Healthcare payment processing
Secure, reliable payment solutions for healthcare providers that protect patient data, reduce compliance risks, and streamline your payment operations. Card payments are exempt from HIPAA's privacy rules, so the real job is keeping patient health information out of your payment flow, and we build that into your setup from day one.
Apply in 60 seconds
Tell us about your practice. It's free to apply.
Your information is encrypted & never shared.
Understanding secure payment solutions for healthcare providers
HIPAA compliant payment processing refers to payment solutions designed to keep Protected Health Information (PHI) safe wherever it touches a payment. Section 1179 of the Health Insurance Portability and Accountability Act (HIPAA) exempts the act of authorizing, processing and settling card payments, so your processor isn't a business associate just for running payments, and you don't need a Business Associate Agreement (BAA) for that alone.
What HIPAA still covers is the health information around the payment: patient statements, receipts that list services, your patient portal and the records you send to fight a chargeback. Keeping diagnoses and drug names out of payment data, and card data protected under PCI DSS, is what makes healthcare payment processing compliant.
From single-doctor practices to telehealth platforms and medical billing companies, we set up payment processing for every kind of healthcare business.
Medical practices & clinics
Doctors, specialists and urgent care
MCC 8011
Telehealth providers
Virtual visits, memberships and prescriptions
MCC 8099
Mental health professionals
Therapists, counselors and group practices
Dental practices
General dentistry and orthodontics
MCC 8021
Hospitals & health systems
Patient balances and cafeterias
MCC 8062
Medical & dental labs
Testing and lab services
MCC 8071
Chiropractors & therapy
Chiropractic, PT and wellness care
MCC 8041
Eye care
Optometrists and ophthalmologists
MCC 8042
Pharmacies
Retail, online and mail-order
MCC 5912
Medical billing & healthcare SaaS
Billing companies and patient payment platforms
Healthcare providers use the code for their specialty, like MCC 8011 for doctors and 8099 for other health practitioners. See our telehealth, pharmacy and medical billing pages for those industries.
The comparison that matters isn't "HIPAA processor vs. standard processor." It's which parts of the payment touch health information.
| Covered by HIPAA? | What to do | |
|---|---|---|
| Authorizing and settling card payments | No, exempt under Section 1179 | Protect card data under PCI DSS |
| Card statement descriptor | A diagnosis there exposes the patient | Show the practice name and phone only |
| Patient statements and itemized receipts | Yes, when they show services | Send them through your HIPAA-covered systems |
| Patient portal and EHR | Yes | Use vendors that sign a BAA, with a tokenized payment page |
| Chargeback evidence | Yes, if you send medical records | Send the minimum needed to prove the charge |
| Business Associate Agreement | Not needed for payment processing alone | Needed for vendors that handle PHI |
Our payment processing implements multiple layers of protection designed for healthcare organizations. Patient payment information stays secure through end-to-end encryption, tokenization and strong access controls that stop unauthorized data exposure. Thorough audit logs track system access and activity, so you can document how payment data is handled.
Our payment solutions integrate with your existing healthcare infrastructure, including EHR systems, practice management software and patient portals. Staff can take payments inside familiar systems, eliminating duplicate data entry, and patients get convenient payment options in the portal they already use.
Detailed activity reports track user access to payment information, and transaction reports keep clear records of every payment. Payment processing alone doesn't need a BAA, so we help you work out which of your vendors do, like portals and billing companies that handle patient records.
Accept payments in person at your facility, through a secure patient portal, by phone with a virtual terminal, or through recurring billing for treatment plans. Every channel uses the same security controls, and none of them needs health details to run a payment.
Card payments are exempt, but health information can still slip into the payment flow, and that's where data breaches start. These are the places to check.
Use your practice name and phone number. A specialty, drug name or condition on a card statement tells anyone who reads it why the patient paid.
Payment receipts don't need diagnosis or procedure codes. Itemized statements that show services are PHI, so send them through your HIPAA-covered systems.
Use a tokenized payment page so card numbers never land in your EHR, and a portal vendor that signs a BAA for the health records it holds.
To win a dispute you need proof of the visit and the patient's consent to pay, not the medical record. Send the minimum needed.
Take card details in a virtual terminal, never on paper or in chart notes, and never store the card security code.
They work for a small practice taking copays at the desk. Telehealth, prescriptions and recurring patient plans are where their rules start to bite.
| Stripe, Square & PayPal | Adaptiv merchant account | |
|---|---|---|
| Telehealth & prescriptions | Stripe restricts both, PayPal needs pre-approval | Underwritten for healthcare before you go live |
| Statement descriptor | Generic or platform name | Your practice name, no health details |
| Patient payment plans | Basic subscriptions | Recurring plans with stored-card consent |
| Your account | Pooled under the aggregator | Your own merchant account and MID |
| Chargeback tools | Basic dispute handling | Alerts, RDR and 3D Secure set up for you |
| Support | A ticket queue | A dedicated account manager |
Payment setups that keep health information out of descriptors, receipts and payment data, with administrative, technical and physical safeguards around card data.
Patient payment data is encrypted at every step, from the moment of capture through transmission and storage.
Connect payments to your healthcare software, EHR systems, patient portals and practice management tools.
Payment processing alone doesn't require a BAA. We help you map which of your vendors handle PHI and need one.
Logs of transactions and payment data access, so you can show how payment information is handled.
Our support team is available around the clock to help with questions about your healthcare payment processing.
Tailored payment processing options to meet your healthcare organization's needs.
