Best HIPAA-Compliant Credit Card Processing Practices

There were 180 million credit cardholders in the US in 2018 and 56% of them reported using credit cards to pay medical costs. Although many patients have insurance coverage that settles their medical costs, most still need to handle some out-of-pocket expenses and copays on their own.

The popularity of credit card payments in the medical field is steadily growing. Thus, healthcare providers need to implement HIPAA compliant credit card processing practices to ensure the integrity and security of patient’s billing information. Keep reading to find all the needed information on this matter!

Importance of Secure Credit Card Payment Processing

The healthcare industry has to face a ton of regulations and the ones about securing protected health information (PHI) are the costliest. A single breach can cost up to $50,000 and a lost reputation.

Name, date of birth, credit card number, information from the medical record, and insurance are considered to be protected health information, so according to the HIPAA requirements merchants and payment systems should keep this data confidential during the billing process.

How Are Credit Card Payments Processed?

Processing credit cards in healthcare should be considered and paid close attention to. There are 5 parties involved in processing a single payment:

• the cardholder, the one who possesses the card
• the credit card issuer, a financial institution (bank or credit union) who gave the cardholder the card
• the healthcare provider, the party who accepts the payment
• the credit card brand, a part of credit card network, such as Visa, Mastercard, American Express
• the credit card network, the one that enables a credit card transaction between the healthcare provider and the card issuer

The payment begins when the cardholder sends a request by swiping their card on a reader of the healthcare provider. The request is then received by the credit card processor and sent further to the credit card network. The latter turns to the credit card issuer and they decide whether the payment will go through. A financial institution checks the account of the cardholder and their credit history.

If everything is fine, a credit company approves the transaction, the approval is received by the credit card network, then by the processor, and finally by the healthcare provider.

However, it may happen that:

• the cardholder does not have enough money
• the card was blocked or known as stolen
• the credit history is bad and the credit card issuer is unwilling to give any more money

So basically, the main role in the process belongs to the credit card issuer.

Credit Card Processing and HIPAA Compliance

The question is whether you should be actually concerned about credit card processing in relation to HIPAA regulations. After all, personal information is exchanged during the payment. So, HIPAA and credit card processing, do they go hand in hand together?

If a bank or credit company processes the payments exclusively, they do not have to be HIPAA-compliant. Payment processing is not a HIPAA-covered function or activity, it is just regular banking.

The situation is different when a financial institution provides other services as well (for example, practice management or medical billing). You have to sign a business associate agreement then and check whether the institution is HIPAA-compliant.

What are the HIPAA requirements for the online payment processing? To have all the possible security measures in hand, both digital and physical to protect sensitive personal and financial information. Otherwise, you will face consequences in the form of legal proceedings and fines when the breach of PHI occurs.

4 Best HIPAA Compliant Credit Card Processing Practices

It is not only the business associate agreement that has to be signed before the HIPAA compliant medical payment processing. Healthcare organizations should consider a list of important criteria to ensure that the patient’s health information is stored securely and will not find its way to cybersecurity criminals and the darknet.

Some of the best practices that any hospital can use for implementing HIPAA compliant credit card processing are:

Choosing the Payment Processor Wisely

One of the best HIPAA compliant credit card processing solutions is to choose the processor very thoroughly. The first thing you have to check is whether they follow Payment Card Industry Data Security Standards (PCI DSS). Normally, all processors who care about their reputation and clients adhere to those. PCI DDS includes erasure of authentication data, limiting the amount of retained data, response to breaches, secure payment card apps, controlling access to the data, and encryption (transforming data to the point where it is unrecognizable at sight, and you need a key to bring it back to normal). There are a lot of security measures and most of them are stated in HIPAA as well.

If you have found such a processor, you can afterward ask them directly whether they offer HIPAA compliant credit card processing services. You need to be 100% sure about the PHI security. After all, if the data is breached by the business associate, you will be held liable as well.

If a processor is HIPAA-compliant, they will never send receipts via non-secure email or text messages, but it is better to double-check whether they avoid doing so.

Use Payment Terminals that Support EMV Chip

The credit cards with the magnetic stripe were proved to be not really secure, so today 83.1% of global transactions are conducted via EMV cards.

The EMV chip is an additional security measure that aims at decreasing the rate of credit card fraud. EMV chips encrypt the information uniquely every time it is accessed. The chip looks like a shiny square on the front of the card. One inserts the card into the payment terminal to initiate the transaction. It is also called dipping.

Payment terminals with EMV chip readers are more expensive but the investment is worth it. It will help you avoid costly fines for neglecting payment card security compliance requirements.

Make Sure to Utilize vP2PE

Consider using the modern encryption technology for payment data security as PCI validated point-to-point encryption. It encrypts the data as soon as the card is swiped or dipped and there is no way that cybersecurity criminals can copy clear data before it reaches the payment gateway. All they will gain access to is the data that can not be deciphered.

This type of encryption is one of the best for patient payment processing and ensures security at all stages.

Develop Custom HIPAA-Compliant Payment Solution

There is a variety of HIPAA compliant electronic payments software available on the market, however, you can consider developing your own solution that would meet your business needs to the fullest extent. Your custom software needs to have the following features:

• End-to-end encryption to ensure the confidentiality of patient data
• In-depth reporting capabilities so you can monitor and analyze the payment history
• Ability for patients to view their bills on the outward-facing second screen and choose between NFC contactless, EMV chip or magstripe card, and other payment methods.

How Langate Can Help with HIPAA Compliant Payment Processing?

Langate has been working in the healthcare industry for more than 10 years now. We know everything about HIPAA-compliant development and how to secure PHI.

In terms of payment processing, we can help you to figure out the encryption part. Our cybersecurity professionals will find a fitting solution for you. It will ensure the unrecognizability of the data on all the stages of the process, may it be storing credit card information for billing purposes or processing the payment.

Our Case

One of our clients is an international provider of IT and financial services for healthcare organizations with offices in New York, Israel, and India. They contacted Langate because they needed to create a system that would be able to manage the full cycle of billing management for various nursing facilities they work with.

Lange created a solution that processed massive amounts of data, encrypt all the sensitive information, securely stores and manages it.

The solution developed by Langate helped to ensure the full confidentiality of the processed data, so our client has managed to become one of the leaders in its niche, significantly increasing its customer base from year to year.

Conclusion

Credit card payment processing does not always have a clear connection to HIPAA-compliance. However, if the processor provides other services (as medical billing), it will be considered as a business associate and has to be compliant.

As long as you have a processor that is compliant with Payment Card Industry Data Security Standards and HIPAA, and your employees know how to handle the sensitive data, you are fine. We recommend additionally work on encryption and invest in payment terminals with EMV chip readers.

If you need someone to level up your encryption game, do not hesitate to reach out to Langate! Our cybersecurity professionals will provide you with a reliable solution in no time.