Credit card
processing for
medical offices.

01 / Design for the practice

A medical office needs more than a terminal.

The payment experience begins when a patient asks what they owe. It ends when your team can match the correct payment to the correct balance and explain the bank deposit.

Credit card processing for a medical office combines payment acceptance, a merchant relationship, software connections, and funding. The right setup supports the way your practice collects: a copay at reception, a balance after insurance, a self-pay visit, or an authorized installment.

Start with three separate records: the patient ledger, the processor’s transaction record, and your bank deposit. A payment can succeed while its ledger posting fails. A ledger entry can look complete while a transaction never settles. Your workflow needs to connect all three.

Map the money before comparing providers

Tell a prospective processor your specialty, locations, monthly card volume, transaction count, largest expected charge, and mix of in-person and remote payments. Explain deposits, advance payments, and services delivered over time. An accurate description helps the review address the business you actually operate.

New to merchant accounts? Start with our merchant accounts guide. Dental practices can also explore dental payment processing.

02 / Understand the economics

Compare the full payment bill, not just the percentage.

Medical office credit card processing fees can include a percentage of the payment, a fixed transaction charge, monthly account or gateway costs, software, equipment, and event-based charges. Ask which costs apply to each payment channel.

Interchange is one ingredient. Visa distinguishes the interchange exchanged between financial institutions from the merchant discount negotiated with the merchant’s financial institution. An interchange table or a processor’s markup alone is not your complete quote. [1]

Small copays and large balances behave differently

Consider an illustrative price of 2.7% + $0.20 per successful payment. This is an arithmetic example, not a NUMUS offer or a market average.

The fixed charge matters more on a small copay. These examples round each transaction fee to cents and calculate the displayed percentage from that rounded amount. A practice collecting many small payments should compare transaction counts as carefully as dollar volume. Actual processors’ rounding and fee schedules can change the final statement amount.

Build an apples-to-apples monthly estimate

Modeled cost = percentage charges + per-transaction charges + recurring charges + applicable event charges. Separate reception payments, online payments, and telephone or stored-card transactions when their prices differ.

For interchange-plus pricing, include estimated underlying interchange and network charges as well as the markup. For flat-rate pricing, check channel exceptions. For a subscription plan, include its recurring cost even in a quieter month.

Then divide the included costs by the same month’s gross processed card volume. Label the result clearly: a processing-only effective rate differs from an operating comparison that includes practice software. Keep refunds, reserves, and unpaid patient balances in separate categories.

Ask what happens when a patient overpays

Insurance adjustments can produce refunds. Find out whether the original transaction fees are returned and whether a separate refund fee applies. Stripe’s published policy, for example, says original processing fees are not returned; your proposed agreement may differ. [2]

Decode the statement with our credit card processing fees guide, then use the calculator below to test your own assumptions.

03 / Make collection feel considered

Build a patient payment journey your staff can explain.

A good workflow gives the patient clarity and gives the team fewer exceptions to untangle. Agree on what happens before the visit, at checkout, and after insurance finishes processing.

1. Before the visit: explain your payment policy and identify an estimated amount separately from a confirmed balance. Give patients a clear way to ask billing questions.
2. At reception: confirm the patient account and amount, accept the payment through the approved device, and provide a receipt. Avoid calling an estimate the final insurance responsibility.
3. After adjudication: reconcile the insurer’s decision, earlier collections, and remaining balance before requesting another payment.
4. At collection: use a secure payment link or the permitted stored-card workflow. Record the confirmation and identify any posting exception.
5. At close: match receipts, adjustments, refunds, and settlement activity. Assign unresolved differences to a named person.

A card on file is a permission workflow

Saving a payment method and charging it later are related but distinct actions. Visa’s stored-credential framework requires an agreement before credentials are retained for future use, including an explanation of how they will be used. Ask your provider how it captures consent and identifies later transactions. [4]

Your practice’s reviewed policy should make the permitted charges, timing, notices, cancellation or update process, and receipt delivery understandable. A signature on an intake packet should not leave a patient guessing when an unexpected balance may be charged.

