Payment apps and HIPAA: what each vendor says

Vendors treat payment data differently from other patient data, and most say little about it. We report what they publish and offer no view on how HIPAA treats payment processing.

Square’s terms say a HIPAA covered entity or business associate whose use of Square has it handle PHI agrees to Square’s BAA, which applies only where Square acts as its business associate.

Covered: Square services where Square acts as a business associate, with Square Appointments and Invoices named as examples.

Left out: Square Buyer Services such as Square Go, Square Profile, Square Pay and Square Local Offers, and more.

No PayPal statement on a BAA was found; its Invoicing terms bar HIPAA-regulated users from using Invoicing in a way that makes PayPal handle PHI for them.

Left out: PayPal Invoicing with PHI.

No Stripe statement on whether it signs a BAA was found; its Services Agreement says users must not provide PHI to Stripe, in a section about third-party data.

Left out: PHI provided as third-party data under Section 4.5 of the Stripe Services Agreement.

No Venmo statement on HIPAA, PHI or a BAA was found on the pages read.

We found no Zelle statement on HIPAA, PHI or a BAA, including in its User Service Agreement, which says the service is for personal use except eligible small businesses at certain institutions.

Intuit says QuickBooks Online is not compliant with HIPAA’s privacy standards and doesn’t recommend entering individually identifiable health information. Its page doesn’t mention a BAA.

Before you choose

• Confirm the BAA covers your exact plan and every feature you’ll use.
• Get the BAA signed before any patient data goes in.
• Turn on the settings the vendor requires, and train your staff on them.