Healthcare tokenization guide
Card tokenization and PHI protection: understanding the difference
Card tokenization replaces payment credentials with substitute values. PHI protection also requires attention to patient information elsewhere in the workflow. Evaluate what a token replaces and what information remains alongside it.
By Fluid Financial · Sources reviewed November 5, 2026
Two questions for every healthcare payment
First, how are payment account details protected? Second, what patient-related information is collected, attached, retained, or shared? These questions overlap in a payment workflow, but they call for different evidence.
Consider a fabricated payment record with a card token, transaction amount, and an optional note containing a patient name and treatment description. Replacing the card number does not itself remove the note. This is an illustrative review scenario, not a statement that every processor includes those fields.
Compare the controls
| Control | Purpose | What to ask |
|---|---|---|
| Card tokenization | Replace payment credentials with a token used in the relevant payment system. | Which credentials are replaced, where are originals held, and who can resolve or reuse the token? |
| Encryption | Protect information using cryptographic keys. | Which fields are encrypted, where are they decrypted, and who manages access and keys? |
| Data minimization | Limit information collected or transmitted to what the defined purpose needs. | Which fields can be removed or omitted before another recipient receives the package? |
| MedToken | Filter unnecessary PHI at the transaction processor and create a second token before financial-services processing. | Which fields are removed and retained in the proposed deployment, and which channels are supported? |
Tokenization and PCI DSS scope
PCI SSC distinguishes EMV payment tokens outside a token service provider’s token data environment from account data. Its guidance also explains that systems handling account data, or connected to systems that do, can remain in PCI DSS scope. Tokenization therefore calls for a scope review of the actual environment.
Source: PCI Security Standards Council FAQ on payment tokens.
Do not assume every token has identical properties. Ask which tokenization model is used and what its protections mean for your terminals, integrations, and reporting systems. The answer should identify the particular solution and configuration.
Removing a field is different from proving de-identification
HHS identifies Expert Determination and Safe Harbor as the two HIPAA de-identification methods. Replacing an identifier with a token or removing selected fields does not, on its own, demonstrate that either method has been satisfied.
Source: HHS de-identification guidance.
Describe the intended outcome precisely. A review may establish that a particular recipient receives fewer fields without establishing that every output is legally de-identified. Ask how remaining references, dates, and linked systems affect the assessment.
How MedToken adds a privacy step
MedToken’s published workflow starts with a first token created at the point of sale. The transaction processor filters unnecessary PHI and creates a second token for transmission to the financial-services provider. Read the published application reference.
MedPay+ combines this privacy technology with merchant processing. A technical review should identify the fields involved and confirm the agreed deployment rather than treating the diagram as proof of every integration or channel.
Use a before-and-after comparison
- Prepare a synthetic payment with the optional fields your practice expects to use.
- Compare the original package with the package received by the next service provider.
- Trace transaction references into receipts, reports, logs, refunds, and reconciliation.
- Record what changed, what remains, and who can access each output.
Use the processor question checklist and vendor data minimization guide to turn the comparison into a procurement record.
Sources and further reading
Original analysis by Fluid Financial. Published November 5, 2026. Regulatory guidance is general information; evaluate its application to your services with your privacy and compliance advisers.
Review your healthcare payment workflow
Discuss MedToken, your processing requirements, and how MedPay+ could fit your organization.
Request a Technical Review