Get started with healthcare payment processing in a few steps. We review your practice, set up your payments and show your team how to keep patient information out of them.
Business registration & EIN
Plus your business license
Government-issued photo ID
For owners with 25% or more
Provider licenses
Medical, dental or professional licenses
Bank & processing statements
Recent business bank and processing statements
Your website or portal
Pricing, refund policy and contact details
Payment channels
In person, portal, phone or recurring plans
Initial assessment
We evaluate your healthcare organization's payment needs and where payments touch patient information, to design the right setup for your practice.
Underwriting
We review your application and match you with a bank that approves your specialty, in a few business days for most practices.
Secure integration
Our team sets up your payment processing, connects it to your healthcare software and sets descriptors and receipts without health details.
Staff training
We train your team on the payment system and on keeping patient information out of payment data, with ongoing support for any questions.
Healthcare payments sit under two sets of rules: HIPAA for patient information and PCI DSS for card data. Banks also watch your disputes.
Authorizing, processing and settling card payments is exempt from HIPAA, so payment processing alone doesn't need a BAA.
Card data follows PCI DSS. Tokenization keeps card numbers out of your EHR and your PCI scope small.
Portals, billing companies and software vendors that handle patient records need a BAA.
Your practice name and phone number on statements, never a diagnosis or treatment.
Get written consent to store a card and charge it on a schedule, and send receipts after each payment.
The Department of Health and Human Services enforces HIPAA with penalties tiered by culpability and adjusted for inflation every year.
Discover why healthcare organizations trust Adaptiv for their payment processing.
“Adaptiv's payment processing system resolved our compliance concerns while providing patients with an easier payment process. The system connected to our EHR without any issues and their support team demonstrates healthcare expertise.”
“As a telehealth provider, we needed a payment solution that worked seamlessly with our virtual care platform while keeping patient information private. Adaptiv delivered exactly what we needed, and our patients love the convenient payment options.”
“The detailed reporting and audit trails have made our audits much smoother. Their system gives our compliance officer what they need to verify we're handling patient payment information properly.”
Card payment processing itself is exempt from HIPAA under Section 1179, so compliance comes from how you handle the health information around it: no diagnoses or treatments in descriptors, receipts or payment notes, card data tokenized and protected under PCI DSS, strict access controls and audit logs, and BAAs with the vendors that do handle patient records.
Not to the payment itself. Section 1179 of HIPAA exempts authorizing, processing, settling and clearing card payments. HIPAA still applies to your patient records, statements and portal, and anything health-related you add to a payment.
Payment processing alone doesn't require one, because of the Section 1179 exemption. If your setup has us handling patient information beyond the payment itself, talk to us about your situation. Your portal, EHR and billing vendors are the ones that usually need a BAA.
Through encryption in transit and storage, tokenization that replaces card numbers with secure tokens, access controls and audit trails, and payment records that leave out health details entirely. That covers both HIPAA's concern with patient information and PCI DSS's rules for card data.
HHS uses four penalty tiers based on how much the organization knew and whether it corrected the problem, and the amounts are adjusted for inflation every year. Payment processing is exempt, but a diagnosis on a receipt or descriptor can still count as a disclosure.
As far as HIPAA goes, you can use any payment processor. Many practices still move to a dedicated merchant account because telehealth, prescriptions and recurring patient plans are restricted by aggregators like Stripe and PayPal, and because they want descriptors, receipts and portals set up without health details from the start.
Payment gateways fall under the same Section 1179 exemption, so a HIPAA compliant payment gateway really means one that keeps PHI out of the transaction: tokenized card storage, no diagnosis or treatment fields, and payment pages that sit outside your EHR. Ours is set up that way, with PCI DSS compliant data security.
Yes. Our payment solutions are designed to integrate with major Electronic Health Record (EHR) systems and practice management software, using tokenized payment pages so card numbers never sit in your EHR.
Credit and debit cards, ACH and eCheck payments, digital wallets like Apple Pay and Google Pay, HSA and FSA cards, and recurring payment plans, all with the same security controls.
Yes. HSA and FSA cards work at medical providers like doctors, dentists and clinics. Pharmacies and retailers that sell a mix of items need an inventory approval system (IIAS) to accept FSA cards; see our pharmacy merchant account page.
Yes. Get the patient's written consent to store their card and charge it on a schedule, show the amount and dates, and send a receipt after each payment. Stored cards are tokenized, so your staff never see the full number again.
Yes. Therapy practices, counselors and mental health clinics are approved, including group practices and online therapy. Clients can pay by card, HSA or FSA card or ACH payments, and the descriptor shows your practice name, not the type of care.
Yes. We approve telehealth providers, including memberships, prescriptions and GLP-1 programs. See our telehealth merchant account page for the details.
Usually a few business days once we have your documents. Telehealth platforms and online pharmacies can take a little longer because the card networks require extra registration.
Often, yes. Many healthcare businesses come to us after an aggregator froze their account during a review. We look at why it happened and what's changed. We also work with merchants on the MATCH list.
Train staff to take card details only through the payment system, never on paper or in chart notes, and to leave health details out of payment notes and receipts. Role-based access, automatic timeouts and audit logging back that up.
Visa's VAMP program flags merchants at a 1.5% fraud-and-dispute ratio with at least 1,500 disputes and fraud reports in a month, and Mastercard starts at 1.5% and 100 chargebacks. Banks act well before that, so aim to stay under 1%.
More tools that come with a high-risk merchant account.
Complete the form below to get started. Our healthcare payment specialists will review your information and contact you shortly.
