All tools / Payments and accounting
Is Stripe HIPAA compliant?
Checked 6 Nov 2026 from 3 vendor sources
No Stripe statement on whether it signs a BAA was found; its Services Agreement says users must not provide PHI to Stripe, in a section about third-party data. The vendor’s position isn’t clear enough to rely on. Treat it as unsafe for patient data until the vendor confirms in writing.
What the BAA leaves out
- PHI provided as third-party data under Section 4.5 of the Stripe Services Agreement
What we couldn’t confirm
The clause sits in a section on data from third-party providers, so how far it reaches isn’t clear. We offer no view on how HIPAA treats payment processing.
Proof from the vendor
- Stripe Services Agreement, General TermsSection 4.5 bars providing PHI to Stripe and makes the user liable; Section 12 defines PHI by 45 CFR 160.103
- Healthcare Embedded Payments: A Guide for BusinessesGeneral note that some payment providers will not execute a BAA; no statement on Stripe’s own position
- Healthcare payment processing systems explainedMentions HIPAA generally; no Stripe commitment
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.