No No BAA is available on any Stripe plan, and the main exclusion is that the Stripe Services Agreement prohibits providing PHI to Stripe. Verified 2026-10-19.
Short answer
Stripe publishes no BAA for any product. Section 4.5 of the Stripe Services Agreement (SSA) says users must not provide PHI to Stripe and are liable for any disclosure. Stripe Identity separately lists PHI processing by HIPAA-covered entities as an unsupported use case.
If you searched "Stripe HIPAA compliant BAA 2025", the answer is the same: no BAA is published for any Stripe product, and no plan or pricing arrangement in the sources offers one. For definitions of BAA and PHI, see the HIPAA glossary. For other tools, see Is it HIPAA compliant? All vendors.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| All Stripe accounts (standard and custom pricing) | No | Not available; no BAA published | Not published by the vendor |
Custom pricing does not change this. The sources do not show a BAA at any pricing tier.
What the BAA covers and what it excludes
Covered services: none, because no BAA is published.
Excluded:
- Payments, Billing, Invoicing and all other Stripe services. PHI must not be provided under the Stripe Services Agreement.
- Stripe Identity. PHI processing by a HIPAA-covered entity is listed as an unsupported use case.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Yes |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Data residency, HITRUST and ISO 27001: Not published by the vendor.
Published controls are not a substitute for a BAA. Without a BAA, strong controls do not make Stripe a place for PHI.
How to use Stripe with PHI
You cannot put PHI into Stripe, so the work is keeping PHI out of it:
- Do not send PHI to Stripe.
- Keep payment descriptions, metadata and invoice fields free of PHI. A clinic should not put a diagnosis, procedure name or provider note in a description line or custom metadata field.
- Review what data your billing and checkout flows pass to Stripe, including anything a practice-management or scheduling integration fills in automatically.
- Use SAML SSO and audit logs for staff access to the Stripe dashboard.
- Document the decision in your vendor inventory, including the SSA Section 4.5 restriction and the date you checked it.
- Train front-desk and billing staff on what must never go into Stripe fields.
HIPAA compliance depends on a signed BAA, configuration and policies. Here, no BAA exists. Your privacy officer decides whether a given payment record counts as PHI in your workflow. For related checklists, see HIPAA guides, and for payment tools by category, see HIPAA-compliant software by category.
Alternatives with a BAA
- Square: verdict conditional, BAA available from the Square Free plan. Read Is Square HIPAA compliant? for scope and exclusions before relying on it.
Sources
- Stripe Services Agreement—General Terms (Section 4.5, Third Party Data) — Terms, checked 2026-10-19. "User must not provide Protected Health Information to Stripe as part of Third Party Data. User is liable for any disclosure of Protected Health Information to Stripe when User provides access to the Third Party Data."
- Supported use cases and locations for Stripe Identity — Help article, checked 2026-10-19. "Processing Personal Health Information (PHI) by a HIPAA-covered entity: Verification or storage of PHI protected by the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This only applies for businesses that are sharing data covered by the US HIPAA."
- Security at Stripe — Trust center, checked 2026-10-19. "Stripe encrypts sensitive data both in transit and at rest."
- Security at Stripe — Trust center, checked 2026-10-19. "Stripe’s systems, processes, and controls are regularly audited as part of our SOC 1 and SOC 2 compliance programs. SOC 1 and SOC 2 Type II reports are produced annually and can be provided upon request."
- Security at Stripe — Trust center, checked 2026-10-19. "We also support single sign-on through Security Assertion Markup Language (SAML) 2.0, allowing you to mandate sign-in requirements, configure access control, and instantly onboard team members through just-in-time (JIT) account provisioning."
- Security at Stripe — Trust center, checked 2026-10-19. "You can also view audit logs of important account changes and activity in your security history."
Changes
No changes recorded since first verification on 2026-10-19. See recent changes in vendor HIPAA status.
Changes and FAQ
Changes: No changes recorded since first verification on 2026-10-19. See Recent changes in vendor HIPAA status for other vendors.
Does Stripe sign a BAA?
No BAA is published for any Stripe product or plan, and the sources show no route to one through custom pricing.
Is Stripe HIPAA compliant for patient payments?
Stripe's Services Agreement, Section 4.5, says users must not provide PHI to Stripe and are liable for any disclosure. With no BAA, treat Stripe as a service that must not receive PHI. Keep descriptions, metadata and invoice fields free of it, and have your privacy officer review the flow.
Can I use Stripe Identity to verify patients?
Not for HIPAA-covered data. Stripe Identity lists PHI processing by HIPAA-covered entities as an unsupported use case.
Does Stripe's SOC 2 report make it suitable for PHI?
No. Stripe publishes SOC 2 among its controls, but SOC 2 is not a BAA, and the Services Agreement still bars PHI.