Demonstrate a declined saved-card payment too. Staff need to know how to contact the patient, update the method through a secure flow, and avoid creating a second charge while troubleshooting the first.

Keep payment acceptance separate from financing

A processor enabling card payments does not automatically provide patient lending. The CFPB cautions that medical credit cards and financing plans can involve deferred interest, fees, and credit consequences. Staff should explain the specific product accurately and allow patients to review coverage and assistance options. [5]

This guide does not represent a NUMUS patient-financing offer. If your practice wants installments, ask what is actually supported and whether the arrangement is an authorized practice payment schedule or a separate lending product.

04 / HSA and FSA acceptance

An HSA or FSA card needs more than a card-network logo.

There are two questions: can this payment be processed, and is this expense eligible under the patient’s account rules? An authorization is not a tax determination.

The IRS explains that HSA funds can cover qualified medical expenses, subject to applicable conditions, and that health FSA reimbursement has its own substantiation rules. Expenses already compensated by insurance cannot simply be reimbursed again. Patients should retain appropriate records and follow their account administrator’s requirements. [6]

On the processing side, the merchant category and account configuration matter. Stripe’s healthcare-card guidance illustrates the use of eligible merchant category codes and makes clear that enabling acceptance does not guarantee issuer approval. Practices combining services with retail products should confirm the additional requirements for that combination. [7]

Confirm these details before advertising acceptance

• Which HSA/FSA cards and channels the proposed configuration supports.
• Whether the assigned merchant category accurately describes the practice.
• How to handle partial payments, insufficient balances, declines, and refunds.
• What itemized documentation patients may need from the clinical billing system.

Keep a calm fallback for a declined benefit card. Explain that the issuer or administrator can help resolve account-specific questions; avoid promising that a particular service is eligible just because the terminal accepted it.

05 / Connect the right systems

“Integrates with your EHR” needs a live demonstration.

A logo on a partner page cannot tell you whether payments post automatically, refunds synchronize, or your exact software edition is supported. Ask the payment provider and software vendor to confirm the specific connection together.

Get a written responsibility list: who maintains the connector, who owns support tickets, what happens after a software upgrade, and which features require a paid add-on. Decide whether your billing team needs a fully connected workflow or can manage a separate terminal with a disciplined posting process.

Evaluate payment links on a phone, including text size, confirmation language, and how patients recognize the practice. Keep clinical details out of URLs and generic payment descriptions. Use an internal reference to connect records within systems configured to handle the necessary information.

NUMUS compatibility with any named EHR, practice-management platform, gateway, or device must be confirmed during review. A proposed solution should be judged on demonstrated capabilities, not an assumed universal integration.

06 / Protect the right information

HIPAA and PCI DSS address different responsibilities.

A medical payment can sit near two kinds of sensitive information: health information and payment credentials. Determine which vendor receives which data, for what purpose, before deciding what agreements and safeguards are needed.

Ordinary financial processing is a specific exception

HHS identifies ordinary consumer financial transactions that facilitate payment for healthcare among situations where a business associate contract is not required. It also lists billing and practice-management services involving protected health information as examples of business-associate activity. The service being performed matters. [8]

Section 1179 of the Social Security Act addresses the financial-institution payment-processing exception. It is not a blanket exemption for every company that touches a medical bill. [9] Have your privacy lead assess integrations that transmit clinical information, provide billing services, or maintain PHI, including whether a business associate agreement is required.

The useful question is: “Show us exactly what data leaves our systems, who receives it, and what each party does with it.” A broad “HIPAA-ready” label is not an answer.

Use tokens; do not keep security codes

A token can reference a stored payment method without making its full card number available throughout your office systems. PCI SSC explains that tokenization may reduce PCI scope but does not eliminate the need to maintain and validate compliance. The implementation matters. [11]

Do not retain a card’s CVV/CVC security code after authorization, including for future or recurring charges. PCI SSC states that customer permission does not create an exception. Review paper forms, call recordings, messaging, and software fields where staff might inadvertently retain it. [10]

Make daily controls practical

• Give each staff member an individual login and the access needed for their role.
• Require extra approval for sensitive actions such as large refunds or bank-account changes.
• Confirm the applicable PCI validation process with your acquirer or payment provider.
• Keep payment devices, software updates, and incident contacts on an assigned maintenance checklist.

