Is Stripe HIPAA compliant? Payment links for consult fees

Stripe does not offer a BAA, so it is not a HIPAA-compliant place for health information. A cash-pay practice can still use Stripe payment links for consult and lab fees, because HIPAA exempts payment processing. The condition is that nothing clinical goes into Stripe: no diagnoses, treatments or test names in products, descriptions, custom fields or receipts.

Does Stripe sign a BAA?

No. Stripe does not publish a business associate agreement or include one in its standard terms. Its own Services Agreement says the user "must not provide Protected Health Information to Stripe" through third-party data connections. HIPAA Journal reports that Stripe will not enter into a BAA with covered entities.

Stripe's healthcare guidance makes the same point from the other side. It says a transaction that includes "a patient's name along with diagnosis information contains protected health information" and tells businesses to confirm whether a payments provider will sign a BAA before committing.

Why can a practice use Stripe without a BAA?

Because HIPAA carves out payment processing. Section 1179 of HIPAA says its rules do not apply to an entity "engaged in authorizing, processing, clearing, settling, billing, transferring, reconciling, or collecting payments" for health care. A card payment for a consult falls inside that carve-out. Anything beyond the payment does not.

The statute is at 42 U.S.C. § 1320d-8. HHS confirmed it in the 2013 Omnibus Rule: "The HIPAA Rules, including the business associate provisions, do not apply to banking and financial institutions with respect to the payment processing activities identified in § 1179." The same rule says a BAA is not needed with a financial institution that is "solely conducting payment activities".

So the exemption covers the payment. It does not cover clinical notes you type into a product name, a custom field or an invoice memo. Keep Stripe to what a payment needs: an amount, a payer, a card and a generic label.

What counts as PHI in a payment?

A payment becomes PHI when it links a person to their health or care. A name and card alone are payment data. A name next to a condition, treatment, program or test is health information, wherever it sits in Stripe.

Check every place text can appear:

• Product names and descriptions. These show on the payment page, the receipt and your dashboard.
• Statement descriptors. The text on the patient's bank or card statement, which other people in a household may see.
• Custom fields. Stripe's own docs say "Don't use custom fields to collect personal, protected, or sensitive data."
• Metadata, invoice memos and notes. Easy to fill in by habit, and visible to anyone with dashboard access.
• Receipts. Stripe emails receipts for successful payments when that setting is on, and they repeat the product name.

How should you name products and payment links?

Name products by the visit or fee type, never by the condition or treatment. "Initial visit," "Lab fee" and "Monthly program" are safe. Anything that tells a reader why the patient is being seen is not.

The same rule applies to your practice name. If your business name itself names a condition, consider a neutral DBA for the statement descriptor. Stripe requires the descriptor to reflect your DBA name and limits it to 22 characters.

Which Stripe settings should you check?

Check four settings: the statement descriptor, the dynamic suffix, customer emails and payment-link options. Each one can leak a treatment name if it was set up for a store instead of a practice. It takes about 15 minutes.

1. Statement descriptor. In business details, set a neutral static descriptor. If you use a dynamic suffix for card payments, keep it generic, such as "VISIT" or "LABS".
2. Receipts. Under customer emails, decide whether Stripe sends automatic receipts. If it does, your product names appear in them, so the names must be safe.
3. Payment-link options. Turn off custom fields. Collect a phone number or address only if the payment needs it.
4. Dashboard access. Give your VA a limited role. Anyone with access can see every customer and product name.

Stripe lists "Telemedicine and telehealth services" as a restricted business that needs extra review, and it prohibits card-not-present sales of prescription-only products. Charge for visits, labs and program fees, and keep prescriptions with your pharmacy.

How do Square, PayPal and EHR payments compare?

Square is the main exception: its terms include a HIPAA BAA for services Square identifies as HIPAA-enabled, such as Square Appointments and Invoices. Stripe does not offer one. Payments built into a HIPAA-ready EHR keep the payment next to the chart, under the EHR's BAA.

Square's BAA has limits. It applies only where Square acts as your business associate and only to services it marks as HIPAA-enabled. Its PHI definition also excludes information exempt under Section 1179. Read it before you treat everything in Square as covered.

When should you use EHR payments instead of Stripe?

Use your EHR's payments when the charge is tied to clinical detail you need to see together: packages, program renewals, card on file for follow-ups. Use Stripe links when you need a fast, generic payment outside the EHR, such as a deposit from an ad lead before they have a chart.

Many EHRs process cards through a payment partner anyway. OptiMantra, for example, lists Fiserv, Stripe and Authorize.net as partners. The difference is that the clinical context stays in the EHR, under its BAA, and the processor only sees the payment.

Lab platforms are a third path. Fullscript and Rupa can charge the patient for the test and your fee in one checkout. Our guide to collecting lab fees before the first consult compares the models.

Checklist: Stripe for a cash-pay practice

1. Product names describe the fee type only: initial visit, lab fee, follow-up, monthly program.
2. Descriptions say what the fee covers, never why the patient needs it.
3. Statement descriptor is your neutral business name or DBA.
4. Dynamic suffix, if used, is generic.
5. No custom fields on payment links.
6. No clinical words in metadata, memos or internal notes.
7. Receipt settings checked, and receipts read like a plain bill.
8. VA has a limited dashboard role.
9. Payment confirmation emails sent from Stripe say nothing about care. Clinical next steps go out from your EHR or a tool under a BAA.
10. Your account has passed Stripe's review for telehealth businesses.

To check the rest of your stack, use the BAA checker or our list of tools that sign a BAA. If you want us to map where payments sit in your patient journey, request a free patient journey map.

This is general information, not legal advice. Confirm BAA terms with each vendor.

Common questions

Does Stripe sign a BAA?

No. Stripe does not offer a business associate agreement, and its Services Agreement tells users not to send it protected health information through third-party data connections. Practices can still take payments through Stripe under HIPAA's payment-processing exemption, as long as no clinical detail goes into Stripe.

Can you name the treatment on a payment link?

No. Name the fee type, such as "Initial visit" or "Lab fee." A treatment or condition next to a patient's name is health information, and it appears on the payment page, the receipt and your dashboard.

Is Square HIPAA compliant?

Square includes a HIPAA BAA in its terms for services it identifies as HIPAA-enabled, such as Square Appointments and Invoices. It does not cover every Square product, so read the scope section of Square's BAA before relying on it.

Do you need a BAA with your payment processor?

Not for payment processing alone. HIPAA Section 1179 exempts authorizing, processing and collecting payments for health care, and HHS confirmed that no BAA is needed with an institution doing only that. You need a BAA if the processor handles health information beyond the payment.

Are Stripe payment links secure?

Stripe payment links run on Stripe-hosted checkout pages, so card data does not touch your website. Security of card data is a separate question from HIPAA, though. The HIPAA risk comes from what you type into product names, fields and notes.