Is Stripe, Square, PayPal, Venmo or Zelle HIPAA Compliant? Payment Processing and HIPAA

Processing a patient's payment is generally exempt from HIPAA's business associate rules. A plain card charge through a processor usually does not require a BAA. HIPAA applies again when health details travel with the payment: a memo that names the therapy, an invoice that lists a procedure, or a booking app that stores client notes. Whether Stripe, Square, PayPal, Venmo or Zelle works for your practice depends on the features you use and what staff type into them. This page checks each vendor and turns the results into rules the front desk can follow. Confirm your final setup with your privacy officer or counsel.

Short answer: which payment tools can a practice use?

Vendor policies change. Every cell below must be confirmed against the vendor's current published terms before publication.

Record the date you review each vendor's terms, and recheck them periodically.

Tool	Basic transaction covered by the payment processing exemption?	BAA offered?	Practical verdict
Stripe (payments)	Generally, for the transaction itself	Confirm in writing with Stripe, including which products are covered	Usable for bare transactions; keep visit details out of descriptions and metadata unless a BAA covers them
Square (card payments)	Generally, for the transaction itself	Confirm in writing with Square	Usable for card charges with generic descriptions
Square Appointments	Booking, client notes and intake data go beyond the transaction	Confirm in writing with Square	Don't store client notes or intake details unless a signed BAA covers them
PayPal (checkout and invoicing)	Generally, for the transaction itself	Confirm in writing with PayPal	Usable for transactions; keep invoice line items generic
Venmo (personal)	Generally, for the transaction itself; check personal-account terms on business use	Confirm with Venmo	Highest risk; check terms, turn off public visibility, keep memos generic
Venmo for Business	Generally, for the transaction itself	Confirm with Venmo	Transactions only; turn off public visibility, keep memos generic
Zelle	Generally, for the transfer itself	Confirm with your bank	Transfers only; keep memos generic and check your bank's business terms

The one-sentence rule: processing a payment is generally exempt, but adding health details to the payment or using the vendor's scheduling, client notes or intake features is where HIPAA applies.

No payment vendor is "HIPAA compliant" for every use. A processor can be acceptable for a $150 copay charge and still be the wrong place to store a client's intake answers. The vendor's policies matter. So does how your staff use the tool.

How HIPAA treats payment processing

Normally, when a vendor handles protected health information (PHI) for a covered entity, the vendor is a business associate. The practice needs a signed business associate agreement (BAA) before sharing PHI with that vendor.

Payment processing is the main exception. Section 1179 of HIPAA generally excludes financial institutions processing payments for health care from HIPAA's requirements, so they are generally not business associates for that activity.

What the exemption covers: the core activities of moving money. That means authorizing, processing, clearing, settling, billing, transferring or collecting a payment.

What it does not cover:

• Diagnosis codes, procedure names or service descriptions attached to the payment
• Appointment details such as date, provider and visit type
• Clinical notes, intake answers or client records stored in the vendor's system
• Extra services the vendor performs beyond the transaction, such as scheduling, reminders, CRM or analytics on patient data

Here is why this matters in practice. A front desk coordinator swipes a card for "$40.00, Professional services." That is a payment, and the processor's role in it is generally exempt. The same practice might also use the processor's booking app, where each client record says "Initial eval, lower back pain, referred by Dr. Patel." That app is storing PHI. The exemption does not reach it.

Stripe, Square, PayPal, Venmo and Zelle checked one by one

Stripe

Stripe's core card processing is the kind of activity the exemption was written for. Stripe also sells products beyond processing, including invoicing, customer records, billing and stored metadata. Any field your integration fills with visit details becomes data Stripe holds.

Check three things:

• Whether Stripe signs a BAA, and for which products.
• Whether Stripe's terms or restricted businesses list place conditions on healthcare merchants.
• What your developer or website plugin sends to Stripe in descriptions and metadata. Product names like "Couples counseling – 50 min" are a common leak.

Square and Square Appointments

Square card payments and Square Appointments are different risk profiles.

• Square payments: a card tap or swipe at the front desk. The transaction itself is generally exempt.
• Square Appointments: booking, client profiles, client notes, intake details and appointment reminders. These store information about who is being seen, when and often why. This goes beyond the transaction.

