All tools / Payments and accounting
Is Square HIPAA compliant?
Checked 6 Nov 2026 from 2 vendor sources
Square’s terms say a HIPAA covered entity or business associate whose use of Square has it handle PHI agrees to Square’s BAA, which applies only where Square acts as its business associate. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Not all Square services are HIPAA-enabled, and Square need not identify which are. Customers must decide whether a service suits PHI. | Not covered |
| Square services where Square acts as a business associate, with Square Appointments and Invoices named as examples | Covered |
What the BAA leaves out
- Square Buyer Services such as Square Go, Square Profile, Square Pay and Square Local Offers
- Information exempt under Section 1179 of the Social Security Act or otherwise not regulated under HIPAA, per Square’s BAA wording on PHI
How to get the BAA
No signature step is described; Square says eligible account owners agree to the HIPAA BAA, published at squareup.com/legal/hipaa, through their use of Square services with PHI.
What the vendor says to do
- Review the HIPAA BAA before use
- Decide whether and how to use each service with PHI, including buyer features and customer messaging tools
- Use safeguards against unauthorized use or disclosure of PHI
- Document why encryption is not reasonable if sending PHI unencrypted, with equivalent measures where appropriate
What we couldn’t confirm
Square says it may, but need not, identify which services are HIPAA-enabled, so confirm your specific product with Square.
Proof from the vendor
- HIPAA Business Associate AgreementScope, Buyer Services exclusion, customer obligations; last updated 16 March 2026
- Comply with Square’s HIPAA requirementsWho the BAA applies to and how agreement occurs
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.