Is Stripe HIPAA Compliant?Taking Payments on a Medical Website

Only if the practice keeps health information out of Stripe. Stripe can process card payments for a medical practice, but Stripe's own terms tell customers not to send it protected health information (PHI). We read Stripe's Services Agreement, Stripe's healthcare payments page and HHS guidance on October 13, 2026. We did not find a Stripe page that offers a Business Associate Agreement (BAA).

Stripe and HIPAA at a glance

• Stripe's Services Agreement says: "User must not provide Protected Health Information to Stripe as part of Third Party Data."
• The Stripe pages we checked do not offer a BAA.
• HHS says a BAA is not required when a financial institution processes payment card transactions for health care.
• That exemption covers the payment. It does not cover extra health details a practice adds to a charge.
• Safe use means sending Stripe only payment data: name, amount, card and billing details.

Does Stripe sign a BAA?

We could not confirm that Stripe signs a BAA. On October 13, 2026, we checked the Stripe Services Agreement and Stripe's article on healthcare payment processing. Neither page offers a BAA. The healthcare article says a payment system should be "able to support local privacy requirements, such as the Health Insurance Portability and Accountability Act (HIPAA)." That is general advice, not a BAA offer.

The Services Agreement is direct. Section 4.5 states: "User must not provide Protected Health Information to Stripe as part of Third Party Data." The agreement uses the HIPAA definition of PHI from 45 CFR §160.103.

Why can a practice take card payments without a BAA?

HHS lists payment processing as a case where a BAA is not required. The HHS business associates guidance says no BAA is needed "When a financial institution processes consumer-conducted financial transactions by debit, credit, or other payment card," clears checks or transfers funds "for payment for health care or health plan premiums."

HHS explains that in these cases the institution "is not performing a function or activity for, or on behalf of, the covered entity." The bank or processor is moving money. It is not doing health care work for the practice.

The limit matters. The exemption covers the payment itself. A charge description that names a diagnosis, a drug or a type of visit adds health details that the payment does not need.

What counts as PHI in a Stripe payment?

Stripe's agreement uses the HIPAA meaning of PHI in 45 CFR §160.103. In short, PHI is health information linked to a person. A patient's name plus an amount is payment data. A patient's name plus "anxiety therapy session" is health information. The table shows common Stripe fields and the risk in each.

How do you set up Stripe safely on a medical website?

Stripe's agreement states that "User is liable for any disclosure of Protected Health Information to Stripe." The setup is the practice's job. Follow these steps before you take the first payment.

1. 1

   Rename products and prices

   Replace any service name that reveals a condition with a neutral label or an invoice number.

2. 2

   Strip metadata

   Check every integration that writes metadata to Stripe. Remove diagnosis codes, visit reasons and provider specialties.

3. 3

   Separate the form from the payment

   Collect intake details in a form tool covered by a BAA. Send only the amount and billing details to Stripe.

4. 4

   Review receipts and invoices

   Edit Stripe's receipt and invoice templates so they show amounts, not services that reveal health details.

5. 5

   Check tracking on the payment page

   Make sure ad and analytics scripts on the checkout page do not capture page titles or form fields that reveal a condition.

What about the forms and pages around the payment?

The risk often sits next to Stripe, not inside it. A booking page titled "Pay for your ADHD assessment" can leak the condition to analytics tools, even if Stripe receives only the amount. HHS defines a business associate as a party that performs functions "that involve creating, receiving, maintaining, or transmitting PHI." A form tool that collects symptoms falls into that group and needs a BAA.

Read our guides on HIPAA compliant online forms and tracking on medical websites before you launch a payment page. Run The Webpatch Tracker Check on the page to see which scripts load.

How Webpatch helps

Webpatch builds and secures websites for healthcare practices. For online payments, we:

• Set up Stripe checkout with neutral product names and no health metadata.
• Connect intake forms to tools that sign a BAA.
• Audit tracking scripts on booking and payment pages.
• Document the setup for your HIPAA records.

We are not a law firm. We handle the technical setup and can work with your compliance advisor. Contact Webpatch to review your payment flow.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.