A dermatology practice we work with implemented card on file in the spring of 2024. By the end of that year, patient balances over 90 days had fallen by more than half and the statement volume had dropped enough that they cancelled the outsourced statement vendor. The same practice also fielded two chargebacks, one formal complaint to the state attorney general's consumer office, and a stretch of unhappy front desk conversations in the first two months, all because the initial policy had no dollar cap and no notice before the charge. The fix was a page of policy and a change to the payment system settings. The lesson is that card on file works, and the details decide whether it works for the practice or against it.
A card on file policy for medical practices means that at check-in the patient authorizes the practice to store a payment method securely and to charge it for the patient's portion of the visit after the insurance claim has been processed, within limits the patient agreed to in writing. The appeal is obvious. The patient responsibility for a visit is not known with certainty until the remittance arrives, weeks later, and collecting it by statement costs money and time and fails often. Charging the card the patient already provided closes the balance the day the remit posts.
The risks are just as real: charging more than the patient expected, charging for an amount the payer got wrong, storing card data in a way that exposes the practice, and losing patient trust. Here are the policy elements, the technology requirements, the workflow and the exceptions.
Key takeaways
- Card on file requires written, specific consent that states what will be charged, when, up to what amount, and how the patient will be notified first.
- Set a per-charge cap, commonly $150 to $300, above which the practice sends a statement or calls instead of charging automatically.
- Never store card numbers in the practice; use a payment processor that tokenizes the card so the practice holds only a reference, and confirm your PCI scope.
- Send an itemized notice with the insurance explanation a set number of days before every charge, and give the patient a way to dispute it first.
- Offer alternatives for patients who decline, and honor them; card on file is a default, not a condition of care.
Why practices adopt it and what it does to the numbers
Patient responsibility has grown as a share of practice revenue for a decade, driven by high-deductible plans. The traditional collection method, a statement cycle of three mailings over 90 to 120 days followed by a collection agency, recovers a fraction of small balances at a cost that often exceeds the balance. Card on file replaces the cycle with a single charge shortly after adjudication. Practices that implement it well report large reductions in patient AR over 60 days and in statement costs, and a modest reduction in front desk phone time. In the dermatology practice, the patient share of AR over 90 days went from about 31 percent of patient AR to about 12 percent within eight months.
The effect is largest for practices with many small balances: primary care, pediatrics, dermatology, physical therapy. It is smaller for surgical specialties, where the cap excludes most charges.
The consent form: what it has to say
Consent is the whole legal and practical foundation. A generic "I authorize the practice to charge my card" line buried in the financial policy is not sufficient in our view and is what generated the dermatology practice's complaint. The consent should be a standalone paragraph or page, signed or electronically acknowledged, that states in plain language: the practice will store the payment method securely through its processor; after the patient's insurance processes each claim, the practice will charge the patient's portion as determined by the insurer's explanation of benefits; the charge will not exceed a stated dollar amount per visit without separate authorization; the patient will receive an itemized notice a stated number of days before the charge; the patient may dispute the amount before it is charged by contacting the office; the patient may withdraw the authorization at any time in writing; and the card will not be charged for anything else.
Include the cap and the notice period as actual numbers in the form, not as "reasonable" or "in accordance with policy." Give the patient a copy. Renew the consent annually or when the card changes. And have counsel review the form against your state's consumer protection and medical debt laws, several of which have added notice and billing requirements for medical providers in the past few years.
| Policy element | What we recommend | Why it matters |
|---|---|---|
| Consent | Standalone signed or e-signed authorization, renewed annually | Defends against chargebacks and complaints; sets expectations |
| Per-charge cap | $150 to $300, stated in the form; higher requires a call | Prevents the surprise large charge that damages trust |
| Notice before charge | Itemized email or text with the EOB summary, 5 to 7 days before | Gives the patient time to question a payer error before money moves |
| Dispute path | Reply to the notice or call; charge held while reviewed | Turns a chargeback into a phone call |
| Storage | Processor tokenization only; no card numbers in the practice | Keeps the practice out of PCI scope for stored data |
| Alternatives | Statement or payment plan for patients who decline | Card on file is not a condition of receiving care |
| Refunds | Refund to the same card within a set number of days when a payer reprocesses | Payers correct claims; the patient should not chase the money |
The technology requirements that are not optional
The practice must never hold card numbers. Not on paper in a drawer, not in a field in the practice management system, not in a spreadsheet. The card is entered once, at check-in or by the patient through the portal, directly into the payment processor's system, which returns a token: a reference string that the practice stores and that can be used to initiate charges but cannot be reversed into the card number. The processor holds the card data under its own PCI DSS certification. The practice's PCI scope shrinks to the devices and staff that handle the card at the moment of entry, which is manageable; storing numbers would put the practice in a scope it cannot realistically meet.
