Medical credit card processing: copays, balances, fees

Medical credit card processing is the setup a physician practice or clinic uses to take card payments: copays at check-in, deductibles and coinsurance once insurance has paid its share, self-pay visits, and payment plans for larger balances. The terminal is the easy part. The hard part is timing, because a medical bill often isn't final until weeks after the visit, and how you collect that last balance decides how much staff time goes into chasing it.

This guide is for family medicine, urgent care, specialists, physical therapy, and other outpatient clinics. Dental offices have different problems (treatment plans, deposits, insurance overpayments), so they get their own guide to dental credit card processing. Our medical and dental page covers how we set up practices. Rules cited are as of October 2026.

What does a medical practice need to take card payments?

A merchant account, a terminal at the front desk, and a way to collect when the patient isn't in the building. Most practices end up with some version of this:

Clearo's POS terminals take chip, tap, and swipe, plus Apple Pay and Google Pay, in countertop, wireless, and portable models. Phone payments, invoices, payment links, and recurring billing all go through our virtual terminal. If statements still go out on paper with a "call us to pay" line, our guide to the payment link shows the simpler route.

When should a practice collect: at check-in or after insurance?

Both, for different parts of the bill. Collect what you know at check-in, which is usually the copay plus any unpaid balance from earlier visits. Collect what you don't know yet, the deductible and coinsurance, after the claim is processed and the patient's share is real.

Practices that try to collect everything at the visit spend their afternoons issuing refunds. Practices that collect nothing until the statement wait a month or two and write some of it off. The middle path is a copay up front plus a card on file for whatever insurance leaves behind.

Here's how that plays out at a family medicine practice in Charlotte:

1. At check-in, the patient pays a $40 copay on the terminal and signs a consent to keep a card on file for any balance after insurance, up to a stated limit of $500.
2. The claim is processed. The plan pays its part, and the patient owes $186 toward the deductible.
3. The practice sends a notice by email or text: "$186 will be charged to your Visa ending 4417 on March 14. Call us before then with any questions."
4. On March 14, the practice charges $186 to the stored card and emails a receipt.

No paper statement, no second notice, and the patient knew the charge was coming. If a balance ever lands above the limit the patient agreed to, stop and call before charging anything. A surprise charge is how a card on file turns into a chargeback.

How does a card on file work for patient balances?

You store the card with the patient's consent, keep it with your payment provider instead of in your practice software or a filing cabinet, and charge it only under the terms the patient accepted.

Consent comes first: Visa's framework for transactions with stored credentials says card details can't be stored for future use until the cardholder agrees. It also expects the first storage and each later charge to be identified in the transaction data, and when nothing is due at the moment you save the card, you run an account verification instead of a charge. Your gateway sets those flags. Your part is making sure the consent happens and asking your provider to confirm the flags are right.

The flag isn't a formality. In Visa's message format, point-of-sale entry mode 10 means the merchant initiated the transaction using credentials stored on file. That's how the patient's bank can tell a balance charge from a card the patient handed over today.

Three habits keep stored cards safe:

• Never keep the security code. PCI SSC says the code isn't needed for card-on-file or recurring transactions, and storing it for those purposes is prohibited.
• Store a token, not the card number. Our guide to payment tokenization explains how that keeps card numbers out of your systems.
• File the signed consent with the patient's account so you can produce it fast if the charge is disputed.

Our card on file guide covers the rest, including what to do when a stored card declines.

How should payment plans work at a medical practice?

As a written schedule charged to a stored card, with the total, the number of payments, the amount, and the dates spelled out before the first charge. Say a patient owes $1,200 after an outpatient procedure and can manage $200 a month. That's six charges of $200 on the same day each month, a receipt each time, and a final note when the balance hits zero.

Debit cards bring a federal rule into play. The CFPB's Regulation E requires preauthorized transfers from a consumer's account to be authorized in a writing signed or similarly authenticated by the consumer, and electronic signatures count. If an amount will vary from the one authorized, the payee or the bank has to send written notice of the amount and date at least 10 days ahead, unless the consumer agreed to a range. The easy fix is a signed plan agreement for every patient, whatever card they use.

Stored cards also go stale. Among issuers that take part in Visa Account Updater, an average of 30% of card accounts get a new number or expiration date, or close, each year, according to Visa's account updater FAQ. Across 200 active payment plans, that's roughly 60 cards a year that would fail without an update. Ask your processor whether it supports account updater services.

Some practices hand balances to an outside lender instead, through a medical credit card or financing plan. Read the fine print first. The CFPB found that patients used deferred interest medical credit cards and loans to pay for almost $23 billion in health care across more than 17 million purchases from 2018 to 2020, and paid $1 billion in deferred interest. An in-house plan on a card on file is often cheaper for the patient, and you keep the relationship.

Do FSA and HRA cards work at a medical practice?

Usually, and your merchant category code is the reason. In a 2003 ruling on debit cards for health flexible spending arrangements and HRAs, the IRS described a card whose use is limited to merchants with health care merchant category codes, naming physicians, pharmacies, dentists, vision care offices, hospitals, and other medical care providers. A 2006 IRS notice let employers extend these cards to other merchants only through an inventory information approval system, which totals the eligible items in a purchase and approves the card for that amount.

