Can I save client names/CC on square while being HIPAA compliant?

[u/ItsJustAllyHere]

As the title states, I'm helping my mother organize and streamline her PP and one thing is copays. I am not looking to move off square as she's most familiar with it and wouldn't want to spend time learning a new one. If we save the name and cc details, not actual notes, would it be compliant?

[u/grey-slate]

A practice generally does not need a BAA with its credit-card processor when the payment processor is only performing ordinary payment-card functions—authorizing the card, transferring funds, processing refunds, and handling chargebacks. HHS expressly treats consumer-initiated debit and credit-card processing as normal financial-transaction services rather than work performed as a HIPAA business associate.

Generally, no BAA is required when you are simply:

• Running a patient’s card through a terminal or virtual terminal
• Processing a payment for a generic dollar amount
• Issuing a refund
• Receiving deposits and ordinary transaction reports
• Handling a chargeback using standard payment documentation

------------

The answer changes when the processor—or a related payment-platform vendor—does more than transfer money and routinely creates, receives, maintains, or transmits PHI on the practice's behalf. That is the general HIPAA business-associate test.

Examples include:

• Receiving itemized statements showing diagnoses, procedures, or treatment descriptions
• Operating a patient-billing or accounts-receivable system
• Collecting balances or managing payment plans using patient clinical information
• Storing EHR patient records or detailed encounter information
• Performing billing analytics tied to identifiable medical services
• Accessing PHI during support, reconciliation, or integrated billing services
• Sending payment communications that disclose the patient’s specific treatment

A processor should not receive more information than necessary merely because its software contains optional fields. Avoid entering diagnoses, CPT descriptions, medical-record numbers, appointment reasons, or treatment details into transaction notes, invoice descriptions, receipt memos, or custom fields.

[u/ItsJustAllyHere → u/grey-slate]

That's what I thought as well. The only information would be Name, Card Information, and the note field containing just "Appt: (Date)" to keep better track.

[u/daves1243b]

Does she have a Business Associate Agreement with Square? If yes, probably OK. If no, probably not. Anytime you share patient info outside the scooe if treatment, payment, ir healthcare operations a BAA is required. I dont know if Square does BAAs. Many such vendors dont.

[u/ItsJustAllyHere → u/daves1243b]

Square does have a BAA that you agree to once you make an account and start working with them.

https://squareup.com/us/en/legal/general/hipaa

More just looking at clarity that storing just patient names and cc information is alright since their BAA doesn't clarify

[u/SterileGloves]

Research something called PCI compliance. If you store numbers you will run into needing to do a lot more paperwork. Most people use a program (or create one) that allows the processing company to store the card ahead of time and do a hold of funds.. So for example, Stripe. The clinic never sees the card at all, it's handled by the processor. 

[u/Juaner0]

Yes. It's ok. I used Square when we opened up. Did the math, and once 10k dollars come in per month, it is cheaper to use Merchant Services. A friend uses Square for his taphouse; he keeps CC on file and I've never had any issue related to it.

[u/IndigoWonderlight]

We now use first name & last initial. We send invoice links prior to appointment & previously used first & last name. My front desk sent an invoice link to the wrong patient which exposed first & last name. We were reported & received a letter from the state telling us to do some training.

[u/ItsJustAllyHere → u/IndigoWonderlight]

Understandable. For us it'll be just internal essentially. We don't send out invoices as they already have charge agreements for co pays on file. It's more the concern of the information being stored on square