Before a practice relies on Square Appointments, confirm Square's position in writing. If Square will not sign a BAA, keep client notes, service names that reveal care, and intake details out of it.

PayPal

PayPal standard checkout and PayPal invoicing are both common in small practices, especially for self-pay therapy clients. The transaction is one issue. The invoice is another. An invoice with the line item "Psychotherapy, 60 min, CPT 90837" sends PHI through PayPal and into the patient's email inbox.

Confirm PayPal's current HIPAA and BAA position, and how invoice data is stored and shown, before sending invoices to patients.

Venmo and Venmo for Business

Venmo carries the most avoidable risk. It was built around a social feed. Depending on account settings, transactions and their notes can be visible to other users.

Points to confirm:

• Whether Venmo's personal-account terms allow receiving payments for business services.
• How Venmo for Business profiles differ in visibility and terms.
• Whether any BAA is available.

The memo field is the real problem. Patients often fill it in themselves with things like "therapy 3/12" or a brain emoji, and that note may be visible to others. Even when the transaction is exempt, a visible memo describing care exposes information about the patient.

Zelle

Zelle is a bank-to-bank transfer network. Patients and practices reach it through their own banks. In most cases the practice's agreement is with its bank, not with Zelle directly.

Points to confirm:

• Your bank's terms for business use of Zelle, including limits and whether a business account is required.
• The memo field. As with Venmo, it is the main place health details end up. "Copay for Dr. Kim, knee MRI follow-up" is a payment plus PHI.

When a payment workflow does need a BAA

The exemption stops at the transaction. You likely need a BAA, or need to keep PHI out of the tool entirely, in these situations:

• The vendor stores PHI beyond the payment. Examples include booking calendars, client records, intake forms, session notes, and automated reminders that mention the visit type or provider. Square Appointments and similar booking features belong here. See HIPAA-compliant scheduling for how to check them.
• Invoices or payment links reveal the service or condition. "Invoice #1048, Professional services" is generic. "Invoice #1048, Suboxone induction visit" is not.
• Payment forms on your website also collect health information. A checkout form that asks "Reason for visit" or "Current medications" next to the card field sends PHI to whichever form or website vendor runs it. See Wix, Squarespace, Shopify and HIPAA for the website side.
• You are considering a healthcare-specific payment platform. Some platforms built for practices offer a BAA as an option. Evaluate each against its current written policy.

If a vendor will not sign a BAA, the rule is simple. Use it only for the bare transaction, and keep every piece of PHI out of it.

Front desk and billing rules for patient payments

These rules belong in your front desk binder and new-hire training.

Use generic descriptions everywhere.

Instead of	Write
"EMDR session – trauma, Dr. Lee"	"Professional services – Invoice #2231"
"Physical therapy, post-op ACL"	"Visit balance – Account #5590"
"Psychiatric med management"	"Professional services"

Keep memo fields empty or generic. Never put health details in Venmo, Zelle or PayPal memos. If you accept these methods, tell patients what to write, for example "Invoice 2231." Turn off public visibility wherever the setting exists.

Take card details only through the processor's secure flow. That means the card reader, a hosted payment page or the processor's payment link. Do not accept card numbers, photos of cards or payment screenshots by text, email or personal messenger, and do not write them on sticky notes.

Check what shows up on bank statements and receipts. A patient's statement or receipt can reveal sensitive care through the merchant name or descriptor. One example is a business name that includes "Addiction Recovery" or "Fertility." Review your statement descriptor and receipt template.

Write down who can do what. Keep a short policy listing:

• The approved payment tools
• Which tools patients may use, and which features (booking, notes, reminders) are turned off
• Who can issue refunds and adjustments
• Where payment questions are discussed internally

Train every new front desk and billing hire on it during their first week.

HIPAA vs PCI DSS: two different rulebooks

HIPAA protects health information. PCI DSS protects cardholder data. They are separate frameworks with separate requirements.

