Medical credit card processing: a guide for practices

Key takeaways

Medical credit card processing sits under two rulebooks, so your processor must meet PCI DSS and sign a HIPAA business associate agreement.

Interchange-plus pricing itemizes the processor’s markup, while tiered pricing buries it, which is why tiered almost always costs a practice more.

Card-on-file needs written consent, a stored token, and 48 to 72 hours of notice before you charge a balance.

Chargebacks in healthcare are won with documentation, so link the consent, the appointment, and the insurance adjudication to every charge.

Pabau keeps card payments, deposits, invoices, and patient records in one platform, so balances close without a second system to reconcile.

Medical credit card processing looks like any other merchant account until you read the contract. Your processor ends up holding data tied to patient care, so HIPAA applies on top of PCI DSS. That single fact decides who you can sign with, what the agreement must say, and how you store a card. Get it wrong and the exposure runs two ways, on compliance and on balances that quietly age into write-offs. What follows covers the pricing models, the card-on-file rules, and the paperwork that decides a dispute.

Where medical card processing parts company with retail

Medical credit card processing is how a practice takes card payments from patients. It happens at the front desk, online before a visit, or after insurance adjudicates the claim. The mechanics match any other merchant account. The rules sitting on top of them do not.

Standard merchant services carry PCI DSS obligations. A medical practice carries those plus HIPAA. As soon as a payment record touches protected health information, the processor becomes a business associate under HIPAA. An appointment date, a treatment type, or a diagnosis code on an invoice is enough to trigger it.

So three differences show up as soon as you start comparing quotes:

• A HIPAA business associate agreement (BAA): any processor handling data linked to patient care has to sign one
• Workflow integration: copay collection at check-in, balance billing after the Explanation of Benefits (EOB), and online prepayment all need to reach your scheduling system
• Larger tickets: elective procedures and specialist visits routinely run $200 to $2,000, which changes both interchange rates and chargeback risk

Both rulebooks apply from your first transaction, so compliance is where the evaluation starts.

Compliance runs on two tracks: PCI DSS and a signed BAA

Neither track is optional. Under the HHS HIPAA Security Rule, a BAA is required from any vendor handling protected health information for a covered entity. That covers creating it, receiving it, storing it, and transmitting it. Payment processors are included whenever patient data forms part of the transaction record.

Plenty of practices open a Square or Stripe account without checking whether the standard product extends HIPAA coverage. It usually does not. Ask for the healthcare configuration by name, and get the BAA in writing before any patient data moves. Our guide to HIPAA-compliant payment processing covers what that agreement has to include.

PCI DSS is the second track. The PCI Security Standards Council requires compliance from every merchant that accepts, stores, processes, or transmits cardholder data. Most independent practices qualify for a Self-Assessment Questionnaire (SAQ) rather than a full audit. The paperwork and the network scans still come around every year.

Scope is the part worth negotiating. When your processor tokenizes and vaults card data on your behalf, raw card numbers never enter your systems. That shrinks both the SAQ you complete and the surface an attacker can reach.

Med spas ask about this constantly. HIPAA applies whenever a licensed practitioner treats a patient, which covers most aesthetic practices. Where the answer is genuinely unclear, assume HIPAA applies and require the BAA anyway. Once the compliance floor is set, the argument moves to price.

Interchange-plus is the pricing model that shows its math

Ask for interchange-plus. It passes through the card networks’ own interchange cost, then adds a markup the processor discloses, so you can see what you are paying for. According to CAP Physicians, processors commonly raise rates three to four times a year. Knowing which model you are on is what lets you catch it.

Interchange-plus suits practices running moderate to high volumes. Flat rate earns its place at low volume, where one visible number beats a few basis points of saving. Tiered pricing rarely works out, because the processor decides which bucket each card falls into.

The fees that quietly inflate your effective rate

The transaction rate is one line on the statement. These are the others:

• PCI non-compliance fee: billed monthly when the annual self-assessment has not been completed, often $20 to $50
• Statement fee: a flat monthly charge for the processing statement itself, typically $5 to $15
• Batch fee: charged each time you close out a day’s transactions, often $0.10 to $0.30
• Early termination fee: some contracts run two to three years and charge $300 to $500 to leave early
• Monthly minimum: when volume drops below a threshold, the processor bills you the difference

Ask for an itemized fee schedule in writing before you sign. A processor who cannot produce one is holding margin somewhere in the stack.

Card-on-file collects the balance without the chase

Card-on-file (COF) moves the needle further than any other change on this list. The practice stores a tokenized card at intake, then charges it once insurance has adjudicated. Nobody has to call a patient about a $40 copay three weeks later.

The sequence runs in four stages, and the first one carries all the risk. Skip written consent and every later dispute turns into an argument you cannot document.

1. Take written consent at intake: the patient signs an authorization covering copays, deductibles, and balances left after insurance. The form names which charges apply and the notice you will give, usually 48 to 72 hours.
2. Tokenize the card: your processor swaps the card number for a token. The raw Primary Account Number (PAN) never lands in your practice management system or EHR, which is what limits your PCI scope.
3. Charge after the EOB: once the insurer confirms the patient’s share, you charge the stored token. An email or text confirms the amount to the patient.
4. Keep the dispute pathway open: tie every charge to the appointment, the service delivered, and the adjudication. That trail is what wins a chargeback later.

Consent is the piece most often missing. A written credit card authorization form gives you the charge types, the notice window, and the signature line on one page.

A medical chargeback is won on paperwork, not argument

Even a clean consent trail gets tested eventually. You win a medical chargeback by producing records rather than explaining yourself. Practices see fewer disputes than retail, but each one tends to be larger and slower to settle.

