Do healthcare payment processing vendors have to be HIPAA-compliant?

“Yes, a healthcare payment processing provider is generally required to be HIPAA-compliant if they handle or process protected health information (PHI) on behalf of covered entities, such as healthcare providers, health plans, or healthcare clearinghouses. This is because the healthcare payment processing provider would be considered a business associate under HIPAA.”