Payments · Telehealth6 min readUpdated November 2, 2026

Do You Need a HIPAA BAA With Your Payment Processor?

HIPAA's payment exemption, when a processor needs a BAA, what Stripe's contract says about health data, and how to keep PHI out of payments.

Nick Bonnassies, CMO at Tagada · checked against 11 sources

Article summary

TL;DR

Usually not. HIPAA section 1179 excludes card payment processing for health care from HIPAA, so a processor that only authorizes, settles and collects payments isn't your business associate. That changes if it receives clinical data or does more than payments. The practical rule: send your processor nothing medical, and focus BAAs on tools that see patient data.

Section 1179 says HIPAA "shall not apply" to entities "authorizing, processing, clearing, settling, billing, transferring, reconciling, or collecting payments", including by "credit, debit, or other payment card".
The exemption covers payment activities only; a financial institution doing more, such as managing receivables, can become a business associate.
Stripe's contract, modified September 28, 2026, says users "must not provide Protected Health Information to Stripe".
Brands outside HIPAA still fall under the FTC's Health Breach Notification Rule, effective July 29, 2024.
On July 29, 2026, the FTC alleged a telehealth company shared health data "with third-party advertising platforms such as Meta and Snap".

Want to go further? Ask

On this page

This guide is part of our hub on telehealth payment processing. The general guide, for any business: getting a high-risk merchant account.

This is general information on how the rules apply to payments, not legal advice. Your HIPAA counsel decides for your setup.

The payment processing exemption, in HIPAA's own words

HIPAA itself carves payment processing out. Section 1179 says the law "shall not apply" to an entity "engaged in authorizing, processing, clearing, settling, billing, transferring, reconciling, or collecting payments, for a financial institution"1.

It names health care payments explicitly: payment "for, or related to, health plan premiums or health care, where such payment is made by any means, including a credit, debit, or other payment card"1.

What the vendor does	BAA needed?	Why
Card processor that only authorizes and settles payments	Generally no	Section 11791; "a normal banking service, not work for the practice"3
Processor that also manages receivables or collections for you	Possibly	Goes beyond payment activities2
Billing platform storing diagnoses, visit dates or superbills	YesIf you are a covered entity	It handles PHI on your behalf3
Intake forms, video, messaging, clinical email	YesIf you are a covered entity	Core PHI tools4

Fig. 1Payment data and clinical data, kept apart

Payment data

CheckoutAmount, card, order ID
sent toCard processorAuthorizes and settles onlyApproved

Generally no BAA: section 1179

Clinical data

IntakeForms, video, messaging
stored inClinical toolsHandle PHI on your behalfDeclined
billed throughBilling platformDiagnoses, visit dates, superbillsDeclined

BAA, if you are a covered entity

The processor's side stays clean when nothing medical is sent to it.

42 U.S.C. § 1320d-8; Accountable and Mentalyc on BAAs (secondary sources).

Watch out

Many pages that say "every processor needs a BAA" are written by vendors selling one. Read the statute, then decide based on what the processor actually receives.

First question: does HIPAA cover your brand at all?

HIPAA applies to covered entities, such as health care providers that bill electronically, and to their business associates. Accountable notes that direct-to-consumer services not acting for a covered entity "may fall outside HIPAA"4.

Falling outside HIPAA doesn't mean no rules. The FTC's Health Breach Notification Rule covers "vendors of personal health records (PHRs) and related entities that are not covered by" HIPAA5.

Your situation	Main framework	What it requires in a breach
The practice bills insurers electronically	HIPAA	Privacy, security and breach rules; BAAs with vendors handling PHI
Cash-pay brand holding health records outside HIPAA	FTC Health Breach Notification Rule5	Notify individuals, the FTC and, in some cases, the media5
Either	FTC Act	NoDeceptive or unfair data sharing7 8

Fig. 2Which framework covers your brand

Your telehealth brandWho you are decides the rule

HIPAAThe practice bills insurers electronically
FTC Health Breach Notification RuleCash-pay brand holding health records outside HIPAA
FTC ActEither case: no deceptive or unfair data sharing

Outside HIPAA doesn't mean outside the rules.

Accountable, July 25, 2026; FTC Health Breach Notification Rule, 89 FR 47028.

