Payment processing for telehealth + compound pharmacy

Each clinic or platform routes as a sub-brand under the parent acquirer. Per-brand descriptors preserve clinic identity on statements. Refund flows stay per-clinic. multiflow doesn't touch clinical data — patient intake, script verification, HIPAA-scoped PHI all live in your telehealth platform + EHR.

For portfolios running men's clinic + women's clinic + weight-loss + peptide-adjacent, consolidation at the parent simplifies the ops picture. Adding a new clinic = new sub-brand + new descriptor, not new merchant account.

HSA/FSA cards require specific MCC coding to clear. Common telehealth-friendly MCCs:

• 8099 (Medical Services — professional services): typically accepts HSA/FSA
• 5122 (Drug Stores / Drug Proprietaries): may or may not — varies by card issuer
• 5912 (Drug Stores, Pharmacies): often accepts HSA/FSA
• 8011 (Doctors): accepts HSA/FSA

The acquirer assigns MCC. If HSA/FSA is strategic for you, confirm the MCC before onboarding — post-approval MCC changes are renegotiations.

Payment data under 45 CFR 164.501 financial transaction exemption is narrowly out of HIPAA scope. multiflow stores no PHI — no patient name tied to clinical diagnosis, no script data, no intake forms. What we store: charge amount, descriptor, sub-brand, legal entity, payout destination. Standard payment metadata.

In edge cases where payment metadata might overlap with PHI (e.g., charge description includes medication name), we execute a BAA. Most operators don't need this — medication names stay in the EHR + pharmacy systems, not in the descriptor.

TRT, HRT, GLP-1 subscriptions typically run 30-day or 90-day cycles. multiflow unifies dunning at the parent — failed payment retry cadence, customer comms timing, grace period handling — while keeping per-brand customer touch (the patient sees an email from MenClinic, not from multiflow).