Patient responsibility is the slowest-moving money in the practice, and it is the money most likely never to arrive.

The RealityThe balance is not disputed. It is just nobody’s job to collect it.

⚠️

The Problem

Balances age because nobody owns them.

Statements go out, some come back, and the rest quietly become bad debt. The technology to prevent that is bought and then half-configured.

🔧

The Solution

Collect at the point the patient is already engaged.

Estimate before the visit, authorise at check-in, settle automatically after adjudication. Each step is a configuration, not a conversation.

✅

The Resolution

Money arrives earlier and the front desk stops chasing.

Fewer statements, shorter ageing, and a practice that can answer what a visit will cost before the patient asks twice.

Card on file medical practice rules, and what actually governs them

Card on file is the single highest-yield change most practices can make to patient collections, and it is the one that generates the most nervous questions. The nervousness is usually misplaced, but not entirely.

The rule everyone cites is the FTC’s click-to-cancel rule, and it is worth being blunt: that rule does not exist. The Eighth Circuit vacated it in Custom Communications, Inc. v. FTC in 2025 for failure to issue a preliminary regulatory analysis, and on 12 February 2026 the FTC formally restored the Negative Option Rule to the form it had before. Any article telling a practice to comply with click-to-cancel is citing a rule that was struck down.

That is not the same as saying the area is unregulated, which is where the careless version of this advice goes wrong. The FTC opened a new rulemaking on 13 March 2026 asking whether to re-adopt provisions of the vacated rule. ROSCA, the FTC Act and state automatic-renewal statutes all still apply. Vacatur removed one rule; it did not remove the obligation to be clear about what a patient is agreeing to.

For a practice, the practical translation is short. Get an explicit, recorded authorisation that names what will be charged and when. Make stopping it as easy as starting it. Do not rely on a rule number in your patient-facing language, because the rule numbers are moving.

Good Faith Estimate requirements are the binding deadline nobody diarises

The rule that most directly governs what a practice tells a self-pay or uninsured patient about cost is the Good Faith Estimate, and it runs on deadlines measured in business days from the moment of scheduling.

This is the part that quietly fails. A practice can have excellent patient payment technology and still miss the estimate, because the estimate is triggered by scheduling rather than by the visit, and scheduling is the one workflow nobody instruments. CMS publishes the model notice practices are expected to give patients, which is a useful check on what your own estimate is missing.

One business day is not a long time, and it is the deadline that applies to the most common case: a patient who books an appointment for later this week. If the estimate is produced by somebody reading a schedule report each morning, that process has already missed appointments booked yesterday afternoon.

The dispute threshold is the reason to care about accuracy rather than just timeliness. Charges are substantially in excess of the estimate when they are at least $400 more than the total expected charges listed on it, which is the trigger for the patient-provider dispute resolution process. An estimate produced quickly but carelessly is worse than a slow one, because it sets a number the practice then has to live with.

The connection to payment technology is direct. A practice that can produce an accurate estimate at scheduling can collect against it at check-in, which is the single biggest lever on patient collections there is. A practice that cannot is reduced to billing after adjudication and hoping. The estimate is not a compliance chore sitting beside the collections workflow; it is the front of it.

PCI compliance medical practice requirements changed, and the version number matters

Practices routinely say they are PCI DSS v4.0 compliant. PCI DSS v4.0 was retired at the end of 2024. The current standard is v4.0.1, and for small merchants validating with the shortest self-assessment questionnaire, two requirements that were future-dated became mandatory on 31 March 2025.

The PCI Security Standards Council’s own notice sets out the change: requirements 6.4.3 and 11.6.1 now apply, and there is a new eligibility condition requiring merchants to confirm their site is not susceptible to attacks from scripts that could affect the e-commerce system. In plain terms, that is about scripts on the page where a patient types a card number, and it is a question most practices have never been asked.

This is worth checking with whoever runs the website rather than whoever runs the practice management system, because the requirement attaches to the payment page rather than to the clinical software. It is a short conversation and it is much easier to have before an attestation is due than after a processor asks for one.

Patient payment plans and where HIPAA actually touches them

There is a persistent worry that running payment plans, or sending balances to collections, is a HIPAA problem. The rule is more specific than the worry.

HIPAA defines payment expansively. 45 CFR 164.501 includes billing, claims management, collection activities and related health care data processing within the definition, which means these activities sit inside permitted uses rather than outside them. It also sets a hard boundary in one specific place: disclosure to consumer reporting agencies is limited to a short list of data elements, being name and address, date of birth, social security number, payment history, account number, and the name and address of the provider or plan.

That list is the useful part. It is short, it is explicit, and a collections vendor sending anything beyond it is outside what the rule permits. It is a reasonable thing to ask a vendor to confirm in writing before signing.

One thing we are not going to tell you, because we could not verify it from a primary source: whether a payment processor is a business associate, and what that means for storing card credentials alongside protected health information. We looked and found no HHS or OCR guidance on point. That question is worth putting to counsel rather than to a consultant, and anyone who answers it confidently without a citation is guessing.

Online bill pay healthcare patients will actually use

The highest-return configuration in this whole area is the least glamorous: letting a patient settle a balance without creating an account. Portal login requirements are the most common reason an online payment does not happen, and they exist because the portal was designed for clinical messaging rather than for collections.

Pair that with a balance that appears on the statement as a link and a text, and most of the ageing problem resolves itself without anyone chasing anything. What remains is the genuinely difficult subset, and that is where payment plans earn their place.

Sequencing matters more than tooling. Estimate at scheduling, authorise at check-in, adjudicate, then charge the residual against the authorisation. Each step is a configuration in systems the practice already owns, which is why our workflow optimization work treats patient payment technology setup as part of the revenue workflow rather than a bolt-on.

Where to start

Start with the estimate, because it has a legal deadline and because it unlocks everything downstream. Then card on file, with a written authorisation you would be comfortable showing to a regulator. Then payment plans for the residual. Online bill pay without a login can be done at any point and usually should be done first, because it is the cheapest change on the list.

The rule set will keep moving. The FTC rulemaking is open, and whatever emerges from it will change the language on the authorisation. Build the authorisation so the language can be edited in one place, and this stops being a recurring project. A broader look at EHR solutions usually surfaces the scheduling and estimate gaps first, because that is where the deadlines live.

Patient payment technology: common questions