Last verified: October 22, 2026, against Stripe's Services Agreement, pricing page, healthcare guide and developer docs. General information, not legal advice.
Is Stripe HIPAA compliant? Stripe doesn't publish a business associate agreement (BAA) or a HIPAA program on any page we could find, and its Services Agreement tells users not to hand it protected health information through connected third-party data. That doesn't rule Stripe out for a practice. Taking a card payment for a visit is the kind of activity HIPAA's payment-processing exception was written for; the risk sits in what you type around the payment. About 140 people a month in the US search this question (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
Short answer from Stripe's own documentation
Short answer (verified October 2026): We found no Stripe BAA. Stripe's Services Agreement (opens in a new tab) (last modified September 28, 2026) says: "User must not provide Protected Health Information to Stripe as part of Third Party Data," meaning data Stripe pulls from your other service providers. Stripe's own healthcare payments guide (opens in a new tab) says a compliant setup may require a BAA and adds: "Not every payments provider will do this: confirm before you commit to an integration."
Two more Stripe pages matter for practices:
- Stripe Identity lists "Processing Personal Health Information (PHI) by a HIPAA-covered entity" as an unsupported use (Stripe Identity use cases (opens in a new tab)). Don't use it to verify patients.
- Telehealth needs review. Stripe's restricted businesses list (opens in a new tab) includes "Telemedicine and telehealth services," which "require additional due diligence by Stripe in order to confirm our ability to support them."
What HIPAA requires before patient information goes in
The default rule: a vendor that will "create, receive, maintain, or transmit protected health information" for your practice needs documented "satisfactory assurance" in a written contract (45 CFR 164.502(e) (opens in a new tab)) that meets 45 CFR 164.504(e) (opens in a new tab). That's a BAA, explained clause by clause in our guide to business associate agreements.
Where card payments fit: section 1179
Payment processing has its own carve-out. Section 1179 of the Social Security Act, added by HIPAA in 1996 (42 U.S.C. 1320d-8 (opens in a new tab)), says HIPAA's administrative simplification rules "shall not apply" to an entity "to the extent" it is doing the work of a financial institution, or "authorizing, processing, clearing, settling, billing, transferring, reconciling, or collecting payments, for a financial institution." It names payments for health care made "by any means, including a credit, debit, or other payment card."
Charging a patient's card for a visit is the kind of activity the statute describes. Stripe doesn't cite the exception on the pages we read; this is how the law reads, not Stripe's stated position.
What section 1179 doesn't cover:
- Your practice. The exception is for the entity doing payment work "with respect to such activities." Your practice remains a covered entity, and payment disclosures aren't exempt from the minimum necessary standard in 45 CFR 164.502(b) (opens in a new tab).
- Extra detail. A diagnosis in a product name or a visit reason in metadata isn't needed to authorize a charge. Sending it is your disclosure to justify.
- Non-payment features. Identity verification, connected data from other providers and anything else beyond moving money need their own analysis, and Stripe's terms already rule some out.
If patients reach your payment link from your website, check what else loads on those pages. The free marketing audit flags privacy risks such as ad pixels on patient forms.
Which Stripe plans a BAA can cover
Stripe's pricing page (opens in a new tab) lists standard pricing of "2.9% + 30¢" per successful domestic card transaction with "No setup fees, monthly fees, or hidden fees." We found no tier, add-on or contract option on Stripe's public pages that adds a BAA. If someone says Stripe signed one for them, ask to see it.
Descriptions, metadata and receipts
Here's where the text you write ends up:
| Field | Who sees it | What to put there |
|---|---|---|
| Product name | The patient: Stripe says "Checkout, Payment Links, and invoices display the Product name for each line item" (products and prices (opens in a new tab)) | "Office visit," "Balance payment," or your practice name |
| Description | Can be shown to customers; Stripe's metadata docs (opens in a new tab) point to description for that | An invoice or statement number from your practice management system |
| Metadata | Your team and connected systems (the API returns it only with your secret key); it "isn't visible to your customers unless you choose to show it" | An internal ID only |
| Email receipt | The patient's inbox (Stripe receipts (opens in a new tab)) | Inherits the fields above |
Stripe's docs say: "Never store sensitive information, such as bank account information or credit card details, to metadata." Apply the same rule to clinical details. Metadata travels to your webhooks and any connected tools, so a diagnosis code placed there spreads.
Illustrative example: A men's health clinic sells a Payment Link product called "ED treatment, 3-month plan." The patient's receipt, their email inbox and anyone reviewing the Stripe dashboard now see it. Renamed "Treatment plan, 3 months," with the plan details kept in the EHR, the same payment reveals far less.
For sensitive specialties, also check the business name that appears on patients' card statements.
Safe uses and unsafe uses for a practice
Safe: card payments for visits, copays and balances with neutral product names; payment links that reference an invoice number; recurring billing for a membership described generically.
Use care: telehealth practices (expect Stripe's extra due diligence); custom integrations where a developer controls what goes into descriptions and metadata.
Unsafe: treatment or diagnosis names in products; visit reasons or codes in metadata; Stripe Identity for patient verification; connecting a data source that would pass PHI to Stripe.
Safer setup or alternatives
- Audit your Stripe product catalog and rename anything clinical. Stripe archives rather than deletes products and keeps archived ones "indefinitely to maintain records of past transactions," so fix names before the next charge, not after.
- Ask your developer to put only internal IDs in descriptions and metadata, and to document it.
- Turn on automatic receipts only after checking what they display.
- Keep the link between payment and visit in your EHR or practice management system.
Comparing processors? Read our Square verdict, which covers a vendor that does publish a BAA, and our PayPal and Venmo verdict. The HIPAA and marketing software hub has the rest.
Medfy doesn't sell Stripe or process payments. Its website analytics count calls, forms and bookings while ad platforms never receive patient data, and submissions from its HIPAA-compliant forms and chat sit in separate, encrypted HIPAA databases in the US or Canada under the BAA Medfy signs with each practice. See how Medfy handles patient data.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Frequently asked questions
Will Stripe sign a BAA?
We found no BAA on Stripe's public legal, pricing or healthcare pages as of October 2026. Stripe's own healthcare guide warns that not every payments provider will sign one and tells businesses to confirm before integrating. Its Services Agreement says users must not provide protected health information to Stripe as part of third-party data. If your setup needs a BAA, ask Stripe directly and get the answer in writing.
Is the free version of Stripe HIPAA compliant?
Stripe has no free tier to compare. Its standard pricing is per transaction, 2.9% plus 30 cents for domestic cards as of October 2026, with no setup or monthly fees, and we found no plan that adds a BAA. Card processing is the kind of activity HIPAA's payment-processing exception describes; what matters is keeping clinical details out of product names, descriptions, metadata and receipts.
Can a practice use Stripe without patient information?
Yes, and that's the safe way to use it. Charge for a neutral item such as "Office visit" or "Payment to Riverside Family Medicine," put only an internal invoice number in the description or metadata, and keep diagnoses, procedures and appointment reasons in your EHR. The patient's name and card details are still needed to process the payment; nothing more should travel with it.
What is a HIPAA-compliant alternative to Stripe?
For patient payments, many practices use the payment feature built into their practice management or EHR system, which can tie a payment to a visit under the BAA you already have. Square publishes a BAA that names its Appointments and Invoices features. Whatever you choose, compare vendors on the BAA for your plan and on what patient details each feature stores.