Card data is PCI. Patient data is HIPAA. They are two scopes, two standards, and two enforcers. A practice that takes cards is a merchant under the PCI Data Security Standard. If it is a HIPAA covered entity, billing records about the patient are protected health information (PHI), including information that relates to payment for care (HHS OCR, Summary of the HIPAA Privacy Rule). Recurring balances and card-on-file sit where those scopes overlap. Mixing a primary account number (PAN) into the chart, the inbox, or a shared spreadsheet is how offices get hurt. This article is a map of which rule applies to which data. It is not legal advice, and it is not a substitute for counsel or your acquirer.
PAN, expiry, and name when they travel with the PAN. PCI SSC writes the standard. Acquirer and brands run the program.
Individually identifiable health information, including payment for care. HHS OCR. Privacy, Security, and Breach Notification Rules.
The commercial layer on the merchant account. Negotiable. Not a HIPAA or PCI invoice.
Two rules, two piles of data
PCI DSS applies wherever payment account data is stored, processed, or transmitted (PCI Security Standards Council). The document in force is PCI DSS v4.0.1. Future-dated requirements in that standard became mandatory on 31 March 2025 (PCI SSC). Your acquirer tells you how to validate, usually a Self-Assessment Questionnaire (SAQ) or a Report on Compliance. A PCI fee on the merchant statement is a processor program, not a Council invoice. PCI DSS 4.0 for merchants is the current filing map.
HIPAA is federal health-privacy law. The Privacy Rule protects individually identifiable health information held or transmitted by a covered entity or its business associate, in any form: electronic, paper, or oral. HHS OCR's Privacy Rule summary defines that as data that relates to the person's health or condition, the care they received, or the past, present, or future payment for that care, and that identifies the person or could reasonably be used to identify them. Billing information at the clinic is on that list. The Security Rule covers the electronic subset (ePHI) and requires administrative, physical, and technical safeguards (HHS OCR, Summary of the HIPAA Security Rule, last reviewed 7 Aug 2026). OCR enforces both.
A PAN in a processor vault is cardholder data. A PAN sitting next to a name, a date of service, and a diagnosis code in the practice management system is cardholder data and PHI. HHS OCR FAQ 575 (created 18 Feb 2009) lists a debit or credit card number among PHI types that warrant extra care in disposal. Shred the imprint. Do not leave yesterday's batch report on the front desk.
Covered entities, in OCR's Privacy Rule summary, are health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with a standard HIPAA transaction. Size is not the test. A one-provider office that bills electronically is in. Confirm coverage with counsel, not with a processor sales deck.
The copay is not a HIPAA transaction
Two rails leave the office. Do not file them as one.
The claim you send a health plan is a HIPAA standard transaction when it is electronic (CMS Transaction FAQs, page last modified 10 Sep 2024).
The card sale is not. CMS's same FAQ is explicit: if a patient or subscriber uses a credit or debit card to pay premiums, deductibles, or copayments, that is not a HIPAA standard transaction and does not have to be in a HIPAA-compliant format. You still have a merchant account, interchange, and PCI scope. You do not skip the claim rules because the copay ran on a card network.
HIPAA still governs how you use and disclose PHI to get paid. OCR's Treatment, Payment, and Health Care Operations guidance (revised 3 Apr 2003) defines payment to include billing and collection. A covered entity may use and disclose PHI for its own payment activities without the patient's authorization, limited to the minimum necessary. That is permission to bill. It is not permission to store the PAN in the chart.
Who is a business associate, and who is just moving money
HHS's Business Associates guidance (last reviewed 30 Jul 2026) is the split most offices get backwards.
A business associate is someone outside your workforce who performs a HIPAA-regulated function on your behalf, or who provides listed services, and in doing so creates, receives, maintains, or transmits PHI. OCR's examples include claims processing, billing, and practice management. A patient portal, EHR host, billing company, and collection agency that works the aging report sit in that bucket. You need a business associate agreement (BAA) before you hand them PHI. The associate is directly liable for parts of the Rules.
A financial institution that only processes the patient's card, debit, check, or electronic funds transfer for health care or premium payment is not doing that job. HHS says that institution is providing its normal banking or payment service to its customers, not a function on behalf of the covered entity. A BAA is not required for that activity.
The test is the function, not the logo. If the same company vaults cards and stores encounter data, runs statements, or hosts the portal, you bought more than acquiring. Ask in writing which legal entity sees PHI, which entity only sees card data, and which contract is the BAA. Counsel signs the BAA.
OCR FAQ 266 (created 19 Dec 2002, last reviewed 28 Dec 2022) allows a covered entity or its collection-agency business associate to contact people other than the patient as needed to obtain payment, still limited to the minimum necessary, and still bound by any agreed restriction or confidential-communication request. Collections is payment. It is also a PHI disclosure. Do not send the diagnosis or the PAN because the balance is past due.
Card-on-file and the balance after insurance
This is the failure mode.
Illustrative, not a quote. Visit day: the patient taps $40 as an estimated copay. Weeks later the explanation of benefits leaves $360 patient responsibility. The office charges the card on file. That second sale is usually card-not-present. It is also a use of PHI for payment. The chart already knew the patient. The merchant account now knows the card.
