Are credit card transactions covered under HIPAA?

Question: Are credit card transactions covered under HIPAA? If an individual (i.e., a subscriber or a patient) uses his or her credit or debit card to pay for premiums, deductibles and/or co-payments, is that “transaction” considered a HIPAA standard, and must it be in a HIPAA compliant format with HIPAA compliant content?


Answer: The HIPAA standards must be used by “covered entities,” which are health plans, health care clearinghouses and health care providers who conduct any of the standard transactions electronically. The HIPAA standards do not apply to individuals, unless they are acting in some capacity on behalf of a covered entity, and not on behalf of themselves as, for example, subscribers or patients.
Ultrasound Repair

Vending Machine

X3 Hand Sanitizer

An individual, acting on behalf of himself or herself, is not a covered entity, and is therefore not subject to the HIPAA standards. Transactions conducted between subscribers or patients and health plans or health care providers are not transactions for which the Secretary of Health and Human Services has adopted standards. Therefore, if an individual uses a personal credit card or debit card to pay either a premium, co-payment and/or deductible to a health plan or a health care provider, the individuals are not covered entities, they are not conducting covered transactions, and the transactions being conducted need not be in the standard format.