• A processor can be PCI DSS compliant and still not sign a BAA.
• A vendor can sign a BAA and still leave the practice with PCI obligations.
• With a hosted processor, card data goes straight to the processor. The practice's PCI scope is usually smaller, often handled through a self-assessment questionnaire, but it is never zero.

Don't present a vendor's PCI compliance as evidence that it handles PHI properly. Don't present a BAA as evidence that card data is secure.

Questions to ask before choosing a payment processor

Send these to the vendor's sales or compliance team and keep the written answers on file:

1. Will you sign a BAA? Which products and features does it cover?
2. What data do your scheduling, invoicing, CRM or reminder features store, and can we turn them off?
3. Who can see transaction memos, customer notes and payment history, both on our staff and on yours?
4. Can we control statement descriptors and receipt content?
5. What happens to stored customer data when we close the account, and can we export or delete it?

A vague answer to question 1 is useful information. Plan to keep the tool strictly to transactions.

Keeping billing conversations among staff off personal messengers

Your payment tool can be set up correctly while PHI still leaks somewhere else. Payment problems tend to get worked out in staff group texts. "Mrs. R's card declined again for her Thursday PT, can someone call her?" is a declined card, a patient name and a visit type in a personal messenger with no BAA. The same happens with refund requests, balance disputes and insurance-versus-self-pay questions.

Chanty is an internal staff workspace where front desk and billing can coordinate this follow-up. A message about a declined card can become an assigned task with an owner and a due date, so it doesn't sit unanswered in a group text. HIPAA with a signed BAA is available from the Business plan. The Free plan does not include a BAA. Read how Chanty handles HIPAA and the BAA or see HIPAA-compliant chat for staff.

Chanty is not a payment processor, does not take patient payments, and is not a patient messaging tool. Card numbers and payment credentials do not belong in staff chat either. Those stay in the processor's secure flow.

For the rest of your stack, see other popular tools checked for HIPAA. Payment exports and invoice records often end up in work apps like Notion, Airtable and Zapier or in cloud storage such as Dropbox and iCloud, so check those tools too.

FAQ

Is Venmo HIPAA compliant for therapists and small practices?

The transaction itself may fall under the payment processing exemption. The risks are the memo field, feed visibility and Venmo's terms on business use of personal accounts. If you accept Venmo, use a business profile where required, turn off public visibility, and ask clients to write only an invoice number.

Is Zelle HIPAA compliant if patients pay through their bank?

A Zelle transfer is a bank payment, which is the type of activity the exemption addresses. Your agreement is typically with your bank. The main risk is what patients or staff write in the memo.

Is Square HIPAA compliant, and is Square Appointments different from Square payments?

They are different. Card processing is generally exempt. Square Appointments stores bookings, client profiles and notes, which goes beyond the transaction. Confirm Square's current BAA position before storing any client details there.

Is PayPal HIPAA compliant for patient invoices?

The payment may be exempt, but invoice line items are not. Use generic descriptions such as "Professional services" and confirm PayPal's current position.

Does Stripe sign a BAA?

Check Stripe's current written policy, and ask which products any BAA would cover. Also check Stripe's restricted businesses list for healthcare conditions, and audit what your integration sends in descriptions and metadata.

Do I need a BAA with my credit card processor?

Not for basic transaction processing, in most cases. You likely do if the processor also stores PHI through booking, notes, intake or reminders. Confirm with your privacy officer or counsel.

What should I write in the memo or invoice description for a patient payment?

Something generic: "Professional services," "Invoice #2231" or "Account balance." Never include a diagnosis, procedure, therapy type or provider specialty.

Is PCI compliance the same as HIPAA compliance?

No. PCI DSS covers cardholder data. HIPAA covers health information. A vendor can meet one without the other.

Can patients pay with Venmo or Zelle if they choose to?

Many practices allow it. If you do, consider noting the patient's choice of payment method in your payment policy. Give patients clear memo instructions, and never confirm or discuss care details inside the app.

What makes a payment app HIPAA compliant?

No app is "HIPAA certified," because no such certification exists. Three things decide whether a payment workflow fits within HIPAA:

• Whether the vendor's role stays within the payment processing exemption
• Whether a BAA is signed for any feature that handles PHI
• Whether your staff keep health details out of memos, invoices and notes