HIPAA compliant credit card processing guide

TLDR

• Is payment processing covered by HIPAA? Credit card processing handles financial data, while HIPAA focuses on health data security. However, if your payment workflow links a patient's identity or medical details (like treatment descriptions) to a transaction, HIPAA applies.
• HIPAA vs. PCI DSS: HIPAA protects patient health privacy (PHI). PCI DSS protects credit card details. Your practice must comply with both. Learn more about PCI compliance for healthcare payment processing.
• What is a BAA? A Business Associate Agreement is a legal contract requiring third-party vendors (like your payment processor), to protect the information under the same strict federal standards your practice follows.
• Payment safeguards and best practice: Always use card tokenization and point-to-point encryption. Never write raw card numbers in EHR notes, on paper, or unencrypted forms.
• Common violations: Sending itemized digital invoices with diagnosis details over an unencrypted email, logging patient details in analytics tools, or using a processor without a signed BAA.

As your healthcare practice grows, you’ll inevitably run into the need to accept more payment options like credit, debit, and even HSA/FSA cards. A quick search and suddenly you’re hit with an alphabet soup of compliance acronyms: HIPAA, PCI DSS, PHI, BA, even BAA. Compliance is likely not the most exciting part of running a clinic, yet it’s important that you have a solid understanding of the different regulations, or else the line between payment data and medical record privacy gets blurry fast. This guide breaks down the compliance jargon, explains how HIPAA and PCI DSS work together, and gives you a practical checklist to protect your practice and your patients.

Is credit card processing even covered by HIPAA?

Generally speaking, credit card processing is not subject to HIPAA as the data being handled is payment data, not health records. But there are some critical nuances that you need to understand before accepting your first credit card payment.

The central theme is data separation. Payments data should not be connected to health records, including diagnoses, electronic health records (EHR), and data held in Practice Management Systems (PMS). In practice, it can be difficult to keep payment information and patient medical records completely independent– for example, if your patient requires an itemized receipt to submit to their insurance company for reimbursement. To protect your practice and patients’ data, you need to ensure that your workflows not only comply with HIPAA rules, but also PCI DSS (Payment Card Industry Data Security Standard) payment regulations.

PCI vs HIPAA compliance for credit card processing

As you evaluate how to incorporate credit card transactions for your practice, you’ll likely run into another compliance regulation called PCI DSS (often just referred to as PCI). While HIPAA governs health data security, PCI DSS governs card and cardholder security. As a healthcare practice handling credit card payments, you’ll need to be both HIPAA and PCI compliant so it’s important to understand how they both work and how one affects the other.

HIPAA vs PCI DSS and how it affects your practice

HIPAA (Health Insurance Portability and Accountability Act)

A U.S federal law that safeguards patients’ protected health information (PHI), including the creation, storage, transmission, and receiving of data. It ensures that every healthcare provider has administrative, physical, and technical safeguards in place.

PCI DSS (Payment Card Industry Data Security Standard)

A global security framework created by major card networks (Visa, Mastercard, Amex, and Discover) to protect sensitive card information and prevent payment fraud.

What are ePHI and BAA for HIPAA compliance?

If your credit card processing workflow touches your patient’s protected health information (PHI), you want to make sure you have a Business Associate Agreement (BAA) in place with your payment provider. As we mentioned in the beginning, credit card processing itself isn’t a violation to HIPAA; however, in order to keep your practice compliant, you’ll want to understand PHI / ePHI (electronic protected health information) and BAAs and when these come into play:

Protected health information (PHI & ePHI)

Protected health information, better known as PHI, is defined in HIPAA as data that covers any medical records, billing information, and other health information that can be linked back to a specific person. This includes printed, digital (ePHI), or even verbal information that is created, stored, transmitted, or received.

Business Associates (BA) and Business Associate Agreements (BAA)

A Business Associate is any third-party vendor that provides services to healthcare providers and has access to PHI. Think of EHR providers, accounting firms, attorneys, and healthcare payment processors, if they come in contact with your patients’ PHI, they’re a BA.

A Business Associate Agreement is a legal contract between the healthcare provider and BA to ensure that any PHI the BA comes in contact with is handled with the same strict administrative, physical, and technical safeguard standards as your practice.

To put this into perspective, when a healthcare practice signs up with Helcim, they can request Helcim to provide them with a BAA to ensure that Helcim is doing their due diligence and meeting the regulatory requirements when handling the clinic’s patient data.

What are the required security measures for HIPAA-compliant credit card processing?

In order for healthcare providers and payment processors to be HIPAA compliant they are required to have certain safeguards in place:

• Point-to-point encryption and tokenization
• Role-based access controls
• Multi-factor authentication (MFA)
• Audit logs of payment activity
• Administrative safeguards and training
• Incident response procedures

1. Point-to-point encryption and tokenization

Card data and patient identifiers need to be encrypted and safely stored using security processes such as tokenization. Tokenization replaces sensitive payment data, such as card numbers, with a randomized string of characters called “tokens”. Your clinic stores these tokens, while your payment processor securely vaults (for example, in Helcim’s card vault) the full 16-digit credit card number.

2. Role-based access controls

Systems need to be structured so that a patient’s payment data and PHI can only be accessed by staff members that require them to complete their specific job duties. Simply put, you only have access to the data that you need to get your job done.

Multi-factor authentication (MFA): MFA should be enforced on all virtual terminals, EHR integrations, and merchant accounts so someone with a stolen password cannot log in to your systems without a secondary identity check (e.g. being prompted to enter an SMS code delivered to a personal mobile device when logging into an EHR).

3. Audit logs of payment activity

Systems must generate access logs tracking who and when billing information was viewed or a payment was processed.

