HIPAA-Compliant vs. HIPAA-Exempt Payments: What Practices Should Know

When practices shop for a payment processor, they often hear that it's "HIPAA-friendly" or that HIPAA "doesn't apply" to payments. Both can be true, depending on what the processor actually does. The key distinction is between HIPAA-exempt and HIPAA-compliant payment processing.

What HIPAA-exempt means

HIPAA protects patients' health information. A payment processor that only handles financial data, such as charging a card or issuing a refund, generally isn't required to follow HIPAA rules, as long as it never accesses medical records or clinical information. That's why a standard card terminal can be used at a medical office: it's exempt because it stays out of anything clinical.

The trade-off is that a HIPAA-exempt processor can't safely connect to your practice software. It can't look up patients, post payments to a patient ledger, send a patient a text about their balance or keep a patient directory. Your staff has to bridge that gap by hand.

What HIPAA-compliant means

A payment platform that does handle protected health information, such as patient names tied to balances, appointment data or ledger postings, has to meet HIPAA's technical, administrative and physical safeguards. In practice, that means:

• Encrypting data in storage and in transit
• Restricting who can access it, with individual logins and permissions
• Securely storing and transmitting patient-identifiable information
• Signing a Business Associate Agreement (BAA) with the practice

Why it matters for your workflow

Being HIPAA-compliant is what lets a payment platform connect to your practice management system. Clover PracticePay is built this way, which is why it can post payments to the patient ledger, run a patient directory, send text-to-pay messages and power payment plans, all while protecting patient information.

Questions to ask any payment provider

1. Are you HIPAA-exempt or HIPAA-compliant?
2. Will you sign a Business Associate Agreement?
3. Do payments post to our PMS automatically, and how?
4. Where are card numbers stored, and are they tokenized?
5. Does every staff member get their own login?

General information only, not legal advice. Your practice is responsible for its own HIPAA compliance program.