The triggers repeat. A patient does not remember authorizing the service, a charge lands after a cancellation, or a stored-card charge arrives with no warning.

Here is the path a dispute takes. The patient calls their bank, the bank pulls the funds from your account, and your processor sends you the chargeback notice. You then get a fixed window, usually 7 to 14 days, to upload evidence. The card network rules on it, and the money either comes back or stays with the patient.

Before you send a dispute response

Have these five items attached before you hit submit:

• The signed authorization form, with the date the patient signed it
• The appointment record showing the service and who delivered it
• The EOB confirming the patient’s share of the bill
• The notification you sent before charging, with its timestamp
• A short cover note tying the four together in plain language

Prevention still beats evidence. Automated appointment confirmations create a timestamp the patient acknowledged. A notice 48 to 72 hours before a stored-card charge settles most “I did not authorize this” complaints before a bank hears about them. When consent, the appointment, and the charge sit in one system, your team answers within an afternoon.

One distinction trips people up. Medical credit cards are a separate product from card acceptance, and the CFPB’s explainer walks through how they and payment plans work. The lender pays the practice upfront and the patient repays the lender. Disputes there follow the lender’s process, not a Visa or Mastercard chargeback.

Integrated payments close the balance without a second system

A standalone terminal processes a transaction. An integrated system posts that transaction to the patient record, the appointment, and the invoice at the same moment. The difference shows up at close of day, when nobody is matching receipts to accounts by hand.

Reconciliation is the honest measure here. Staff working from a separate terminal match paper receipts to patient accounts, which takes 30 to 60 minutes daily in a busy practice. Practice management software that owns both records removes the step altogether.

Systems that handle payments natively usually also support:

• Prepayment links sent with the appointment confirmation
• Digital invoices with card payment built into the email
• Payment status visible beside the appointment in the patient record
• Automated balance notifications once insurance has adjudicated

In-person payments deserve the same treatment. A clinic POS terminal wired into the patient record writes each payment straight to the account, so the front desk never types a figure twice.

What to check before you sign a processor contract

Work through this list while you are still negotiating, not after the first statement lands.

• BAA availability: get written confirmation that the processor will sign one before you share patient-linked data
• PCI scope: ask whether their tokenization model reduces your scope, and by how much
• Pricing model: prefer interchange-plus, and treat tiered pricing as a warning sign unless volume is genuinely low
• Contract terms: check the termination fee, the auto-renewal window, and the notice required before a rate change
• Integration: confirm whether the processor writes into your EHR or practice management platform natively
• Chargeback support: ask what evidence they assemble for you, and what their win rate looks like for healthcare merchants
• Single point of support: one vendor for software and payments means one call when a payment does not post

Eight questions to get answered in writing

Verbal answers do not survive a renewal, so put these in an email:

1. Will you sign a HIPAA business associate agreement with our practice?
2. What is your exact markup over interchange, and is it locked for the term?
3. How often are rates reviewed, and what notice do we get before a change?
4. Which monthly fees apply on top of the per-transaction rate?
5. Is there an early termination fee, and how long is the contract?
6. Does your tokenization and vaulting reduce our PCI scope?
7. Which EHR and practice management platforms do you integrate with natively?
8. What support do you give us when a patient files a chargeback?

Four mistakes that keep costing practices money

• Signing before the fee schedule arrives: the rate gets agreed, the monthly fees do not, and the effective cost lands above the quote
• Storing card numbers in the patient record: it pulls your whole system into PCI scope, and it fails an assessment fast
• Charging a stored card with no notice: the patient calls their bank instead of your front desk
• Letting an auto-renewal roll: a three-year term renews quietly while you are still shopping around

How Pabau keeps payments inside the patient record

Payments usually live beside the patient record rather than inside it. The terminal takes the money, the practice management system holds the appointment, and somebody reconciles the two after close.

Practice management software like Pabau treats the payment as part of the record. Pabau’s payment processing keeps card payments, deposits, invoices, and clinical notes in one platform. The front desk issues an invoice from inside the patient file and takes a deposit at booking. Payment history sits beside treatment history. One screen answers what was treated, what was billed, and what is still owed.

For in-person payments, Pabau Pay, our card terminals, posts each transaction to the patient’s account as it is taken. The terminals carry no monthly fee, so you pay on the transactions you take. Payment links, tap to pay, and account credit cover the rest.

The result is fewer moving parts at month end. Consent, the stored token, the notice, and the charge all belong to the same patient file. A dispute response becomes a matter of printing what is already linked.

See payments land in the patient record

Pabau keeps card payments, deposits, invoices, and patient records in one platform, so balances close without a second system to reconcile. Pabau Pay, our card terminals, posts in-person payments straight to the patient’s account.

Book a demo

Conclusion

Two decisions carry most of the weight. Pick a processor who will sign a BAA and price on interchange-plus. Then wire it into the system that already holds the appointment and the balance.

The compliance work is largely one-time. The collections benefit keeps arriving. Consent at intake, a stored token, and a notice before each charge all pull in the same direction. The linked trail is what settles a dispute when one arrives.

One trade-off is worth remembering. A standalone processor may quote a slightly lower rate, and you pay it back in reconciliation time every afternoon. If you want to see card payments, deposits, and invoices land in the patient record, book a demo of Pabau’s payment tools.

Continue your research

Still chasing balances after the visit? Patient collections walks through the sequence that gets a balance paid without a phone call.

Need the consent wording for a stored card? Credit card authorization form gives you a signature-ready page covering charge types and notice windows.

Taking payment at the point of booking? Stripe for online bookings explains how prepayment links attach to the booking flow.

Frequently asked questions