Your structure, who is the provider and who runs the brand, decides which column you are in: see who can own a telehealth company.

What Stripe's contract says about health data

Stripe's Services Agreement is direct: "User must not provide Protected Health Information to Stripe as part of Third Party Data. User is liable for any disclosure of Protected Health Information to Stripe when User provides access to the Third Party Data."6

So the question is less "will my processor sign a BAA" and more "am I sending it anything medical". Read your own processor's agreement for an equivalent clause. For Stripe's telehealth policy as a whole: does Stripe allow telehealth?

Keep health data out of your payment data

Most leaks into the payment stack come from fields nobody thinks about. Check each one.

Field	Risk	What to write instead
Product or line-item name	Treatment named in the processor dashboard	"Monthly care plan", "Consultation"
Statement descriptor	Treatment on the card statement, seen by anyone with the statement	Brand name and support contact
Payment metadata	Intake answers or condition codes passed to the processor	Order ID, patient ID only
Receipt emails	Treatment details sent by the processor	Amount, date, link to the patient portal
Dispute evidence	Clinical notes uploaded to fight a chargeback	Proof of consent, delivery, terms accepted

Fig. 3A payment record with nothing medical in it

Order · Monthly care planAs the processor sees it

Product name: Monthly care plan
Statement descriptor: Brand name and support contact
Metadata: Order ID, patient ID only
Receipt email: Amount, date, link to the patient portal
Dispute evidence: Consent, delivery, terms accepted

Illustrative record, not real data.

What the processor sees: enough to bill and to win a dispute.

Illustrative example.

For disputes specifically, see telehealth chargebacks: you can win most cases with consent and delivery records, without medical files.

Ad pixels: where telehealth brands got in trouble

The FTC's two telehealth cases are about advertising data, not the card processor.

Cerebral (April 15, 2024)
A proposed order of more than $7 million; data of nearly 3.2 million consumers sent to third parties through tracking tools7.
Hims & Hers (July 29, 2026)
The FTC alleges sharing of health data "with third-party advertising platforms such as Meta and Snap"; the case is ongoing and these are allegations8.

Pixels and conversion APIs on intake and checkout pages need the same review as your payment fields. The setup side: server-side tracking for telehealth companies.

How Tagada helps

Payment security for a telehealth brand

TagadaPay handles the payment side with security built in: PCI DSS Level 1, SOC 2, ISO 27001 and GDPR, and "enhanced review for regulated verticals"11.

Fraud and security: "Native 3DS2, device intelligence, and rules engine: approve real customers, block the rest"
Your vault, portable: "Switch processors without re-onboarding customers"
Server-side tracking for Meta (Conversions API), so you control what each event sends
24/7 human support on Slack Connect

Building the whole telehealth brand? With Tagada Rx, "Tagada never persists PHI": identity and intake answers go to the clinical network, Tagada keeps routing data only (IDs, statuses, timestamps), and emails are content-free9. US patients only, by selection10.

Tagada follows Visa and Mastercard rules and the laws that apply to payments.

Apply for processing

Updated on November 2, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

Is Stripe HIPAA compliant?

HIPAA's section 1179 exempts payment processing, so a processor doesn't need to be "HIPAA compliant" to take card payments for care. Stripe's contract says users "must not provide Protected Health Information to Stripe". Keep treatment details out of product names, descriptors and metadata.

What is the HIPAA payment processing exception?

It's section 1179 of HIPAA. It says the law does not apply to entities "authorizing, processing, clearing, settling, billing, transferring, reconciling, or collecting payments" for a financial institution, including card payments for health care. It covers payment activities only, not extra services.

Does HIPAA apply to billing information?

Billing records held by a covered entity can be PHI. The card transaction itself, processed by a financial institution, falls under the section 1179 exemption. The risk is adding clinical details to payment data, which turns a payment record into a health record.

When does a payment vendor need a BAA?

When it does more than process payments and handles PHI for a covered entity: a billing platform storing diagnoses or visit dates, a collections service, a patient portal. A processor that only moves money generally doesn't.

My telehealth brand is cash-pay. Am I still covered?

Maybe not by HIPAA, depending on your structure. But the FTC's Health Breach Notification Rule covers health record vendors outside HIPAA, and the FTC Act covers data sharing with advertisers.