Keeping a Patient's Card on File

“We keep a card on file” describes three separable things that are usually procured together and almost never designed together. Pulling them apart is most of the work, because each one fails differently and only one of them can be handed to a vendor.

The credential

The stored means of charging — in a well-built arrangement, a token held by the payment processor that the practice's system refers to, rather than a card number the practice holds itself. This is the part that can and should be outsourced.

The authorization

What the patient agreed the practice may charge, and when. This is the part that decides whether a charge is defensible, it cannot be outsourced, and it is the part most often reduced to one sentence on a registration form.

The disclosure

What the patient is actually told, and when — at signup, and again before an amount they did not expect. A charge a patient did not see coming is a dispute whether or not the paperwork covers it.

The instinct is to write the broadest consent the patient will sign: authorization to charge the card for any balance the patient owes. That instinct is backwards. A broad authorization is not a stronger one — it is a vaguer one, and vagueness is what a patient's bank resolves against the merchant. An authorization that states its own limits is the one that can be shown to a third party and read as covering the charge in question.

Four questions decide whether an authorization is worth having. None of them has a right answer that this article could supply — they depend on the practice, its services, and its patients — but leaving any of them unanswered is itself the decision.

1. 01

   What may be charged

   The narrowest useful version is adjudicated patient responsibility — the amount left after the payer has processed the claim and said so. Broader versions reach estimates taken before adjudication, missed-appointment fees, and balances from other family members on the same guarantor account. Each step outward is a separate thing to have agreed, not a natural extension of the first.
2. 02

   Up to what limit

   A ceiling, per charge or per period, above which the practice contacts the patient instead of charging. A limit is not a concession; it is the thing that makes the rest of the authorization credible, and it converts the worst case from an unbounded charge into a phone call.
3. 03

   For how long

   An authorization with no end is an authorization that will one day be used on a patient who has forgotten it exists. Whether it expires on a date, on the closing of an episode of care, or on the settlement of a named balance, it should end by its own terms rather than by someone remembering to remove it.
4. 04

   How the patient finds out

   Before the charge, after it, or both — and by what channel. This is the question whose answer costs the least to implement and prevents the most disputes, because most objections to a card-on-file charge are objections to a surprise rather than to the amount.

At the front desk, storing a debit or credit card and setting up a recurring bank debit are the same conversation. In federal law they are two different objects with two different frameworks, and a practice that treats them as one will meet the difference at the worst moment.

The bank-account version has an explicit writing requirement

Recurring transfers out of a consumer's bank account are preauthorized electronic fund transfers, and 12 CFR 1005.10(b) (opens in a new tab) states the rule in one line: they “may be authorized only by a writing signed or similarly authenticated by the consumer.” The same paragraph requires that a copy be furnished to the consumer. “Similarly authenticated” is what makes an electronic signature or a recorded consent workable — the requirement is a record attributable to the consumer, not paper.

Two neighbouring paragraphs shape how such an arrangement has to run. Under 1005.10(d) (opens in a new tab), where a transfer will differ from the previous one or from the authorized amount, written notice of the amount and date goes to the consumer in advance — which is exactly the case a medical balance presents, since the amount varies with what the payer did. Under 1005.10(c) (opens in a new tab), the consumer stops the transfer by telling their own bank, not the practice. The practice can be entirely unaware that an arrangement has been stopped until a transfer does not arrive.

The card version's rules come from somewhere else

A stored payment card is not governed by that regulation. Its requirements come from the card networks' operating rules and from the practice's own merchant agreement — private instruments, which the practice has agreed to and can read, and which is where the specific obligations for storing a credential and charging it later are actually written. Reading the merchant agreement is not a formality here; it is the only way to know what the practice has already promised about stored credentials.

The technical goal is straightforward and it is the opposite of what “keeping a card on file” sounds like: the practice should end up holding no card data at all. A processor stores the credential and returns a token — a reference that is useless anywhere else and can be charged only through that processor, on that merchant account. The practice's system stores the token against the account. Nothing in the practice's own database is a card number.

One category deserves naming, because it is the one a well-meaning front desk writes on a form. The PCI Security Standards Council defines sensitive authentication data as security-related information used to authenticate cardholders or authorize payment card transactions, and identifies it as card verification codes, full track data, PINs and PIN blocks. It is the data that proves the card is present and in the right hands at the moment of a transaction — which is precisely why it is not the kind of thing a filing cabinet, a scanned form, or a free-text note on an account should ever contain.

• A card number written on a form is storage. Scanning that form into the chart does not undo it; it moves it somewhere with worse controls and a longer retention period.
• A card number in a free-text note is storage. It also travels — into exports, into backups, into whatever the next system migration carries across.
• A token is not a card number and that is the point. Choosing a vendor arrangement where the practice never receives the credential is one decision that removes a whole class of problem, rather than a control that has to be operated correctly forever.

A healthcare organization signing up a payment vendor reaches for a business associate agreement, because that is the instrument it reaches for with every vendor. For payment processing specifically, the statute contains an express carve-out, and knowing it exists prevents both a false sense of protection and a pointless argument with a processor that will not sign.

42 U.S.C. § 1320d-8 (opens in a new tab) — “Processing payment transactions by financial institutions” — provides that HIPAA's administrative-simplification part does not apply to an entity with respect to those activities, including “the use or disclosure of information by the entity for authorizing, processing, clearing, settling, billing, transferring, reconciling or collecting, a payment for, or related to, health plan premiums or health care.” The activity is what the carve-out is written around.

Once the charge goes through, none of the above matters and everything about posting does. Money has arrived with no instruction attached to it, and applying it is a decision rather than transcription — the whole argument of posting patient payments, which a card on file does not change. Two consequences are sharper here than elsewhere, because automation makes both of them silent.

• A charge taken before adjudication is against an estimate. The remittance later replaces the estimate with the real cost sharing, and the difference has to go somewhere. Collecting early is a legitimate choice; collecting early and treating the amount as settled is not.
• An overcharge is a liability, not revenue. Where the charge exceeded what the patient owed, the practice is holding the patient's money, and resolving a credit balance is the obligation that follows. An automated charge produces these faster than a manual one, and nothing about the automation surfaces them.

There is also a reporting effect worth deciding deliberately. An account settling automatically leaves the accounts receivable aging quickly and quietly, which is the intended benefit — and it means the aging no longer shows how much of the patient book is collectable by ordinary effort versus how much is running on stored credentials. Those are different asset qualities, and a practice that has moved a substantial share of patient collections onto stored cards should be able to see the split rather than infer it.

Each of these is a variation on the same root cause — the authorization was treated as paperwork to be completed rather than as the product.

1. 01

   The authorization that never ends

   A card stored at a first visit and charged two years later, for a balance from an episode the patient has forgotten, on a card they may have replaced. Technically covered by a consent nobody has looked at since. This is the one that generates complaints that are legitimate even when the balance is.
2. 02

   The charge nobody announced

   An amount the patient did not expect, appearing without notice. Where the arrangement runs on a bank account, advance notice of a varying amount is a defined obligation; where it runs on a card, it is merely the thing that would have prevented the chargeback. The operational answer is identical either way.
3. 03

   The consent that covers everything and establishes nothing

   “I authorize charges for any balance owed.” It reads strong and performs weakly, because a third party asked to decide whether this charge was authorized has nothing specific to read. Specificity is not a limitation on the practice; it is the practice's evidence.