Overview
HIPAA compliance is a top priority when using third-party tools like Stripe and Mailchimp in your practice. This guide explains how our integration with Stripe remains fully HIPAA compliant, and what to consider when using Mailchimp or other email marketing tools.
Stripe Integration & HIPAA Compliance
When Stripe is integrated through our software, no Protected Health Information (PHI) is ever stored or transmitted to Stripe. Here’s why:
No Patient Data Shared: We never send names, medical details, or any other PHI to Stripe.
Anonymized Tokens: Stripe only receives anonymized payment tokens, allowing transactions without identifying the patient.
Secure API Integration: Our Stripe connection uses industry-standard encryption and security, ensuring HIPAA-compliant communication.
💡 Important: Using the Stripe or Square app and storing patient names or medical notes directly on those platforms is not HIPAA compliant. This warning applies only when using those platforms independently — not through our integration.
Using Mailchimp for Marketing
Email marketing itself is not inherently HIPAA compliant, especially if PHI is included. However, many large medical organizations use email platforms for non-sensitive marketing content, including:
Holiday closures
New services or practitioners
General updates
You can:
Export your patient email list and use Mailchimp (or another provider) to send messages.
Avoid including any PHI (diagnoses, treatments, etc.) in marketing emails.
Consider adding a Business Associate Agreement (BAA) with your email provider if handling sensitive info.