Federal data privacy guide
EO 14117, healthcare payments, and the DOJ Data Security Program.
Understand where MedPay+ and MedToken fit in a healthcare payment-data privacy review under Executive Order 14117 and 28 CFR Part 202.
By Fluid Financial · Sources reviewed November 5, 2026
How MedPay+ supports a payment-data privacy review
MedPay+ combines MedToken data privacy technology with merchant processing. MedToken is the privacy technology; MedPay+ is the complete healthcare payment offering.
MedToken is Fluid Financial’s patent-pending data privacy technology. It is designed to remove unnecessary protected health information (PHI), including electronic PHI (ePHI), from a payment data package and generate a second token before that token is sent to the bank or financial-services provider for processing.
The published architecture provides a basis for evaluating this focused data-minimization step within a provider’s broader privacy-control strategy. It does not, by itself, establish compliance with the DOJ Data Security Program (DSP), HIPAA, or state law. Validate the deployed workflow and the scope of any assessment before relying on a compliance claim.
Review the published MedToken architecture · Explore MedPay+.
What Executive Order 14117 addresses
DOJ’s DSP implements EO 14117. It prohibits or restricts certain transactions that give countries of concern or covered persons access to U.S. government-related data or Americans’ bulk sensitive personal data, including health and financial data. It is a transaction-focused national-security program, rather than a general certification for healthcare payment technology.
Source: DOJ Data Security Program overview.
Determine which transactions are covered
Review data brokerage, vendor, employment, and investment arrangements. Personal health data has a bulk threshold of more than 10,000 U.S. persons, subject to aggregation rules; other categories and government-related data require separate analysis. Tokenization or encryption alone does not remove covered data from scope.
Section 202.505 exempts certain transactions ordinarily incident to and part of financial services, including specified payment activities. This is not an entity-wide exemption: assess the particular transaction and any separate cloud, support, analytics, or other access arrangement.
Sources: 28 CFR §§ 202.205–202.206, § 202.505, and DOJ FAQs, including FAQ 75.
Map the privacy feature to the wider control environment
| Review area | MedToken’s focused role | Evidence needed for the wider review |
|---|---|---|
| Payment data minimization | Designed to remove unnecessary PHI before the second token goes to the financial-services provider. | Synthetic before/after packages; retained fields; token linkage; downstream destinations. |
| Restricted-transaction security | Evaluate the privacy step against the proposed data flow. | CISA organizational, system, and data-level controls; access restrictions; security logs; risk assessment; testing. |
| Vendor and access review | Product descriptions identify the payment-processing boundary. | Actual service providers, ownership, support access, subcontractors, hosting, and permitted data uses. |
| Governance and assurance | A technology control is one part of an operating program. | Where applicable: documented due diligence, annual independent audit, officer certifications, records, and required reporting. |
Sources: CISA security requirements for restricted transactions and DOJ Compliance Guide. This table is a review framework, not a completed assessment of MedPay+.
Questions healthcare providers should resolve
- Which payment fields and associated records are actually necessary?
- Who can access the first token, second token, linkage information, logs, backups, and support systems?
- Which payment transactions are exempt, restricted, prohibited, or outside scope?
- What assessment covers this specific MedPay+ configuration, and which controls remain the provider’s responsibility?
- How do online payments, recurring payments, refunds, and other exceptions change the analysis?
Use fabricated patient and test payment information for demonstrations. Ask your compliance team to review the complete arrangement; HIPAA status alone does not resolve the separate DSP analysis.
EO 14117 and MedPay+ questions
Does MedPay+ automatically satisfy EO 14117 and 28 CFR Part 202?
MedPay+ includes MedToken, a focused payment-data privacy control. Full compliance depends on the applicable transactions, parties, data, safeguards, and operating procedures. Request an assessment and control mapping for the specific deployment.
Does tokenization remove data from the DOJ Data Security Program?
Not automatically. The definition of bulk U.S. sensitive personal data includes anonymized, pseudonymized, de-identified, and encrypted data. Review the actual data and access arrangements rather than assuming a token creates an exemption.
How can healthcare providers evaluate MedToken for data minimization?
Compare synthetic payment packages before and after filtering at the transaction processor. Confirm removed fields, retained identifiers, token linkage, downstream access, and exception workflows. The published architecture is a starting point; validate the deployed configuration.
Federal and state privacy reviews belong together
Healthcare organizations should also evaluate applicable state health-data, consumer privacy, security, and breach-notification requirements. Read the state health-data privacy guide.
General product-evaluation information, not legal advice or a compliance certification. Sources reviewed November 5, 2026. Requirements and applicability can change.
Review your payment-data privacy controls
Discuss MedToken data flows, MedPay+ deployment scope, and the evidence your technical and compliance teams need.
Request a Technical Review