Medical Practices: Collecting Patient Balances Faster

Card on file is a consent problem, not a technology problem

Most practices can already store a token. What stops the charge going through cleanly is a consent record that does not say enough. Visa's rules require that, before a merchant stores a payment credential for a future transaction or takes an advance or partial payment, it obtains the cardholder's express informed consent to an agreement containing a specific list of items. Build your intake form from that list rather than from a template, because the list is what a dispute will be measured against.

What Visa requires you to disclose before storing a card

Visa's Table 5-20 sets out the general requirements for partial payments, advance payments and transactions using stored credentials. The agreement must cover a description of the goods or services, the total purchase price, and cancellation and refund policies including the date any cancellation privileges expire. It must identify the merchant: the location of the merchant outlet, and an address, email address and phone number for contacting you about the transactions. On the stored credential itself it must state the last four digits of the account number that will be used, how the cardholder will be notified of changes to the agreement, the transaction amount or a description of how it will be determined, the transaction currency, how the stored credential will be used, the timing and frequency of transactions, and the expiration date of the agreement if there is one. Where the credential will be used for unscheduled credential-on-file transactions, the agreement must instead state the event that will prompt the transaction — for a practice, that is typically the adjudication of the claim and the posting of a patient balance. Visa also requires that the transaction-type requirements be displayed clearly at the time consent is given and separately from your general terms, and that you retain the information for the life of the agreement and provide it to the cardholder or issuer on written request.

Visa's healthcare interchange programs start at $500

Visa's US schedule effective April 18, 2026 lists healthcare-specific consumer credit programs, and both of them are limited by ticket size: Healthcare 1 (card not present) and Healthcare 2 (card present) apply to transactions of $500 or more. For Traditional Rewards and All Other Products the published rates are 1.53% + $0.05 card-not-present and 1.43% + $0.05 card-present; on Visa Infinite Spend Qualified and Visa Signature Preferred products the same programs list at 2.40% + $0.10 and 2.30% + $0.10. These are interchange reimbursement fees between financial institutions, and Visa is explicit that merchants pay a merchant discount to their own provider instead. Two things follow for a practice. Splitting a large balance into several small charges can move it out of programs that require $500 or more, so ask before you set up a payment plan. And whether these programs reach your statement at all depends on your pricing structure — on flat-rate or tiered pricing they generally will not.

HIPAA section 1179 and your card processor

Section 1179 of HIPAA, codified at 42 U.S.C. 1320d-8, covers entities engaged in the activities of a financial institution, or in authorizing, processing, clearing, settling, billing, transferring, reconciling or collecting payments for a financial institution. To the extent an entity does those things, the statute says the HIPAA administrative simplification part and its standards do not apply to it for those activities. The statute names the use or disclosure of information to process payments for health care or health plan premiums made by any means, including a credit, debit or other payment card, an account, check or electronic funds transfer. It also lists related activities such as transferring receivables, auditing, customer disputes and inquiries, and complying with a subpoena or law.

Where the exemption stops

The exemption is tied to payment activities, not to vendors. A supplier that does more than move money — running your patient billing, sending statements with visit details, or storing clinical notes alongside payments — may be doing something the section does not describe. Ask each vendor which of its services are payment processing only and whether it will sign a business associate agreement for anything else. Then send only the data a payment needs: amount, patient account reference and card token, never diagnosis or procedure detail in descriptors, payment notes or invoice line items. Statement descriptors are a common leak, because they are visible to anyone who sees the cardholder's bank statement. This is general information, not legal advice (September 17, 2026); confirm your obligations with your compliance adviser.

PCI applies to you regardless of size

The PCI Security Standards Council states that PCI DSS is intended for all entities involved in payment processing, including merchants, regardless of size or transaction volume. It also states that whether a small merchant is required to validate compliance is determined by the individual payment brands, and that merchants should contact their acquirer or payment brand about validation and reporting requirements. So the standard applies to a two-chair dental practice; what differs is how you have to demonstrate it. Ask your acquirer which self-assessment questionnaire applies to your setup before you buy anything, because the answer depends on how cards reach your systems and can change if you add a patient portal.

HSA and FSA reconciliation

These cards behave differently from ordinary payment cards and have their own eligibility rules for what can be paid. Separate them in your reporting rather than letting them sit in the same bucket as everything else; mixed in, they distort your effective rate and make month-end harder to reconcile than it needs to be.