIAS for FSA and HSA cards. It also integrates with Veradigm, Practice Fusion, and athenaIDX.
• P2PE validation at the desk and on the phone: TC Safe feature of TrustCommerce encrypts card data inside the device, including keypads billing staff use to take cards over the phone, which can qualify a merchant for the shorter SAQ P2PE assessment.
• Automatic card updates: TC Citadel of TrustCommerce stores reusable tokenized card information that can be shared across clinic locations, and TC CardCurrent feature updates expired or reissued cards on a monthly batch so payment plans keep running.
• Works with an existing processor: The TrustCommerce payment gateway can work with Fiserv, Chase Paymentech, Elavon, Global Payments/TSYS, and Worldpay. It also accepts PayPal and Venmo, and its cloud-connected PAX terminals need no software installed on front-desk computers.

TrustCommerce Processing fees

Custom quote required. No public pricing schedule exists.

TrustCommerce Strengths

TrustCommerce is a great fit for large health system infrastructures.

• One payment vendor across an entire Epic system: Clinics can process payments in hospital and professional billing, MyChart, check-in kiosks, and payer workflows through a single vendor.
• Flexibility on the payment processor: TrustCommerce is certified with Fiserv, Chase Paymentech, Elavon, Global Payments/TSYS, and Worldpay, so a healthcare system can integrate TrustCommerce with its existing payment processors. Make sure to check if there is any extra fee for this integration.
• Offline payment processing mode: TrustCommerce supports offline sales so payments can continue when the network drops.
• Broad payment options for patients: Patients can pay by card, ACH, Apple Pay, Google Pay, PayPal, or Venmo, plus HSA, FSA, and HRA cards.

TrustCommerce Limitations

• TrustCommerce doesn't document how or when it signs a BAA. In contrast, Helcim provides a BAA on request at no extra cost, with compliance and audit reports available through its Trust Center.
• TrustCommerce’s costs for processing, gateway fees, setup, hardware, P2PE licensing, tokenization, and account updates are not published. In contrast, Helcim publishes its processing rates and hardware prices, and charges $0 for setup, monthly fees, PCI compliance, and card storage.
• TrustCommerce's documentation covers U.S. banks and processors and publishes no Canadian processing. On the other hand, Helcim serves both the U.S. and Canada, with published Canadian rates and Interac debit at $0.09 per in-person transaction.

Our take

TrustCommerce is a solid choice for health systems already running Epic, Veradigm, or athenaIDX that want payments built into check-in, MyChart, the pharmacy, and affiliate clinics. The clinics should have an IT team to manage a custom setup. However, TrustCommerce doesn’t publish its pricing. If clinics prefer low-cost and transparent payment processing fees, Helcim is the better option. Helcim publishes processing rates, offers a BAA on request, and provides a Payment Extension that connects Helcim to the EHR software that clinics already use.

Checklist for choosing a HIPAA compliant payment processor

Step 1 - Confirm BAA availability and exact product scope for your use case: Some BAAs cover only specific services, like Square's, which applies only to its HIPAA-enabled products. Some, like EBizCharge's BAA, are arranged through a sales rep during contract drafting. InstaMed, Phreesia, and TrustCommerce don't publish their BAA process at all, so you won't know the terms until you're deep in a sales conversation. In contrast, Helcim provides a BAA on request at no additional cost, based on a government BAA template. Practices can also request compliance and audit reports through Helcim's Trust Center, plus a bridge letter if they fall between audit periods.

Step 2 - Evaluate pricing model, Interchange Plus versus flat rate: A flat rate charges the same percentage on every card. Interchange Plus passes through the actual network cost of each transaction and adds a fixed margin on top. Flat rate pricing is simpler, but it can cost more for a practice that processes high volume. Helcim Interchange Plus rates are available for both the U.S. and Canada, and the margin drops automatically as monthly volume grows, with no renegotiation. There's no monthly fee, setup fee, or PCI compliance fee.

Step 3 - Read the contract and exit terms: Ask about contract length, automatic renewal, early termination fees, and whether payment hardware is leased. InstaMed doesn't publish a standard contract length or termination fee, and some Phreesia reviews describe trouble canceling an auto-renewal. Also ask whether saved patient cards can move with you if you switch. Helcim is month-to-month with $0 cancellation, and its hardware is bought outright rather than leased. If you're leaving a provider that charges an early termination fee, Helcim's Buyout Program helps cover it, and Helcim migrates saved card data from your previous processor at no charge so patients don't have to re-enter their cards.

