Payments are one of the least glamorous parts of building a telehealth business and one of the most consequential. A payment system that does not meet HIPAA requirements creates legal exposure. One that does not support HSA and FSA cards loses patients who could have paid. One that is not integrated into the clinical workflow creates manual reconciliation work that compounds as volume grows. And one that cannot handle subscriptions cleanly undermines the retention model that most DTC telehealth brands depend on.
At Bask Health, our payment processing infrastructure is built specifically for telehealth businesses, covering the compliance requirements, payment types, and operational workflows that generic processors were not designed to handle. Telehealth.HHS.gov notes that selecting a telehealth platform requires careful evaluation of HIPAA compliance and integration with existing clinical workflows, and payment infrastructure is no exception to that standard. This guide covers what a healthcare payment system actually needs to do for a telehealth business, and why the requirements are more specific than most operators expect.
Key Takeaways
- A healthcare payment system for telehealth must meet both HIPAA and PCI DSS compliance requirements simultaneously. PCI DSS 4.0 became the mandatory standard in March 2025.
- Standard consumer payment processors, including PayPal, Venmo, and standard Stripe configurations, are not HIPAA compliant for healthcare payment use without additional configuration and a signed BAA.
- A healthcare payment processor must sign a Business Associate Agreement if payment data is linked to any patient identifier or clinical information, making it a HIPAA business associate.
- Telehealth businesses need payment systems that support subscriptions, HSA and FSA cards, split payments, and refund workflows, not just one-time card transactions.
- Payment should be integrated into the clinical workflow, not treated as a separate step, so the patient journey from intake to payment to prescription runs without manual handoffs.
- Bask Health's payment infrastructure is built for DTC telehealth, covering compliance, subscription billing, HSA and FSA support, and integration with the clinical platform in one system.
Why Generic Payment Processors Do Not Work for Telehealth
Most early-stage telehealth businesses make the same payment mistake: they reach for the most familiar payment tool and assume compliance can be sorted out later. Stripe is easy to implement. Square is widely used. PayPal is ubiquitous. None of them are designed for healthcare payment processing without significant additional configuration, and most of them cannot meet the HIPAA requirements that apply to telehealth transactions without a healthcare-specific setup and a signed BAA.
The reason is structural. Healthcare payments are not just financial transactions. When a patient pays for a telehealth visit and that payment record is linked to their name, the date of service, and the clinical context of the visit, that information becomes protected health information under HIPAA. A payment processor that stores or transmits data tied to patient identifiers and clinical details is a HIPAA business associate and is therefore required to sign a Business Associate Agreement.
According to HHS.gov's HIPAA guidance, covered health care providers must use technology vendors that comply with HIPAA Rules and will enter into business associate agreements. A payment processor that refuses to sign a BAA, or that claims HIPAA does not apply to their system, is not a compliant choice for a telehealth business collecting payment data linked to patient records.
The Dual Compliance Requirement: HIPAA and PCI DSS
Healthcare payment processing sits at the intersection of two distinct compliance frameworks, and a telehealth business needs to meet both.
HIPAA governs protected health information. When payment records are linked to patient identifiers, treatment dates, or clinical details, HIPAA's privacy and security rules apply. The processor must handle that data with encryption, access controls, and audit logging consistent with the HIPAA Security Rule.
PCI DSS governs payment card data. The PCI Security Standards Council sets the requirements for any entity that stores, processes, or transmits cardholder data. PCI DSS 4.0.1 is the current standard, and version 4.0 became mandatory in March 2025. Telehealth businesses that accept credit and debit cards must comply with PCI DSS regardless of whether their payment processor is also HIPAA-compliant.
The practical implication is that PCI compliance is necessary but not sufficient. A payment processor that is PCI DSS certified but does not meet HIPAA requirements is not appropriate for healthcare payment processing where PHI is involved. Both frameworks must be satisfied simultaneously, and the systems must be configured to enforce both.
Do Telehealth Businesses Need HIPAA Compliant Payment Processing?
Yes, if payment records are linked to any patient identifier or clinical information. A credit card number alone falls under PCI DSS, not HIPAA. But when a payment record includes a patient's name, a date of service, a clinical category, or any information that could identify the patient and connect the payment to their healthcare, that data becomes PHI and HIPAA applies. For virtually all telehealth businesses, this means payment processing must be both PCI DSS compliant and HIPAA compliant, with a signed BAA from the payment processor.
What a Healthcare Payment System for Telehealth Needs to Support
Beyond the compliance baseline, a healthcare payment system for a DTC telehealth business needs to handle a set of workflows that generic payment tools are not built for. Here is what each one requires.
Subscription Billing
Most DTC telehealth businesses run on subscription models. A patient pays a monthly fee for ongoing access to care, medication, and follow-up. The payment system needs to support recurring billing that automatically charges the subscription on the correct cycle, handles payment failures with appropriate retry logic, notifies patients of upcoming charges, and manages cancellations and plan changes without requiring manual intervention from the operations team.
A payment system that requires manual invoicing for each renewal cycle will not survive at scale. Subscription billing infrastructure needs to be automated, configurable by plan type, and connected to the clinical platform so that prescription refills and subscription renewals are coordinated rather than running independently.
