Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
When users enable services that provide Stripe access to third-party data including personal data, users authorize that access and are solely responsible for obtaining all necessary consents; users are expressly prohibited from providing Protected Health Information to Stripe and bear liability for any PHI disclosure.
This analysis describes what Stripe's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision places the consent and legal authorization burden entirely on the user for third-party personal data provided to Stripe, and establishes user liability for any Protected Health Information transmitted to Stripe regardless of whether the transmission was intentional.
The agreement establishes that users are responsible for obtaining all necessary rights and consents from individuals whose third-party data is provided to Stripe through enabled services; users bear full liability for any Protected Health Information disclosed to Stripe through third-party data access, as stated in Section 4.5.
Cross-platform context
See how other platforms handle Third Party Data Authorization and PHI Prohibition and similar clauses.
Compare across platforms →Monitoring
Stripe has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"If User enables Services or functionality that provide Stripe access to data, including Personal Data and Content, from User's third party service providers ('Third Party Data'), then User authorizes Stripe to access and use the Third Party Data, and User must obtain all necessary rights and consents from the applicable individuals and third parties sufficient to enable Stripe to lawfully collect, use, retain, and disclose the Third Party Data. Stripe will use Third Party Data as this Agreement describes and to (a) secure, provide, and update the Stripe services, (b) comply with Law and Financial Provider requirements, and (c) prevent and mitigate fraud, financial loss, and other harm. User must not provide Protected Health Information to Stripe as part of Third Party Data. User is liable for any disclosure of Protected Health Information to Stripe when User provides access to the Third Party Data.Excerpt from Stripe's Terms of Service
1. REGULATORY LANDSCAPE: The prohibition on providing Protected Health Information to Stripe and associated user liability provision directly engages HIPAA; Stripe is not designated as a HIPAA Business Associate under this agreement, and the PHI prohibition reflects this. GDPR and CCPA engage the third-party data consent requirement; users must obtain data subject consent or establish another lawful basis for processing before enabling Stripe access to personal data from third-party providers. Enforcement authority includes HHS Office for Civil Rights for HIPAA-related PHI disclosures. 2. GOVERNANCE EXPOSURE: High for healthcare-adjacent businesses. The agreement places liability for PHI disclosure entirely on the user, meaning that inadvertent transmission of PHI through API integrations or third-party data enablement creates user liability without any Stripe assumption of HIPAA obligations. Technical safeguards to prevent PHI from entering Stripe data flows are the user's responsibility. 3. JURISDICTION FLAGS: Healthcare-adjacent businesses in any US jurisdiction must assess whether their Stripe integrations could result in PHI transmission. GDPR and CCPA create heightened obligations for users enabling third-party personal data access, requiring lawful basis documentation and consent management that the agreement assigns entirely to the user. 4. CONTRACT AND VENDOR IMPLICATIONS: Organizations in healthcare, health-adjacent, or health insurance sectors using Stripe integrations that access third-party data should conduct technical audits to confirm PHI is not transmitted through enabled services. Data mapping should identify all third-party data sources that flow to Stripe through API or service integrations. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should establish technical controls to prevent PHI from entering Stripe data flows and conduct periodic audits of third-party data integrations. Consent management programs should be reviewed to ensure lawful basis documentation covers Stripe's authorized data uses as described in Section 4.5. Legal teams should assess whether existing HIPAA compliance programs address the PHI prohibition and user liability established in this provision.
This provision places the consent and legal authorization burden entirely on the user for third-party personal data provided to Stripe, and establishes user liability for any Protected Health Information transmitted to Stripe regardless of whether the transmission was intentional.
The agreement establishes that users are responsible for obtaining all necessary rights and consents from individuals whose third-party data is provided to Stripe through enabled services; users bear full liability for any Protected Health Information disclosed to Stripe through third-party data access, as stated in Section 4.5.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Stripe.