Step 4 - Check EHR and PMS integrations: Confirm whether the processor connects to your specific practice management software and whether payments reconcile back to the patient record automatically. Helcim's Payment Extension connects to SimplePractice, Jane App, TherapyNotes, Carepatron, CharmHealth, Noterro, Athenahealth, and more. Staff take the payment without leaving the software, and it reconciles back automatically. Helcim also connects directly to QuickBooks Online and Xero for the accounting side. Explore Helcim integrations.

Step 5 - Ask about fraud protection: Online transactions carry more fraud risk than in-person transactions. Therefore, make sure to ask the payment processor about security tools to prevent chargebacks, chargeback fees, the dispute process, and whether fees are refundable. Helcim Fraud Defender helps healthcare clinics minimize chargebacks. Besides, Helcim's chargeback cost of $15 is refunded if the clinic wins the credit card dispute process.

Step 6 - Confirm PCI DSS compliance: PCI DSS protects card data and HIPAA protects health information, so a practice needs both. PCI compliance matters, but it does not substitute for a BAA when PHI is involved. Ask the payment processors whether stored cards are tokenized and whether they charge a PCI compliance fee. Helcim is PCI DSS and HIPAA compliant. With the AES-256 encryption, Helcim ensures your clinic is PCI compliant at no extra costs.

What security features are worth looking for in HIPAA payment processors

HIPAA's Security Rule is risk-based rather than prescriptive about exact technical specifications. These are widely used practices worth confirming with any vendor handling PHI, and Helcim documents its own approach to each on its Security page:

• Encryption at rest and in transit: PHI and payment data are unreadable both while stored and while moving across the network
• Tokenization of stored payment data: Card numbers are replaced with randomized tokens so raw data never sits on the practice's own systems
• Multi factor authentication: A second identity check on top of a password, required for virtual terminals, EHR integrations, and merchant account logins
• Role based, least privilege access controls: Staff can only see the payment and PHI data required for their specific job
• Audit logging of payment and PHI access: A record of who accessed billing or patient data, and when
• Documented incident response plan: A clear, written plan for how the vendor responds to a potential breach or security incident

What are the risks of using a processor that isn't properly covered under HIPAA?

If a payment processor is acting as a Business Associate and handles PHI on a practice's behalf, the practice needs a compliant BAA with that vendor. Common risk patterns include:

• Sending itemized invoices with treatment details over unencrypted email
• Writing card numbers directly into EHR notes
• Using a vendor that is functioning as a Business Associate without a BAA in place.

See Helcim's guide to creating HIPAA compliant invoices for how to avoid the first one. HHS adjusts HIPAA penalty amounts periodically for inflation, so make sure to check HHS's compliance and enforcement page directly for current figures rather than relying on an outdated number.

Ready for a payment processor that's straightforward about compliance?

Helcim provides a Business Associate Agreement to healthcare merchants on request, backed by an internally audited HIPAA program and Trust Center access to compliance reporting. No added fee, no vague marketing claim to take on faith. Start for free or request your BAA directly from the compliance team at privacy@helcim.com.

Want to talk it through first? Reach a real person, not a ticket queue.

Frequently asked questions about HIPAA Compliant Payment Processors

Which payment processors aren't HIPAA compliant for healthcare practices?

Any vendor acting as a Business Associate for your specific workflow that will not sign a BAA is not a compliant option for that use case, no matter how secure its general payment technology is. Confirm BAA scope directly with the vendor rather than assuming based on brand size.

Is Jane App the only HIPAA compliant payment processor?

No. Jane App is a practice management platform with payment functionality, not a standalone processor. Multiple standalone processors, including Helcim and Square, will sign a BAA for the workflows that require one.

Do I need a BAA with my payment processor?

Yes, if the vendor creates, receives, maintains, or transmits PHI on your behalf, which most clinic billing setups involve once a patient's identity gets tied to a service description or treatment detail. If your processor only ever sees a transaction amount with no linked patient or health data, ask the vendor directly before assuming a BAA isn't required.