No: PayPal does not publish a BAA, and its own Invoicing terms tell HIPAA Covered Entities not to let PayPal handle PHI. Venmo publishes no BAA or HIPAA statement either, so neither service is a place for patient information.
No No BAA is published for any PayPal or Venmo plan. The main exclusion is PayPal Invoicing, where Covered Entities and Business Associates must not use the service in a way that has PayPal create, receive, maintain or transmit PHI. Last verified 2026-10-19. This page reports the vendor's published terms; see all vendor HIPAA checks for other tools.
Short answer
No BAA is published for PayPal or Venmo, so no plan or service is available with a BAA.
PayPal's Invoicing terms require HIPAA Covered Entities and Business Associates not to use Invoicing in a way that causes PayPal to handle PHI. Venmo's User Agreement bars personal accounts from business, commercial or merchant transactions. Venmo has no HIPAA statement at all.
In practice, keep PHI out of payment notes, invoice descriptions and customer fields. A clinic that sends an invoice reading "Follow-up: knee arthroscopy, Dr. Patel" has put treatment detail into a service that has told Covered Entities not to do that.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| PayPal Business (Checkout, Invoicing) | Not available | Not published by the vendor | Not published by the vendor |
| Venmo personal accounts | Not available | Not applicable | Not applicable |
| Venmo business profiles | Not available | Not published by the vendor | Not published by the vendor |
Venmo business profile information is public, and Venmo makes no HIPAA statement for business profiles.
What the BAA covers and what it excludes
Covered services: none. No BAA is published, so no PayPal or Venmo service is covered.
Excluded:
- PayPal Invoicing. Covered Entities and Business Associates must not use it in a way that lets PayPal create, receive, maintain or transmit PHI.
- Venmo personal accounts. The User Agreement does not permit business, commercial or merchant transactions, so a practice cannot collect patient payments on one.
- Venmo business profiles. There is no HIPAA statement, and profile information is public.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Not publishing a control is not a statement that it does not exist. Without a BAA, though, no control changes the verdict.
How to use PayPal with PHI
Compliance depends on a signed BAA, configuration and policies. Here no BAA exists, so the safest approach is to keep PHI out of PayPal and Venmo entirely. Definitions of BAA, PHI and Covered Entity are in the HIPAA glossary: BAA, PHI, Covered Entity.
- Do not send invoices that describe services, diagnoses, procedures or treatment dates. Use a neutral reference such as an account number.
- Keep PHI out of notes, memos, item names and customer fields, including free-text boxes on checkout pages.
- Do not use Venmo for patient payments, from a personal account or a business profile.
- Keep itemized billing detail in a system covered by a BAA, and send only the amount due through the payment tool.
- Check any automation that moves payment data onward, such as a Zap that copies PayPal transactions into a spreadsheet or CRM. See Is Zapier HIPAA compliant?.
- Have your privacy officer review payment flows. This page does not decide whether a payment record alone is PHI in your situation.
- Train front-desk and billing staff on what may and may not be typed into payment fields. More practical material is in the HIPAA guides.
Alternatives with a BAA
Square: verdict conditional, BAA from plan Square Free. See Is Square HIPAA compliant? for covered services and exclusions. For more options, browse HIPAA-compliant software by category, including the payments category.
Placement in category tables is never influenced by payment.
Sources
- Invoicing Terms and Conditions (last updated October 29, 2025) — Terms, checked 2026-10-19. "If you are subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) as a Covered Entity or Business Associate (as defined in HIPAA), you covenant and agree that you will not use Invoicing in a manner that causes PayPal to create, receive, maintain or transmit Protected Health Information (PHI) on your behalf."
- How to Keep Track of Invoices and Payments | PayPal US — Vendor page, checked 2026-10-19. "The invoicing services are not intended to be used by HIPAA covered entities"
- User Agreement | Venmo (effective August 24, 2026) — Terms, checked 2026-10-19. "personal accounts and Teen Accounts may not be used to conduct business, commercial or merchant transactions with other personal accounts or Teen Accounts"
- Venmo for Business: Business Account Addendum | Venmo — Terms, checked 2026-10-19. "Effective January 24, 2019"
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
FAQ
Does PayPal sign a BAA?
No BAA is published for PayPal or Venmo, and none is described as available on any plan.
Can a medical practice or other HIPAA Covered Entity use PayPal Invoicing?
PayPal's Invoicing terms require Covered Entities and Business Associates not to use Invoicing in a way that causes PayPal to create, receive, maintain or transmit PHI. An invoice that names a service, diagnosis or provider visit runs against that term.
Can I accept patient payments through Venmo?
Venmo's User Agreement does not allow personal accounts to be used for business, commercial or merchant transactions. Business profiles have no HIPAA statement, and their information is public.
What are the alternatives to PayPal with a BAA?
Square is listed as conditional, with a BAA from plan Square Free; see Is Square HIPAA compliant?. The payments category lists further options.