Do not put diagnoses, treatment narratives, or patient charts in a generic processor notes field or a merchant-account application. Keep necessary clinical records in the appropriate protected workflow.

07 / Follow the deposit

Separate patient collections, insurer receipts, and available cash.

A successful card authorization, a captured payment, a settlement, and a bank deposit are separate milestones. Ask when a transaction becomes eligible for payout, when payouts are sent, and when the receiving bank makes them available. Stripe’s documentation distinguishes settlement timing from the payout schedule and bank availability; the same questions belong in any provider comparison. [13]

Request a written example covering a Friday payment, the batch cutoff and time zone, a bank holiday, the first deposit, and a refund. Confirm any faster-funding fees, eligibility limits, reserves, and review conditions. A “next-day” headline is not a universal funding promise.

Insurer virtual cards deserve their own review

Some health plans pay claims using virtual credit cards. CMS explains that those payments can involve card-processing fees and distinguishes them from the adopted healthcare EFT and ERA standards. Its guidance states that a health plan must comply when a provider requests the applicable standard transactions. [12]

Review payer enrollment and reconciliation options separately from patient checkout. Ask what each service costs and how the remittance is matched to the deposit; do not assume every electronic insurer payment uses the same payment method or fee schedule.

Read more about funding timelines and the differences between ACH and credit card processing.

08 / Choose with evidence

Give every provider the same practice profile.

Ask each provider to price the same monthly volume, transaction count, payment mix, number of locations, and software needs. A lower rate on a different scenario is not a lower cost for your practice.

Request a complete written proposal and mark each answer as confirmed, conditional, or not supported. This makes gaps visible before the team invests time in a migration.

Include the practice manager and a billing-team member in the demonstration. The person who handles adjustments often notices limitations a sales presentation skips. Ask them to describe one difficult real-world workflow using a fictional patient account, then have the provider walk through it.

09 / Change without losing the thread

Plan the switch around reconciliation and continuity.

Before canceling the current account, review its termination and equipment terms, save accessible reports, and confirm how outstanding refunds and disputes will be handled. Saved payment methods may require a supported migration; do not assume one provider’s tokens work in another system.

1. Confirm approval and configuration. Verify the accepted business activities, bank details, devices, channels, and software connection.
2. Demonstrate the important exceptions. Include a decline, partial refund, posting failure, and authorized stored-card payment using approved test facilities.
3. Train the team. Give reception and billing staff a short guide for payment confirmation, duplicate prevention, refunds, and escalation.
4. Reconcile the first live batches. Track payments through ledger posting and deposits before relying on the new process at full scale.
5. Close the old workflow deliberately. Retain appropriate access and records for remaining obligations, then complete cancellation and equipment return requirements.

Choose a responsible person for the cutover and a fallback for interruptions. A migration is complete when staff can handle the normal payment and the awkward exception, not just when the new terminal powers on.

A better processor conversation

Take a better checklist
to your next meeting.

A rate quote is only the beginning. Compare the full cost, demonstrate the patient-payment workflow, and settle the switching questions before you commit.

No email gate. The worksheet is blank for your own quotes and contains no formulas. Keep patient information, card numbers, security codes, and banking details out of these planning documents.

10 / Put your practice in the picture

Start with a processing review built around your medical office.

Share your practice’s business details, monthly card volume, average and highest ticket, payment channels, and current software. If you already process payments, have recent statements available so the discussion can focus on your actual costs and requirements.

NUMUS can review the application and discuss potential processing options. Approval, pricing, integration compatibility, HSA/FSA support, and funding terms depend on the proposed provider and review. Confirm the final arrangement before committing to hardware or changing your billing workflow.

Keep the application about the business. Do not submit patient records, diagnoses, or individual treatment details as supporting merchant documents.