The US Department of Health and Human Services (HSS.gov) has stated that credit card processing does not fall within the scope of HIPAA as no health record information is being stored - only card payment information and collecting payments is excluded explicitly from HIPAA mandates. See 45 CFR 164.502(e), 164.504(e), 164.532(d) and (e) https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
