Compliant payments for medical, dental and specialty practices

HSA and FSA cards: providers versus retailers

Health savings account and flexible spending account cards run on the card networks, so a practice accepts them through its normal terminal or gateway. The substantiation rules differ by merchant type. IRS Notice 2006-69 describes how plans can treat card transactions at merchants whose merchant category codes relate to health care, such as physicians, dentists, vision care offices, pharmacies and hospitals. A merchant without a health care category code, such as a general retailer selling eligible over-the-counter items, is expected to use an inventory information approval system (IIAS), which checks the items in the basket against an eligible product list at the point of sale. IRS Notice 2007-2 added rules for drug stores and pharmacies. For a medical or dental practice, the practical steps are to confirm your merchant account carries the correct health care category code and that the processor passes it through. A clinic that also runs a retail counter for eligible products should ask whether IIAS is needed for that part of the business.

HIPAA and PCI DSS are separate obligations

HIPAA governs protected health information held by covered entities and their business associates. PCI DSS is the card industry standard that applies to any merchant that accepts payment cards. Meeting one does not satisfy the other. A practice that is HIPAA compliant still has to complete its PCI DSS validation for card data, and a PCI compliant payment setup does not make the rest of the practice HIPAA compliant. HHS guidance allows providers to use health information for payment, subject to the minimum necessary standard. In practice, keep clinical detail out of anything that travels with a card transaction: statement descriptors, invoice line descriptions, text-to-pay messages and gateway notes should name the practice and an account or invoice number, not a diagnosis or procedure.

Card on file and payment plans

Storing a card for a remaining balance or setting up a payment plan should start with written or electronic consent that says what will be charged, when and how the patient can cancel. Use the tokenised storage your gateway provides instead of keeping card numbers in the practice management system or on paper. Send a receipt for each scheduled charge.

Surcharging patient payments

Visa rules allow U.S. merchants to surcharge credit cards only, not debit or prepaid cards, which means a surcharge cannot be added to HSA or FSA debit cards. The surcharge cannot exceed the merchant's cost of acceptance for that card or 3%, whichever is lower, and Visa and the acquirer must be notified at least 30 days in advance. Some states prohibit surcharging, so check the state surcharge guide on this site before adding one. Insurance contracts may impose their own limits.

Canada

Billing provincial health insurance plans runs through each province's own claims system and is separate from card processing. Card acceptance for uninsured services, co-pays for extended health plans and retail products follows the normal card network and PCI DSS rules.

Payment types at a glance

Each way a patient pays has its own requirement to check.