HIPAA does not usually make your card processor a business associate, but it does govern everything around the payment: the patient data in your billing records, your telehealth platform, and any vendor that handles protected health information (PHI) on your behalf. For a telemedicine operator, the practical task is to keep PHI out of the payment flow, sign a Business Associate Agreement (BAA) wherever a vendor really touches PHI, and secure a merchant account that survives acquirer scrutiny of your clinical model.
This guide separates the three obligations that get blurred together (HIPAA, PCI DSS and card-network underwriting), explains where a BAA is and is not required, and walks through the decisions that determine whether your funds keep flowing.
Most confusion in telemedicine payments comes from treating “compliance” as one checkbox. It is three separate regimes, enforced by different parties:
| Regime | Who enforces it | What it governs | What failure looks like |
|---|---|---|---|
| HIPAA Privacy, Security and Breach Notification Rules | HHS Office for Civil Rights | PHI held or transmitted by covered entities and their business associates | Breach penalties, corrective action plans |
| PCI DSS | Card networks and your acquiring bank | Cardholder data (PAN, expiry, CVV) | Fines passed through the acquirer, loss of card acceptance |
| Acquirer and card-network underwriting | Sponsor bank and processor | Your business model, marketing claims, refund terms, chargeback ratio | Reserves, funding holds, account termination |
A processor can be flawless on PCI and still freeze your account because your prescription marketing or subscription disclosures do not match what its bank expects. Conversely, a HIPAA-ready telehealth platform tells you nothing about whether your merchant account is stable. You need to answer all three.
Often, no. This surprises many operators.
HHS guidance states that HIPAA’s business associate provisions do not apply to banks and financial institutions for the payment processing activities defined in section 1179 of the statute. In practice, a processor that only authorizes, clears and settles a consumer’s credit or debit card payment is providing a normal financial service on its own behalf, not a service to you as a covered entity. A BAA is not required for that function.
The exception matters just as much. A financial institution can become a business associate when it performs functions beyond payment processing, such as accounts receivable work on the provider’s behalf. The same HHS guidance notes that if a health plan or provider uses a vendor to conduct HIPAA-standard electronic transactions, such as electronic funds transfers (EFT) or remittance advice (ERA), that vendor may be a business associate.
Use this as a working test:
This is a general orientation, not legal advice. If your structure is unusual (a management services organization, a physician-owned entity with a non-clinical parent, a platform that bills on your behalf), have a healthcare attorney or your HIPAA compliance officer confirm the classification.
The HIPAA risk in telemedicine payments is rarely the card network. It is the metadata you attach to the payment. Review these four places:
The HHS telehealth guidance is direct about vendors: covered providers must use technology vendors that comply with the HIPAA Rules and enter into a BAA when the product creates, receives, maintains or transmits PHI. Your video platform, EHR, patient portal and intake forms qualify. Your card-acceptance layer, if designed well, should not.
The cleanest compliance posture is one where neither PHI nor card numbers ever sit on your servers. Hosted payment fields or iframes served by your gateway keep the card data with the gateway while your site handles only a token. This shrinks your PCI scope and keeps clinical data in a separate system.
Two current PCI DSS v4 points apply to telemedicine sites that embed payment forms:
Translation for your team: strip third-party tracking scripts from checkout and billing pages, and do not let analytics tools see anything on pages that combine payment and clinical context. That serves both PCI and HIPAA.
The compliance function of payments has expanded. Pharmacy Times reports that processors without healthcare-specific expertise often retroactively flag telehealth businesses, producing unexpected account restrictions. The same piece describes regulators and acquirers scrutinizing prescription marketing claims, subscription billing transparency and physician licensure alignment.
That maps to concrete underwriting questions you should expect:
Merchants that cannot answer these cleanly are the ones who end up with a reserve or a termination notice after months of volume, often when growth makes the account visible to risk teams.
Your merchant category code (MCC) affects more than interchange. According to the same Pharmacy Times analysis, MCC 8099 (Medical Services) is often more effective for HSA/FSA bundling than MCC 5912 (Drug Stores and Pharmacies), depending on the service structure. If patients expect to pay with health savings or flexible spending cards, misclassification can cause declines at checkout that look like fraud filters but are really eligibility mismatches.
Practical steps:
Many telemedicine startups begin with payments embedded in their EHR, prescribing or pharmacy software. It is convenient. It also tends to place you under a master merchant account controlled by the software vendor. Per the Pharmacy Times analysis, this setup exposes providers to sudden funding holds, reserves or termination driven by the platform’s aggregate risk profile, and experts recommend decoupling clinical technology from financial infrastructure.
If your own merchant account sits in your name, with its own underwriting file, you can switch software without re-underwriting your payments, and a problem at the platform level does not automatically become your cash flow problem. Ask any vendor who is the merchant of record, who holds the reserve, and what happens to your funds if the platform is terminated.
