Is Square HIPAA Compliant?
Square is HIPAA compliant for some services offered by the company and will enter into a Business Associate Agreement for these services; but, if a covered entity uses Square solely as a payment processor, it is not necessary for Square to be HIPAA compliant or enter into a Business Associate Agreement.
Square is a multi-tool business solution that started life as point-of-sale payment processing system. In recent years, it has extended its services to include an ecommerce platform, team management software, payroll services, and much more. In December 2021, the company changed its name to Block, but still provides services under the Square brand.
For HIPAA covered entities wishing to use Square´s services, the issue of is Square HIPAA compliant is a little complicated because, when a covered entity only uses Square for its payment processing services, compliance with HIPAA is not required. This is because financial institutions are exempted from HIPAA compliance when processing payments for health plan premiums or health care.
This exemption appears in the original 1996 text of HIPAA (§ 1179) and was confirmed by the Department of Health & Human Services (HHS) in the preamble to the 2013 Final Omnibus Rule – HHS noting that the HIPAA Rules, including the business associate provisions, do not apply to financial institutions with respect to the payment processing activities identified in § 1179.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
However – and relevant to the question of is Square HIPAA compliant – if a financial institution provides services to a covered entity other than exempted activities (i.e., performing accounts receivable functions on behalf of a covered entity), the financial institution then operates as a business associate for those services and needs to be HIPAA compliant.
When does Square Need to be HIPAA Compliant?
Square needs to be HIPAA compliant for any services other than payment processing which involve the creation, receipt, storage, or transmission of Protected Health Information (PHI). For example, if a covered entity takes advantage of Square´s email and SMS marketing platform, the covered entity must ensure Square has appropriate measures in place to ensure the confidentiality, integrity, and availability of PHI maintained on or transmitted by the platform.
When using any service other than Square´s payment processing services which involve the use or disclosure of PHI, the covered entity must also enter into a Business Associate Agreement (BAA) with Square. The company provides a draft BAA on its website, and it is recommended covered entities review the draft before agreeing with its terms and conditions or requesting amendments to meet any unique requirements.
Also, Square states on its website that “sellers (e.g., covered entities and business associates) are responsible for determining whether they are subject to HIPAA requirements and whether they intend to use the services in connection with PHI”. If your organization is unsure of its obligations under HIPAA in respect of Square services, it is advisable to seek professional compliance advice as Square support is extremely limited.
Conclusion: Q: Is Square HIPAA Compliant? A: Yes – When You Need It to Be
Square offers a range of business solution tools that can help covered entities work more efficiently and streamline healthcare operations. When these operations involve the creation, receipt, storage, or transmission of PHI, Square has the necessary safeguards in place to ensure the confidentiality, integrity, and availability of PHI, and the company is willing to enter into a BAA when required.
However, a BAA is not required if you only use Square for payment processing purposes; and, in this respect, it is important to be aware that although Square is a financial services company and not a bank, its financial services are operated by a fully owned subsidiary that has received an Industrial Loan Company bank charter and that is FDIC-insured.
