On this page
No, not as a place for health information. As of November 12, 2026, Stripe publishes no business associate agreement, its Services Agreement includes none, and that agreement tells users not to provide protected health information as third-party data. A cash-pay practice can still take consult and lab fees through Stripe, because HIPAA exempts payment processing. The condition is that the payment carries nothing clinical.
Checked November 12, 2026 on Stripe's Services Agreement (last modified September 28, 2026), its security page and its Identity documentation. We found no Stripe page that offers a BAA. Ask Stripe in writing if you need a firm answer for your account.
What does Stripe say?
Stripe has no HIPAA page. We looked in three places where one would show up:
- The Services Agreement. Section 4.5 says "User must not provide Protected Health Information to Stripe as part of Third Party Data," and makes the user liable for any such disclosure. We found no BAA in the agreement or among the documents it links to.
- The security page. It lists PCI Level 1, SOC 1 and SOC 2 reports, and other standards. HIPAA is not on the list.
- Stripe Identity. Its documentation lists "processing Personal Health Information (PHI) by a HIPAA-covered entity" as an unsupported use.
Stripe's own guide to healthcare payments says a payments provider "might" need to execute a business associate agreement and adds: "Not every payments provider will do this: confirm before you commit to an integration." It doesn't say Stripe will.
So we list Stripe as "no BAA" in our BAA table. That is based on what Stripe publishes. We haven't seen a statement from Stripe that it refuses every request.
Why can a practice still use Stripe?
HIPAA has a carve-out for payment processing. When a bank or card processor authorizes, clears and settles a payment, it isn't acting as your business associate, so no BAA is needed for that activity. Our longer guide, Stripe payment links in a medical practice, quotes the statute and the HHS rule.
The carve-out covers moving money. It doesn't cover storing a diagnosis in a product name. A payment for "Consult" from Dana R. is a payment. A payment for "Thyroid panel and hormone consult" from Dana R. tells Stripe, and everyone who sees the receipt, something about her health.
What may go into Stripe, and what to keep out
- Product and price names: "Initial consult," "Follow-up visit," "Lab fee," "Program, month 1." Not the condition, test or treatment.
- Descriptions and statement descriptors: your practice name and a generic item.
- Custom fields on payment links: none that ask about symptoms, goals or medications. Don't turn a checkout into an intake form.
- Metadata: an internal ID is fine. A note such as "labs abnormal, needs follow-up" is not.
- Receipts and emails from Stripe: payment details only. Next steps for care go out from your EHR or a tool under a BAA.
- Disputes: if a patient disputes a charge, don't upload chart notes as evidence. Send proof of the booking and the payment terms.
Where do practices slip up?
The checkout is usually clean. The leak is in what's connected to it. A common setup sends every Stripe payment through Zapier into a spreadsheet or a CRM, with the product name attached, so a VA can see who paid for what. If the product names are generic, that list is a list of payments. If they name programs, it's a list of patients by treatment, sitting in tools with no BAA. See Is Zapier HIPAA compliant?
The second slip is the subscription name. Monthly programs often get descriptive names so they are easy to tell apart in the dashboard. Use a neutral name the patient sees and keep your own code for the program in your EHR.
When should you use something else?
If you want the payment to carry clinical context, such as an invoice that lists the labs ordered, use a tool with a BAA for that step.
| Option | BAA | Good fit when |
|---|---|---|
| Stripe | None published | Payment links and subscriptions with generic names |
| Square | In its terms, for HIPAA-enabled services such as Invoices and Appointments | You want invoices or booking under a BAA |
| Your EHR's billing | Covered by the EHR's BAA | You want the payment next to the chart |
| PayPal and Venmo | Not confirmed | Not for anything beyond a plain payment |
Many EHRs use Stripe or another processor behind the scenes. That is fine: the clinical detail stays in the EHR under its BAA, and the processor sees a payment. For Square, read Is Square HIPAA compliant? For when to charge, read how to collect lab fees before the consult.
To check your other tools, use the HIPAA and BAA checker.
This is general information, not legal advice. Confirm BAA terms with each vendor.
Common questions
Does Stripe sign a BAA?
Stripe publishes no BAA and its Services Agreement includes none (as of November 2026). Its terms tell users not to provide protected health information as third-party data. If you need a BAA for the payment step, use a tool that offers one.
Can a medical practice use Stripe without a BAA?
Yes, for taking payments. HIPAA exempts payment processing, so long as product names, descriptions, custom fields and receipts hold nothing about the patient's care.
Are Stripe payment links HIPAA compliant?
A payment link is fine when it names a generic item such as "Consult" or "Lab fee" and asks no health questions. A link that names a condition or collects symptoms is not.
What should a Stripe product be called in a medical practice?
Use the kind of visit or fee, not the reason for it: "Initial consult," "Follow-up visit," "Lab fee." Keep program and treatment names in your EHR.