HSA and FSA Card Support
Healthcare savings accounts and flexible spending accounts are a significant payment source for telehealth patients. Many GLP-1, mental health, and chronic disease management services are HSA and FSA eligible, and patients using these accounts expect the payment experience to work as smoothly as a standard credit card transaction.
HSA and FSA card acceptance requires the payment system to process transactions correctly against the card network rules for healthcare spending. Not all payment processors handle this cleanly. A processor that declines HSA transactions or routes them incorrectly creates patient friction and lost revenue.
Multi-Product Order Management
DTC telehealth businesses frequently sell clinical services and physical products in the same transaction. A patient who completes a weight management consultation and receives a prescription may also be purchasing supplements, devices, or other products as part of the same program. The payment system needs to handle these multi-line transactions correctly, allocating payment across clinical services and physical products with appropriate tax and fulfillment routing.
Bask Health's order management and payment infrastructure handle this together. As a result, the transaction that starts with a clinical intake ends with a correctly fulfilled multi-product order without requiring manual intervention at the payment boundary.
Refund and Dispute Workflows
Healthcare refunds are more complex than standard e-commerce refunds. A patient who disputes a charge for a telehealth visit is disputing a transaction linked to PHI. The refund and dispute workflow needs to handle the financial side correctly while maintaining appropriate clinical documentation and not creating HIPAA exposure in the dispute process.
The payment system should support full and partial refunds, log all refund activity against the correct patient record, and handle payment disputes through a workflow that does not require clinical staff to share inappropriate information with the payment processor.
Integration With the Clinical Platform
This is the requirement that generic payment processors most consistently fail to meet, not because they cannot process payments, but because they are not connected to the clinical workflow that precedes and follows the payment.
In a telehealth business, payment is not a standalone event. A patient completes intake, a provider approves a treatment plan, a prescription is generated, and payment is collected as part of the same clinical workflow. If the payment system is disconnected from the clinical platform, someone has to reconcile payment records against clinical records manually, match refunds to clinical outcomes, and track which patients are current on their subscription versus which ones have lapsed. That manual overhead is manageable at 100 patients and unsustainable at 2,000.
Bask Health's payment infrastructure is connected to the same platform as our EMR and e-prescribing tools, patient management system, and pharmacy fulfillment, so payment status, clinical status, and fulfillment status are all visible in the same place rather than requiring reconciliation across separate systems.
Common Payment Mistakes Telehealth Businesses Make
Using PayPal or Venmo for Patient Payments
These platforms are not designed for healthcare payment processing and cannot meet HIPAA requirements for transactions linked to PHI. They also do not support HSA and FSA cards and do not provide BAAs for healthcare use cases.
Assuming PCI Compliance Equals HIPAA Compliance
PCI compliance protects card data. HIPAA compliance protects patient health information. When payment records contain PHI, both apply, and a processor that is PCI certified but not HIPAA compliant is not a complete solution for healthcare payment processing.
Separating Payment From the Clinical Workflow
Building the payment system as a standalone component that does not connect to intake, clinical review, and fulfillment creates manual reconciliation overhead that grows with the business. Payment should be integrated into the patient journey, not appended to it.
Not Having a Signed BAA With the Payment Processor
A payment processor that accesses records containing patient identifiers linked to clinical information is a HIPAA business associate. Operating without a signed BAA creates liability regardless of how the processor's marketing describes their HIPAA status.
What Payment Methods Should a Telehealth Business Accept?
At minimum: major credit and debit cards (Visa, Mastercard, American Express, Discover), HSA and FSA cards for eligible services, and ACH for subscription billing where appropriate. The payment system should also support digital wallets where patient demographics make them relevant. The specific payment types that matter most depend on the patient population and the care model. Still, HSA and FSA support is particularly important for any telehealth business targeting conditions covered by these accounts.
A Note From the Field
The payment problems that grow fastest in telehealth businesses are the ones that seem minor at launch. A subscription retry logic that is not quite right loses a small percentage of patients each month. HSA card declines create friction that leads to churn. Manual reconciliation between the payment system and the clinical platform takes two hours a week at 500 patients and twenty hours a week at 5,000. None of these feel urgent on day one. All of them become expensive if left unaddressed through the first growth phase.
Conclusion
A healthcare payment system for a telehealth business is not just a payment processor. It is a compliance-grade, workflow-integrated financial infrastructure that needs to handle HIPAA requirements, PCI DSS standards, subscription billing, HSA and FSA card support, and multi-product order management, all connected to the clinical platform rather than running as a standalone tool.
Bask Health's payment infrastructure is built for exactly this use case, giving DTC telehealth brands a payment system that meets the compliance requirements, supports the payment types their patients need, and integrates with the clinical platform so the full patient journey from intake to delivered prescription runs on one connected system.
This article is for informational purposes only and does not constitute legal or medical advice. Healthcare operators should consult qualified legal and compliance counsel regarding their specific HIPAA and PCI DSS obligations.
References
- PCI Security Standards Council (PCI SSC). (n.d.). PCI Security Standards Council. https://www.pcisecuritystandards.org/
- U.S. Department of Health & Human Services. (n.d.). A resource for health care providers: Educating patients about privacy and security of their health information. https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/resource-health-care-providers-educating-patients/index.html
- U.S. Department of Health & Human Services, Office for the Advancement of Telehealth. (n.d.). Getting started with telehealth. https://telehealth.hhs.gov/providers/getting-started