Where offices get hurt:
-
The PAN lives in the wrong system. A number on the superbill, in the EHR, in a front-desk spreadsheet, or in an inbox is in the cardholder data environment and is PHI. Tokenization is the cut: capture at a hosted field or terminal, vault the PAN, store only a token the practice cannot redeem into a full card number. Tokenization does not erase PCI DSS and does not complete a Security Rule risk analysis. It stops the chart from being a card file.
-
The charge is a surprise. Delayed patient-responsibility sales generate "I did not authorize this" disputes. A chargeback pulls the money and often a fee. Representment needs stored-credential consent, the visit, and the remaining balance, not a chart note that "we always bill the card." Authorizing at the visit and capturing weeks later is a different clock than a new sale on a stored token. Confirm with the acquirer which one you are running.
-
Phone and keyed follow-up. Staff typing cards from a paper form is keyed, not card-present. Interchange prices that gap. PCI scope and HIPAA disposal both follow the paper. If the office must take a card by phone, use a point-to-point encrypted device or a hosted pay-by-link so the PAN never lands in the headset software.
-
Minimum necessary, ignored. A statement to the wrong address, a portal note that lists the procedure next to the card last-four, a collection letter that recites the diagnosis: those are PHI uses. OCR's TPO guidance requires policies that reasonably limit payment disclosures to the minimum necessary.
Keep the visit tap on a terminal when the patient is there. Vault a token only if you will actually run later balances. Delete leftover PAN after the token is issued. Volunteers who dump paper are workforce for HIPAA disposal training (FAQ 575).
What to put in writing before the next boarding
Ask the processor and the billing vendor, separately:
- Where is the PAN captured, stored, and deleted? Name the vault entity. Get their current Attestation of Compliance for that vaulting service, dated, against PCI DSS v4.0.1.
- Which legal entity, if any, creates, receives, maintains, or transmits PHI for you? If the answer is "none, we only process the card," that should match HHS's financial-institution description. If the answer is billing, portal, or claims, you need a BAA that matches the work.
- How are later patient-responsibility charges submitted: a new card-not-present sale on a token, or delayed capture of an old authorization?
None of those answers is a rate. Card cost is interchange, assessments, and markup, including keyed mix and monthly extras. If you want the as-billed view of those extras, run one statement through the analyzer.
Do not treat a signed BAA as a PCI SAQ. Do not treat a PCI badge as a Security Rule risk analysis. Card data is PCI. Patient data is HIPAA. Keep them in different systems, with a token in the middle, and you can collect the balance without turning the chart into a card file.
FAQ
Is a patient's credit card number protected health information? At a covered entity, billing records that identify the patient are PHI, including payment for care. HHS OCR FAQ 575 (18 Feb 2009) lists a debit or credit card number among PHI types that warrant extra care in disposal. The same digits are also cardholder data under PCI DSS. One field, two rules.
Do I need a business associate agreement with my card processor? Not for ordinary card, debit, check, or EFT processing of a patient-conducted payment. HHS (Business Associates guidance, last reviewed 30 Jul 2026) treats that as the financial institution's normal transaction service, not work on the covered entity's behalf. A vendor that also bills, stores claims, or runs a patient portal that holds PHI is a different job. Ask counsel which functions you actually bought.
Is a copay charged on a card a HIPAA standard transaction? No. CMS Transaction FAQs (page last modified 10 Sep 2024) say a patient or subscriber using a credit or debit card to pay premiums, deductibles, or copayments is not a HIPAA standard transaction and does not have to be in a HIPAA-compliant format. The claim you send the plan is a different rail.
Does tokenization make the office HIPAA compliant? No. Tokenization can shrink where the PAN lives for PCI DSS. The HIPAA Security Rule still requires reasonable administrative, physical, and technical safeguards for electronic PHI (HHS OCR Security Rule summary, last reviewed 7 Aug 2026). A vaulted card does not file a Security Rule risk analysis.
Can we keep a card on file for the balance after insurance posts? As a merchant, yes, if you vault the PAN and charge it as a later card-not-present sale, with whatever cardholder consent your acquirer and the brands require. As a covered entity, that balance and the billing record remain PHI. Do not paste the PAN into the chart, the inbox, or a shared spreadsheet.
Does paying the PCI fee on our merchant statement cover HIPAA? No. A PCI line is a processor program. HIPAA is enforced by HHS OCR. Completing an SAQ does not satisfy the Security Rule, and a signed BAA does not file PCI DSS.
Sources
- HHS OCR, Summary of the HIPAA Privacy Rule
- HHS OCR, Summary of the HIPAA Security Rule, last reviewed 7 Aug 2026
- HHS, Business Associates guidance, last reviewed 30 Jul 2026
- HHS OCR, Uses and Disclosures for Treatment, Payment, and Health Care Operations, revised 3 Apr 2003
- HHS OCR FAQ 575, disposal of PHI, created 18 Feb 2009
- HHS OCR FAQ 266, collections contacts, created 19 Dec 2002, last reviewed 28 Dec 2022
- CMS, Administrative Simplification Transaction FAQs, page last modified 10 Sep 2024
- PCI Security Standards Council, PCI Security Standards
- PCI Security Standards Council, PCI DSS overview
Questions about how this applies to your business?
Talk it through