Introducing the Chargebee CLI
chargebee docs

HIPAA Configurations & Guidelines

Chargebee supports HIPAA compliance for its core billing and subscription management platform (Chargebee Billing). When a customer notifies Chargebee that they intend to disclose ePHI while using Chargebee Billing, Chargebee may review whether that disclosure is necessary and may execute a business associate agreement (BAA) for Chargebee Billing.

Unless a BAA is executed by Chargebee with a customer, the customer is prohibited from sharing any ePHI with Chargebee.

Additionally, even if a BAA is executed by Chargebee with the customer, it only applies to Chargebee Billing and does not apply to any other component, product or service that Chargebee provides or makes available, including:

  1. Any middleware, integrations or other components that are capable of being used in conjunction with the platform.
  2. Other products or services such as Chargebee Receivables, RevRec, Retention/Growth, or Reveal.

The validity of the BAA is subject to continued compliance by the customer to the mandatory configuration requirements relating to Chargebee Billing set forth below.

Mandatory Configuration Requirements

Given below is the list of mandatory requirements for HIPAA compliance for Chargebee Billing.

  1. Custom SMTP: Chargebee Billing can send email through Chargebee's SMTP server or the customer's SMTP server. A HIPAA-compliant account must use the customer's own SMTP server so the customer controls incoming and outgoing email. Do not use Chargebee's SMTP servers. The customer manages the custom SMTP server. See SMTP configuration.

  2. Abandoned Carts: Chargebee offers a report for tracking abandoned carts. It counts visitors who leave checkout without completing a purchase. This Classic report uses geolocation. On a HIPAA-compliant account, disable it: log in to your Chargebee site and go to Settings > Configure Chargebee > Checkout and Self-Serve Portal, then disable Track abandoned carts.

  3. Taxes: Chargebee can verify customer tax details for tax calculation in certain countries. On a HIPAA-compliant account, disable this: log in to your Chargebee site and go to Settings > Configure Chargebee > Taxes, then clear Enable location validation.

  4. E-Invoicing: Chargebee can generate, transmit, and manage electronic invoices for supported countries. On a HIPAA-compliant account, either keep ePHI and other HIPAA-covered transactions out of e-invoicing, or disable the feature. Log in to your Chargebee site, go to Settings > Configure Chargebee > E-invoicing, and click Disable > Confirm. See E-Invoicing.

  5. Auto-complete address in Checkout and Self-Serve Portal: Chargebee can auto-complete addresses in checkout and the self-serve portal. On a HIPAA-compliant account, disable it. Log in to your Chargebee site and go to Settings > Configure Chargebee > Checkout and Self-Serve Portal > Advanced Settings, then turn off Autocomplete addresses. See Hosted Checkout.

  6. Atomic Pricing: Chargebee lets you embed pricing tables on your website with a frontend integration. Do not enable this feature on a HIPAA-compliant account.

  7. Payment gateways: On a HIPAA-compliant account, use a direct gateway integration where Chargebee provides one. Where Chargebee connects through a payment aggregator, either keep ePHI and other HIPAA-covered transactions off that gateway or use your own direct integration. This applies to BlueSnap, Cybersource, NMI, Ecentric, Windcave, JPM Mobility gateway, Pin Payments, eWay Rapid, Worldpay, Sage Pay, Ogone (Ingenico), Beanstream (Bambora), Paymill, dLocal, Metricsglobal, Nuvei, Paypal Pro, Orbital (Chase), Paypal Payflow, Moneris, BluePay, and Elavon.

  8. Customer must not submit any ePHI or other information subject to HIPAA as part of the inputs provided to any of the AI capabilities offered by Chargebee. Customers must also not cause any such ePHI or information to be processed by the AI capabilities (for example, in response to the inputs/prompts provided to the AI capabilities or otherwise through any configuration or use of the Chargebee services).

  9. Do not submit ePHI to Chargebee's pre-release offerings.

Contact your account manager or Chargebee Support with questions.