What that means at your front desk:

• Your account should carry a health care code that matches what you do. A card limited to health care codes has no reason to approve a practice that was set up under a generic one. Our guide to the merchant category code shows how to check yours on a statement.
• Hand out itemized receipts. A patient's plan may ask what the charge was for, and "Payment, $186" doesn't answer that.
• If you surcharge, ask your processor how these cards show up at the terminal, because Visa and Mastercard don't allow surcharges on debit or prepaid cards.

Does HIPAA apply to credit card processing?

HIPAA has a carve-out for payments, but where it ends is a question for your compliance officer, not your processor. We don't make HIPAA determinations for practices. Here's what the law says about payments in general terms, and the habits that keep payment data and health data apart.

Section 1179 of HIPAA exempts financial institutions' payment activities, such as authorizing, processing, clearing, and settling payments, from the law's rules. Where that exemption stops has been debated for years. In 2015, HHS's advisory committee on health data, the National Committee on Vital and Health Statistics, wrote to the HHS Secretary about section 1179 and the privacy questions around it. If a vendor does more than move money, such as mailing statements that list procedures, ask your compliance advisor whether you need a business associate agreement with it.

Habits that help no matter how that question is answered:

• Keep diagnoses, procedure names, and visit reasons out of payment fields: the description on a payment link, the memo on a phone payment, the text of a reminder. "Balance for your visit on March 3" says enough.
• Don't take card numbers by email or text, and don't write them on intake forms that get scanned into the chart.
• Collect online balances on a payment page your provider hosts, so card data never touches your website or practice software.

Card security has its own standard, PCI DSS, separate from HIPAA. Our guide to what PCI compliance is explains what it asks of a practice, and we provide PCI compliance support for our merchants.

Can a medical practice add a credit card surcharge?

In most states, on credit cards only and within network caps. Visa limits a US credit card surcharge to the lesser of your merchant discount rate or 3%, and wants 30 days' notice to your acquirer before you start. On a patient's Mastercard, the surcharge can't go above the lesser of your average effective merchant discount rate or 4%. Neither allows a surcharge on debit or prepaid cards.

States add their own limits. Connecticut bars surcharges on any payment method (Connecticut Department of Consumer Protection), and Maine bans them on credit and debit cards (Maine Legislature). Our page on surcharging rules by state covers the rest.

On a $250 visit paid by credit card, a 3% surcharge is $7.50. Our view: think twice before surcharging patients. Nobody chooses to get sick, the bill already feels out of their hands, and a fee for paying the normal way rarely speeds up collections. A flat fee for paying through an online portal is a different animal, a convenience fee, with its own rules. If you do surcharge, Clearo's surcharging program covers compliance, disclosure, and setup.

What should self-pay patients see before you take a deposit?

A good faith estimate. CMS says people who don't have insurance, or don't use it for a visit, have the right to a good faith estimate of what their care will cost, and can dispute a bill that comes in at least $400 above it.

For payments, that suggests two habits. Base any deposit on the estimate, not a round number someone picked. And if the final bill runs well past the estimate, call the patient before you charge a stored card. The CMS page has the details on timing and disputes; your billing team or counsel can tell you how they apply to your services.

What does medical credit card processing cost?

Interchange, network fees, and your processor's markup, the same layers every business pays. Visa's schedule has separate rows for some business types, healthcare among them, so check which rows your sales actually qualify for. The example below uses Visa's standard rates from its US interchange schedule effective April 18, 2026, and the Federal Reserve's Regulation II cap for debit cards from issuers with $10 billion or more in assets.

Say an urgent care clinic in Houston takes $50,000 a month in card payments, 400 sales averaging $125. For simpler math, assume all 400 sales are on Visa cards.

That's about 1.20% of sales in interchange. Per-sale figures are rounded; the monthly totals aren't.

The online row is the one to watch. Had those 120 Traditional Rewards payments been tapped at the front desk (Product 2, 1.65% + $0.10), they'd have cost $259.50 instead of $318.00. That's $58.50 a month, or $702 a year. It's a reason to collect known amounts at the visit, not a reason to stop taking online payments: a $2.65 payment that arrives this week beats a paper statement that sits for two months.

On interchange-plus pricing, each of those rows shows up on your statement so you can check it. On a flat rate, you can't see the split. Our comparison of interchange-plus vs flat rate explains both.

Common medical payment mistakes

• Card numbers on paper intake forms, sticky notes, or emails.
• Charging a stored card for more than the patient agreed to without calling first.
• Diagnosis or procedure details in payment descriptions and reminders.
• Relying on paper statements as the only way to collect a balance.
• A surcharge that hits debit or prepaid cards along with credit.
• A merchant account coded as something other than a medical practice.

Next step

If your practice already takes cards, the open questions are what you pay and whether balances are being collected the hard way. Send us a recent statement for a free statement review and we'll show you your effective rate and where the money goes, or contact us to talk through copays, cards on file, and payment plans with a rep before you change anything.