Can You Accept Online Payments and Stay HIPAA Compliant? What You Need to Know for Stripe, Square, WordPress and Shopify

Payments, E-Commerce and HIPAA Compliance

Selling healthcare services or regulated products online is no longer unusual.

Practices now sell:

• GLP-1 programs
• Hormone therapy
• Telehealth consultations
• Supplements and medical devices
• Online health and coaching programs
  

And the moment payment enters the picture, the same question appears:

Can you accept online payments and still stay HIPAA-Compliant?

This article explains how HIPAA-Compliant e-commerce works – especially if you use popular e-commerce solutions such as Stripe, Square, WordPress, WooCommerce, or Shopify.

Does Accepting Online Payments by a Healthcare Provider Automatically Trigger HIPAA?

Not always.

HIPAA applies when your system collects, stores, or transmits Protected Health Information (PHI).

Payment information alone is not PHI.

But the moment your checkout collects:

• Medical history
• Eligibility questionnaires
• Prescription data
• Symptoms
• Uploaded documents
• Diagnosis-related notes
• Consent
  

…you are handling PHI and your process must be HIPAA Compliant.

The Biggest Misconception About HIPAA-Compliant E-Commerce Platforms

Many developers assume:

“I need a HIPAA-Compliant e-commerce platform.”

In most cases, you don’t.

HIPAA does not require your entire e-commerce store to become HIPAA Compliant:

You can continue using:

• Shopify
• WooCommerce
• Square e-commerce

It only applies to the parts of the workflow that touch PHI.

How to Accept Online Payments and Stay HIPAA Compliant

To continue using Stripe, Square, or Shopify you can:

Separate PHI from payment processing.

Here’s the efficient architecture:

1. A patient completes a HIPAA-Compliant intake, consent, or eligibility form
2. PHI is stored with a HIPAA-Compliant form provider with a Business Associate Agreement (BAA)
3. Only non-PHI information proceeds to checkout
4. Payment is processed by Stripe, Square or Shopify
   

This keeps:

• PHI inside a HIPAA-Compliant environment
• Payments inside your existing e-commerce system
• Clean separation of the data for HIPAA purposes
• Lower compliance risk
  

That’s what HIPAA-Compliant e-commerce actually means in a cost efficient way.

Stripe and HIPAA: What You Should Know

Stripe is not HIPAA Compliant and does not provide a BAA (Business Associate Agreement), so when you use it for online payments, PHI must be kept separately.

In many setups, the safest structure is:

• Collect PHI in a HIPAA-Compliant form
• Send only necessary transaction data to Stripe
  

Understand how e-payments fit into HIPAA-Compliant e-commerce.

Square and HIPAA: Similar Rules Apply

Square is widely used for:

• Telehealth payments
• Medical services
• Online scheduling deposits
  

Square provides a BAA (Business Associate Agreement) for payment processing, but not automatically. A Covered Entity (healthcare practice) has to request, review and sign it.  

 A better structure is:

• HIPAA-Compliant form first
• Square payment second
  

Learn how to add a HIPAA-Compliant questionnaire before a Square checkout.

WordPress, WooCommerce and HIPAA Payments

WordPress and WooCommerce are extremely popular in healthcare.

But WooCommerce checkout fields are not designed to store PHI by default.

Instead of modifying the checkout process to capture medical data:

• Use a HIPAA-Compliant intake form
• Route PHI securely
• Let WooCommerce manage checkout and delivery
  

Learn how to add a HIPAA-Compliant form to your WordPress website with WooCommerce checkout.

Shopify and HIPAA-Compliant E-Commerce

Shopify is fast, scalable, and loved by developers.

But Shopify checkout should not store medical questionnaires as it does not provide a BAA, therefore, it is not a HIPAA-Compliant platform.

Many healthcare startups use this model:

• HIPAA-Compliant intake
• Approval or eligibility
• Shopify checkout for payment only
  

Explore how HIPAA-Compliant forms work with Shopify checkout.

When Do You Actually Need a Fully HIPAA-Compliant Payment System?

There are situations where a deeper integration is required:

• If most transactions include PHI
• If payment is tied directly to medical records
• If clinical data and billing must live together
  

But for most:

• Hybrid e-commerce stores
• Online programs
• Supplement brands
  

Full HIPAA payment infrastructure is often unnecessary and expensive.

Architecture matters more than platform choice.

Common HIPAA E-Commerce Mistakes

Collecting PHI directly in:

• Shopify forms
• WooCommerce checkout notes with medical information
• Square order comments (if a BAA is not signed)
• CRM payment add-ons
  

The safest rule:

Keep PHI outside the checkout system, unless you are 100% sure the system is HIPAA Compliant.

HIPAA-Compliant E-Commerce Is About System Design

The common question is not:

“Is Stripe HIPAA Compliant?”
“Is Shopify HIPAA Compliant?”

The better question is:

“Is my workflow designed correctly?”

When PHI is collected through a HIPAA-Compliant form and kept separate from your e-commerce platform:

• You protect patient data
• You reduce legal exposure
• You keep your favorite tools
• You launch faster
  

That’s the real strategy behind HIPAA-Compliant e-commerce.

Frequently Asked Questions About HIPAA and Online Payments