4. Administrative safeguards and training

BAs and clinics need to have policies and procedures defined around the handling of PHI and card data. This includes training staff members on their roles and responsibilities in the safe handling of PHI and payment data.

5. Incident response procedures

In case of a potential data breach or other security incidents, there must be a clear, documented plan on how to respond to these events.

What are common HIPAA violations when processing credit card payments?

As we mentioned in the beginning, even with a good understanding of how HIPAA affects card processing, lines can get blurry when you involve other providers into your practice’s workflow. Here are some examples of non-HIPAA compliant payment processing scenarios that you may encounter:

• Sending itemized digital invoices: If you send your patient an invoice with a payment link that includes things such as patient names, treatments, or diagnoses in the line items, you’ll want to ensure that the data is encrypted.
• Emailing receipts using non-secure email providers: If you’re looking to send an email receipt to your patient, make sure that you’re using a secure email system or portal instead of using non-encrypted providers (such as Gmail or Outlook).
• Writing down card information on patient records: Writing down card numbers is already a no-no for PCI DSS compliance, but if you write that in the patient’s files or EHR system–resulting in payment data and patient health data overlap– now you’re also breaking HIPAA rules. Learn how a healthcare clinic should store a patient's card on file.
• Not having a Business Associate Agreement: Using a payment processor (a BA in this case) that stores or has access to patient information requires a Business Associate Agreement (BAA) to ensure their cooperation in safe handling of PHI.
• Logging patient identifiers in analytics tools: Make sure that if you track any web or marketing analytics, you don’t run them on any payment pages that inadvertently log patient identifiers along with payment information.

Choosing a HIPAA-compliant payment provider for your clinic

Navigating two different compliance systems, such as HIPAA and PCI DSS, may seem complicated at first, but a good payments provider will guide you on PCI DSS compliance and do much of the heavy lifting for your clinic. When reviewing which provider will be best for your practice ask these three compliance-related questions:

1. Is the payment provider HIPAA compliant?
2. Can they provide a Business Associate Agreement (BAA) upon request?
3. Will they help me stay PCI DSS compliant by issuing annual Self-Assessment Questionnaires and do they have safeguards in place to protect PHI and patient payment data?

Explore the best patient payment processing solutions for your business.

The checklist to accept credit card payments in a HIPAA compliant way

Once you have created a merchant account with a payments provider, review this checklist to make sure you’re remaining HIPAA compliant when accepting credit card payments.

• Separate payment data from patient records: Keep patient health records (PHI) separate from their credit card processing information, so no system or person has access to both in one place.
• Use card tokenization and data encryption: Never jot down raw card data locally. Use a payment provider that securely handles the sensitive information using tools such as tokenization and end-to-end encryption.
• Set up a BAA with Business Associates: If businesses that support your clinical operations, such as a payment provider, come into contact with PHI, make sure a BAA is established before they get access to any patient information. Helcim always provides BAA to healthcare clinics upon request.
• Maintain PCI DSS compliance: Some payment providers, like Helcim, will help you stay PCI DSS compliant by sending you an annual Self-Assessment Questionnaire (SAQ). Make sure you read each question carefully and train your team accordingly.
• Team training on best practices: Set a regular cadence to ensure that your team is up to date and confident in safe handling practices of patient payment information and PHI.
• Establish access controls & MFA: Make sure that those who have access to sensitive information, are only those that require it to complete their job responsibilities. Using proper login best practices and setting up multi-factor authentication can limit data vulnerabilities.

Ready to start accepting credit cards through a HIPAA compliant payments company?

Helcim allows healthcare practices to accept credit card payments, while ensuring compliance to HIPAA standards and more importantly, protecting your business and clients’ data. We offer Business Associate Agreements (BAA), encrypt and tokenize all card data to PCI DSS standards, and offer a full platform of payment tools for healthcare providers.

Learn more about how Helcim supports healthcare providers with a HIPAA compliant payments solution or sign up now to start saving on card processing fees.

Frequently asked questions

Can a healthcare provider store a credit card on file and remain HIPAA compliant?

Yes. But the card information must be tokenized on your payment systems to remain PCI-DSS compliant. You can’t write down full card numbers in the notes section of your EHR system or in a patient intake form. If your payments company handles tokenized card data and PHI, you must request a Business Associate Agreement (BAA) to promise safe handling of PHI.

Does using a self-built patient payment portal trigger HIPAA obligations?

Yes. A patient payment portal is subjected to the same HIPAA requirements. If you build a patient payment portal that handles the patient’s name alongside a balance, diagnosis, or treatment line item, etc., you are subjected to the strict requirements of the HIPAA Security Rule.

Is it HIPAA compliant to take credit card payments over the phone?

Yes. You can take credit card payments over the phone and still be HIPAA and PCI DSS compliant. However, you need to ensure that your team members are properly trained and aware of safe handling procedures. For example, if you take payment over the phone, these should be taken in a secure environment and should not be recorded—make sure you’ve stopped any call recordings before your patient shares their card information.

Is it HIPAA compliant to email a patient a payment receipt?

Yes. Emailing receipts can be HIPAA compliant, but you need to be cautious of what information is included in the email and that you’re using encrypted email systems or portals. Standard email providers (e.g. Gmail or Outlook) are unencrypted and vulnerable to interception. If the receipt contains PHI and uses a non-encrypted email, it would be a violation to HIPAA rules.

Are HSA/FSA card payments treated differently under HIPAA?

No, they are treated the same. Though HSA and FSA cards have other conditions for your practice to be able to accept them (read more about accepting HSA and FSA cards here), from as far as HIPAA is concerned, they’re handled in the same way as standard credit cards, requiring the same end-to-end encryption and tokenization to protect card-holder data.