HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Is Square HIPAA Compliant?

Answering the question is Square HIPAA compliant is a little complicated because, although Square is HIPAA compliant for some services offered by the company, it is not necessary for Square to be HIPAA compliant for others.

Square is a multi-tool business solution that started life as point-of-sale payment processing system (hence the URL www.squareup.com). In recent years, it has extended its services to include an ecommerce platform, team management software, payroll services, and much more. In December 2021, the company changed its name to Block, but still provides services under the Square brand.

For HIPAA Covered Entities wishing to use Square´s services, the issue of is Square HIPAA compliant is a little complicated because, when a Covered Entity only uses Square for its payment processing services, compliance with HIPAA is not required. This is because financial institutions are exempted from Privacy Rule standards when processing payments for health plan premiums or health care.

This exemption appears in the original 1996 text of HIPAA (§ 1179) and was confirmed by the Department of Health & Human Services (HHS) in the preamble to the 2013 Final Omnibus Rule – HHS noting that the HIPAA Rules, including the Business Associate provisions, do not apply to financial institutions with respect to the payment processing activities identified in § 1179.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

However – importantly in the context of is Square HIPAA compliant – if a financial institution provides services to a Covered Entity other than exempted activities (i.e., performing accounts receivable functions on behalf of a Covered Entity), the financial institution then operates as a Business Associate for those services and needs to be HIPAA compliant.

When does Square Need to be HIPAA Compliant?

Square needs to be HIPAA compliant for any services other than payment processing which involve the creation, receipt, storage, or transmission of Protected Health Information (PHI). For example, if a Covered Entity takes advantage of Square´s email and SMS marketing platform, the Covered Entity must ensure Square has appropriate measures in place to ensure the confidentiality, integrity, and availability of PHI maintained on or transmitted by the platform.

Additionally, when using any service other than Square´s payment processing services which involve the use or disclosure of PHI, the Covered Entity must enter into a Business Associate Agreement (BAA) with Square. The company provides a draft BAA on its website, and it is recommended Covered Entities review the draft before agreeing with its terms and conditions or requesting amendments to meet any unique requirements.

Notably, Square states on its website that “sellers (e.g., Covered Entities and Business Associates) are responsible for determining whether they are subject to HIPAA requirements and whether they intend to use the services in connection with PHI”. If your organization is unsure of its obligations under HIPAA in respect of Square services, it is advisable to seek professional compliance advice as Square support is extremely limited.

Conclusion: Q: Is Square HIPAA Compliant? A: Yes – When You Need It to Be

Square offers a range of business solution tools that can help Covered Entities work more efficiently and streamline healthcare operations. When these operations involve the creation, receipt, storage, or transmission of PHI, Square has the necessary safeguards in place to ensure the confidentiality, integrity, and availability of PHI, and the company is willing to enter into a BAA when required.

However, a BAA is not required if you only use Square for payment processing purposes; and, in this respect, it is important to be aware that although Square is a financial services company and not a bank, its financial services are operated by a fully owned subsidiary that has received an Industrial Loan Company bank charter and that is FDIC-insured.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.