Healthcare security planning
How to include payment systems in a healthcare security risk assessment
Include payment-related systems that create, receive, maintain, or transmit ePHI in the assessment scope. Map the information, identify threats and existing safeguards, and assign owners to address the risks you find.
By Fluid Financial · Sources reviewed November 5, 2026
Connect the payment review to the wider assessment
A practice may review processing fees, terminal uptime, and settlement accuracy without examining the patient information around those transactions. The security assessment is a place to bring those questions together with the organization’s broader work on ePHI.
HHS risk-analysis guidance covers identifying relevant ePHI, assessing threats and vulnerabilities, evaluating existing safeguards, and documenting risk levels. It does not prescribe one methodology for every organization.
Source: HHS risk-analysis guidance.
The workflow below is a suggested way to organize the payment portion of that work. It is not a substitute for assessing the rest of the organization.
Define the scope before gathering documents
List locations, terminals, portals, practice-management connections, reporting exports, and support channels. For each, establish whether ePHI is actually involved. Record who operates the component and who can change its configuration.
Use a fabricated transaction to identify where information travels. Include an ordinary payment and an exception such as a refund. Ask operations staff to explain how the transaction is reconciled, because that process can reveal outputs absent from a vendor’s initial diagram.
Build a payment risk register
| Review area | Illustrative question | Record to keep |
|---|---|---|
| Data entry | Could optional fields receive unnecessary patient information? | Field inventory and approved entry instructions. |
| User access | Can former staff or overly broad roles access reports? | Role list, account owner, and access-review findings. |
| Connected systems | Does an export send more information than its recipient needs? | Integration map and sample output. |
| Service interruption | How would staff handle payments and reconciliation during an outage? | Approved contingency workflow and recovery responsibilities. |
| Exceptions | Do refunds or support requests introduce new information? | Synthetic examples, identified concerns, and assigned actions. |
Distinguish evidence from assurances
For each concern, record the existing safeguard, evidence inspected, remaining uncertainty, and responsible owner. Use your organization’s method to assess likelihood and impact. Set a follow-up date for missing evidence rather than marking a question resolved because a brochure describes a security feature.
NIST SP 800-66 Revision 2 provides practical resources for understanding and implementing the HIPAA Security Rule. It can support the wider assessment team’s work.
Assess MedToken at its specific handoff
MedToken’s published architecture places PHI filtering and second-token creation at the transaction processor before onward financial-services processing. If evaluating MedPay+, which combines MedToken and merchant processing, ask for evidence about the agreed fields, channels, and configuration.
Record that handoff in the risk register alongside systems before and after it. A privacy step at one point in the workflow does not settle the access, retention, availability, or vendor questions elsewhere. Review the MedToken architecture.
Revisit the assessment when the workflow changes
Define review triggers such as a new location, payment channel, integration, processor, or reporting feature. Compare the changed workflow with the approved record, update open actions, and confirm who accepts any remaining risk. Keep the assessment connected to operational decisions rather than treating it as a one-time procurement file.
Continue your payment privacy review
Sources and publication information
- HHS: Guidance on Risk Analysis Requirements
- NIST SP 800-66 Revision 2: HIPAA Security Rule Resource Guide
Original analysis by Fluid Financial. Published November 5, 2026. The checklists are practical discussion tools; apply regulatory requirements to your circumstances with your privacy and compliance advisers.
Review your healthcare payment workflow
Discuss MedToken, your processing requirements, and how MedPay+ could fit your organization.
Request a Technical Review