While credit card processing itself is considered to be outside the scope of HIPAA, patient cardholder data (including name, billing address, etc.) are classified as protected health information (PHI) and must be secured according to HIPAA requirements. To ensure HIPAA compliance, you will also need to enter into a Business Associate Agreement (BAA) with your chosen credit card processor.