> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specode.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# Payment Processing Guide
> How to choose the right payment processor for your healthcare app.
## Choosing the Right Payment Processor
Not all payment processors work for all healthcare apps. Two independent factors determine which processor is right for your app:
1. **The processor's business category rules** - some processors restrict or prohibit certain healthcare business types (telehealth, pharmacy, prescription drugs) regardless of how you handle data.
2. **HIPAA and PHI requirements** - if protected health information (PHI) could appear in payment records, you need a processor that signs a Business Associate Agreement (BAA).
Both factors must be satisfied. An app can pass the HIPAA test but still be blocked by a processor's category restrictions, or vice versa.
## When to Use Stripe
Stripe is the easiest payment integration and works well for many healthcare apps. Use Stripe when **all** of the following are true:
* It sells non-clinical wellness, fitness, education, general memberships, or content subscriptions
* No diagnosis or treatment is delivered through the app
* No prescription is written, sold, or delivered through the app
* No PHI (diagnosis, treatment notes, CPT codes, visit reason, or clinical metadata) is sent to or stored in the payment record
**Examples where Stripe works:** wellness coaching memberships, fitness tracking subscriptions, mental health education content, supplement stores (no health claims), general health content platforms.
Bare payment processing is exempt from HIPAA's BAA requirements under [Section 1179](https://www.law.cornell.edu/uscode/text/42/1320d-8) of the Social Security Act. This means a qualifying app can use Stripe legally as long as no PHI enters the transaction record - use generic statement descriptors (e.g., "SMITH MEDICAL PA" not "SMITH ONCOLOGY") and keep clinical details out of metadata, invoice line items, and receipts.
## Stripe for Healthcare Apps (Restricted Categories)
Stripe's [Restricted Businesses policy](https://stripe.com/legal/restricted-businesses) classifies telemedicine/telehealth services, online pharmacies (including SaaS platforms), prescription pharmaceuticals, and prescription medical devices as **restricted categories**. This means these business types require Stripe's approval before they can process payments - they are not automatically available. Stripe also does not sign a BAA.
**Specode helps navigate Stripe's approval process.** Our team works directly with Stripe to help customers in restricted healthcare categories get approved on a case-by-case basis. If your app falls into a restricted category, talk to the Specode team before assuming you need a different processor - we may be able to get you approved for Stripe.
**Consider a BAA-signing processor if ANY of these apply to your app:**
1. The app provides telemedicine or telehealth consultations involving diagnosis or treatment (synchronous or asynchronous)
2. A clinician prescribes medication through the app - even if the prescription is sent to an outside pharmacy
3. The app sells, dispenses, or facilitates prescription pharmaceuticals, or operates as an online pharmacy
4. The app sells prescription-only or regulated medical devices
5. Clinical PHI would appear in transaction descriptors, invoice line items, metadata, or receipts
6. The app offers insurance products with medical benefit packages
These categories are restricted by Stripe but **not necessarily blocked** - the Specode team can help assess your specific situation and facilitate the approval process. Alternative processors remain a solid option if Stripe approval is not viable or if you need a processor that signs a BAA.
## Recommended Processors by Use Case
### For Clinical Billing (Non-Prescribing)
These processors sign BAAs and work well for clinical practices that bill for services but don't prescribe or dispense medication through the app:
| Processor | BAA | Recurring Billing | Notes |
| -------------------------------------------------------- | --- | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| [Helcim](https://www.helcim.com/healthcare/) | ✅ | ✅ | Formal HIPAA program with annual audit. Good for general clinical practices. |
| [Rectangle Health](https://www.rectanglehealth.com/) | ✅ | ✅ | Healthcare-specialized. Integrates with 50+ healthcare systems. |
| [InstaMed](https://www.instamed.com/) (JPMorgan Chase) | ✅ | ✅ | Purpose-built for healthcare payments. Best for mid-to-large healthcare organizations. |
| [Square](https://squareup.com/us/en/legal/general/hipaa) | ✅ | ✅ | Signs a BAA for permitted-category clinical billing. **Not for prescribing telehealth or Rx** - Square's terms restrict telemedicine and prohibit online pharmacy. |
### For Telehealth and Rx (High-Risk)
These processors specialize in high-risk healthcare verticals including prescribing telehealth and pharmacy:
| Processor | BAA | Telehealth | Rx/Pharmacy | Gateway |
| -------------------------------------------------------------------- | --- | ---------- | ----------- | --------------------- |
| [PaymentCloud](https://paymentcloudinc.com/industries/telemedicine/) | ✅ | ✅ | ✅ | Authorize.net, NMI |
| [Corepay](https://corepay.net/) | ✅ | ✅ | ✅ | LegitScript-certified |
| [Payment Nerds](https://paymentnerds.com/) | ✅ | ✅ | ✅ | Authorize.net, NMI |
| [Seamless Chex](https://seamlesschex.com/telemedicine/) | ✅ | ✅ | ✅ | No volume caps |
All of these support recurring billing and card-not-present transactions.
## Hybrid / Split-Processor Architecture
Apps that combine clinical and non-clinical revenue can use both processors simultaneously:
* **Stripe** handles non-clinical revenue (wellness memberships, general content, supplements)
* **BAA-signing processor** handles clinical/Rx revenue (telehealth consults, prescriptions)
**Common pattern for prescribing apps:** Bill the patient for the clinical service (e.g., telehealth consultation) through a BAA-signing processor, and have a partner pharmacy charge the patient directly for the medication. This keeps your payment account clean and avoids regulatory issues.
The Specode AI coder can integrate multiple payment processors in the same app - just describe the split in your chat.
## PHI Segregation Rules
Regardless of which processor you use, follow these rules to keep PHI out of payment records:
* Use generic statement descriptors (e.g., "SMITH MEDICAL PA" not "SMITH ONCOLOGY")
* Keep transaction metadata limited to name, amount, and non-clinical service description
* Put diagnosis, treatment, or visit reason in transaction metadata
* Include CPT codes in invoice line items
* Add clinical details to email receipts or refund notes
* Use condition-revealing statement descriptors
## LegitScript Certification
If your app processes card-not-present payments for medication sales, Visa and Mastercard require [LegitScript certification](https://www.legitscript.com/). This applies to online pharmacies, prescription delivery services, and telehealth platforms that facilitate medication purchases. Several high-risk processors (Corepay, PaymentCloud) can help you through the LegitScript certification process.
## Integration in Specode
The Specode AI coder can integrate any payment processor that provides an API. The process is the same regardless of processor:
1. Tell the AI which processor you want to integrate
2. Ask what credentials you need
3. Sign up with the processor and get your API keys
4. Add credentials to your project settings
5. Tell the AI to verify the integration
See [Integrations](/overview/configuration-deployment/integrations) for the general setup workflow.