All tools / Payments and accounting
Is PayPal HIPAA compliant?
Checked 6 Nov 2026 from 5 vendor sources
No PayPal statement on a BAA was found; its Invoicing terms bar HIPAA-regulated users from using Invoicing in a way that makes PayPal handle PHI for them. The vendor’s position isn’t clear enough to rely on. Treat it as unsafe for patient data until the vendor confirms in writing.
| Plan or product | BAA |
|---|---|
| PayPal Invoicing, for use that would have PayPal create, receive, maintain or transmit PHI | Not covered |
What the BAA leaves out
- PayPal Invoicing with PHI
What we couldn’t confirm
The restriction applies to PayPal Invoicing, and we found no statement about patient data in other PayPal products. We offer no view on how HIPAA treats payment processing.
Proof from the vendor
- Invoicing Terms and ConditionsCovenant by HIPAA covered entities and business associates not to use Invoicing with PHI
- Acceptable Use PolicyTelemedicine, prescription and medical services need pre-approval; no HIPAA or PHI mention
- PayPal Data Protection Addendum for Business Management ProductsNo HIPAA, PHI or BAA mention
- PayPal User AgreementNo HIPAA, PHI or BAA mention
- Payment Services Agreement (Braintree)No HIPAA, PHI or BAA mention
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.