Not every dollar arrives by patient card. If you bill health plans, you will meet virtual credit cards (VCCs). The National Committee on Vital and Health Statistics has highlighted that VCCs are permitted under HIPAA but frequently create friction through fees, manual keying and poor reassociation with claims. The CMS guidance letter also confirms providers may request standard HIPAA-compliant EFT/ERA payment, and health plans must honor that request.
If VCC fees are eroding your margin, request EFT with ERA in writing, and make sure your merchant account can accept the VCCs that still arrive without surprise pricing.
We see telemedicine merchants approach payments backwards. They shop for a processor advertising a “HIPAA-compliant” badge, then discover the badge says nothing about reserves, MCC alignment or what happens when a disputes spike hits. At CARDZ3N, we treat healthcare billing as a high-risk vertical because acquirers do, and we build around that reality.
Our approach has three parts. First, hands-on underwriting support: we help you present your clinical model, licensure, advertising and refund terms the way a sponsor bank wants to read them, so the application reflects the business accurately. Second, transparent reserve structures and quote-based pricing, because a telehealth operator cannot forecast cash flow against terms that stay vague until after approval. Third, multi-bank resilience: a single bank relationship is a single point of failure, and healthcare merchants are exactly the accounts that benefit from alternatives.
On HIPAA specifically, our advice is to keep the payment layer boring. Tokenized card capture, generic descriptors, no clinical data in gateway fields, and a BAA with every vendor that genuinely handles PHI. Then protect the revenue with dispute prevention, because chargebacks, not audits, are what most often threaten telemedicine accounts.
— Joshua Benedetti
Put these questions to every provider you evaluate:
We place telemedicine and healthcare merchants that mainstream processors reject or freeze. Our telemedicine merchant account page covers the vertical in detail, and our healthcare and telehealth payments page explains how billing, subscriptions and in-person points of care fit together. If you have already been shut down elsewhere, start with our high risk merchant account service. For checkout design, our payment gateway options support tokenized, hosted card capture, and chargeback management covers prevention and dispute representment. Pricing is quote-based, so the quickest way to a real number is to talk with our team through cardz3n.com.
If you are launching or re-platforming, work through this sequence:
Usually not for standard card acceptance. HHS guidance explains that banks and financial institutions are generally outside the business associate provisions for payment processing activities. You do need a BAA with vendors that handle PHI for you, and a processor performing services beyond payment facilitation may qualify as a business associate.
There is no official HHS or government certification for HIPAA compliance. The phrase is a marketing description. Evaluate the processor on how it handles PHI, whether it will sign a BAA where one is warranted, and its PCI DSS status, rather than on a badge.
Often yes, but it depends on how your services are structured and which MCC your account carries. Pharmacy Times notes that MCC 8099 can work better than MCC 5912 for some service structures. Confirm with your processor and test a live card before you advertise HSA/FSA acceptance.
Common triggers include prescription advertising claims, unclear subscription billing, licensure questions and rising chargebacks. Processors without healthcare experience may also review accounts retroactively. Clear underwriting disclosure up front and strong dispute controls reduce the risk.
It is convenient but can leave you as a sub-merchant under the platform’s master account, so your funds depend on its risk profile. Many operators prefer a merchant account in their own name and a gateway that integrates with their clinical software.
Every merchant's processing setup is different, so the right answer depends on your industry, sales channels, average ticket size and chargeback history. CARDZ3N's payments specialists review those details with you and match your business with the right sponsor bank, gateway and risk tools, whether you sell online, in store, by invoice or on a recurring subscription.
We work with merchants across the USA, Canada, the UK and the EU, including high-risk, B2B and fast-growing businesses that traditional processors often turn away. If you would like a second opinion on your current rates, contract terms or approval options, contact our team for a free, no-obligation processing review.
Joshua Benedetti is the CEO of CARDZ3N, a Las Vegas-based merchant services provider specializing in high-risk payment processing and B2B payment technology.
Joshua Benedetti on LinkedInCARDZ3N Inc is headquartered in Las Vegas, Nevada, and provides merchant services to businesses that traditional processors turn away. Backed by top-tier sponsor banks and processors, CARDZ3N combines institutional stability with the speed of a specialized team that understands high-risk industries. Services include high-risk account underwriting and placement, gateway solutions across the major gateway platforms, POS integrations, ACH and check processing, chargeback prevention through ChargebackZ3N, and business lending and working capital. Its AerospacePay division serves OEMs, MROs, FBOs, and repair stations with B2B and B2G payment processing. CARDZ3N serves merchants in the USA, Canada, the UK, and the EU.
Start protecting your revenue from chargebacks today — schedule your complimentary consultation with CARDZ3N’s dispute management specialists.