Ask your payment processor or practice management vendor three questions in writing. Do you tokenize, and does the token stay with the patient record? Do you support card account updater, so that when a card is reissued with a new expiration date the token keeps working? And is the card-on-file charge integrated with the practice management system so that posting the patient responsibility from the remittance can trigger the notice and the charge without rekeying? The third question determines whether the workflow is automated or a manual chore that stops when the person who does it is out. Card on file also works well alongside the online payment and estimate features we build into practice websites, because the patient who entered a card through a portal expects to see the charges there.
The workflow from check-in to charge
At check-in, the front desk explains the policy in one sentence, offers the form, and enters the card into the processor terminal or lets the patient enter it on a tablet. Copays are still collected at the visit; card on file is for the balance that is unknown until adjudication. The consent and the token are recorded on the patient account with the date. Patients who decline are marked as statement or plan, and that is the end of the conversation.
When the remittance posts and a PR balance transfers to the patient, the system (or the biller, if it is manual) checks three things: the patient has an active card-on-file consent, the balance is at or below the cap, and there is no secondary payer still to adjudicate. If all three are true, the notice goes out: an itemized message showing the date of service, the insurer's allowed amount, what the insurer paid, the patient's deductible, coinsurance or copay portion, and the date the card will be charged. Five to seven days later, if the patient has not disputed, the charge runs and a receipt is sent. If the balance exceeds the cap, the patient gets the same notice with a request to call and arrange payment or a plan. If a secondary payer exists, the balance waits.
Disputes are handled by holding the charge and reviewing the claim. Most disputes turn out to be payer errors (a copay applied that the plan does not have, an out-of-network adjudication for an in-network visit) and the practice would have had to fix them anyway; the notice just surfaced them before the charge instead of after. Refunds, when a payer reprocesses and the patient owed less, go back to the same card within a set number of days, automatically where the system allows.
Exceptions and fairness
Medicaid patients generally cannot be charged beyond nominal cost sharing, so card on file does not apply to them and the workflow must exclude them. Patients with documented financial hardship under your policy should be routed to the plan or hardship process rather than charged. Minors' accounts belong to the guarantor, and the consent must be the guarantor's. Patients who withdraw consent must have the token deactivated the day they ask. And the practice should be able to show, for any charge, the consent, the notice and the remittance line that produced the amount. If it cannot, it should not have charged.
The dermatology practice's complaint came from a $480 charge with no notice on a card the patient had given for a copay two years earlier. Under the policy above, that charge would have been a notice and a phone call, and the practice would have collected the money anyway, more slowly and without the complaint. Our medical billing team sets it up for practices with those rules built in.
Questions we hear
Can we require card on file as a condition of being seen?
We advise against it, and in some states and for some payer contracts it may not be permissible. Offer it as the default with clear alternatives. Most patients accept it when the cap and notice are explained; the ones who decline are a small share and a statement still works for them.
What happens when the payer reprocesses a claim months later and the patient owed less?
Refund to the card promptly, with a notice explaining why. Build the refund step into the policy from the start, because payers reprocess claims constantly and a practice that charges quickly must refund just as quickly to keep trust. Track refunds by month; a rising count means a payer is adjudicating wrongly on the first pass.
Does card on file affect our HIPAA obligations?
The payment processor handles cardholder data under PCI rules, and the notice you send contains protected health information (dates of service and amounts), so it must go through a channel the patient has agreed to and that meets your HIPAA policies, such as the secure portal or a text or email the patient has consented to receive. Do not put diagnosis or service descriptions in an unencrypted text.
What to do this week
- Ask your payment processor or practice management vendor in writing whether it tokenizes cards, supports account updater and integrates the card-on-file charge with remittance posting.
- Draft the consent form with a specific dollar cap and notice period, and send it to counsel with a note about your state's medical billing notice laws.
- Write the exclusion rules: Medicaid, hardship, secondary coverage pending, balances above the cap.
- Build the notice template with the itemized explanation of benefits summary and the charge date.
- Pilot with one provider's patients for 60 days, track disputes and refunds, and adjust the cap before rolling out.
