A three-physician practice collected about $62,000 a month from patients by card last year, between copays at the desk, statement payments online and payment plans on file. Its processor statement ran nine pages. The office manager knew the headline rate, 2.9 percent plus 30 cents, because it was in the contract. She did not know the effective rate, total fees divided by total volume, until we added up the statement: $2,360 for the month, or 3.8 percent. The gap was a PCI non-compliance fee, a gateway fee, a higher rate on keyed and online transactions, and a chargeback fee that appeared four times.
Card acceptance is one of the few costs in a practice that scales with collections, so it deserves the same attention as a payer contract. Choosing a card processor for patient payments comes down to understanding how the fee is built, comparing the same fee lines across vendors, deciding what to do about surcharging, and keeping the PCI scope small. This article covers each of those, with a worked example, and closes with the PCI and HIPAA questions that belong in any processor contract.
Key takeaways
- Every card payment carries interchange (set by the card networks and paid to the cardholder's bank), network assessments, and the processor's markup; only the markup is negotiable, and the pricing model decides whether you can see it.
- Interchange-plus pricing passes interchange through at cost and adds a stated markup; flat-rate pricing blends everything into one rate that is simple but usually expensive for a practice with debit-heavy, card-present volume.
- Compare effective rate (total fees divided by volume), not headline rate, and the same twelve fee lines across every quote.
- Visa and Mastercard allow a surcharge on credit cards of up to 3 percent or the cost of acceptance, whichever is lower, never on debit, with 30 days' notice to the networks and disclosure at the entrance, the point of sale and on the receipt; several states, including Connecticut and Massachusetts, prohibit surcharging outright.
- A processor that offers validated point-to-point encryption terminals and hosted payment pages reduces your PCI DSS scope to the shortest self-assessment questionnaire, which matters more than a few basis points.
How a card fee is built
Three parties take a share of each transaction. Interchange goes to the bank that issued the patient's card, and its rate is set by the card networks in published tables that vary by card type (a regulated debit card costs a fraction of a premium rewards credit card), by how the card was presented (a chip or tap in person costs less than a number keyed in or entered online), and by merchant category. Assessments go to the card network itself, a small percentage plus per-transaction fees. The processor's markup is the third piece, and the only one your practice can negotiate.
The pricing model determines whether you can see those pieces. Under interchange-plus pricing, the statement shows interchange and assessments at cost and adds the processor's markup as a stated percentage and per-transaction fee (for example, 0.25 percent plus 10 cents). Under flat-rate pricing, everything is blended into one rate such as 2.9 percent plus 30 cents regardless of card type, so the practice overpays on every debit card and every in-person transaction to subsidize the simplicity. Tiered pricing, which sorts transactions into "qualified" and "non-qualified" buckets at the processor's discretion, hides the markup entirely; we tell practices not to sign it.
Two features of practice volume favor interchange-plus. A large share of patient payments are debit cards, including health savings account and flexible spending account cards, which run at debit interchange, and a practice whose merchant category code identifies it as a physician office accepts those cards without special certification. And most copays are card-present at the desk, where interchange is lowest. Flat-rate pricing throws both advantages away.
The fee lines to compare
| Fee line | What it is | What to ask |
|---|---|---|
| Markup percentage and per-item fee | The processor's margin over interchange and assessments | Quote it on interchange-plus; confirm it is the same for all card types |
| Card-not-present rate difference | Higher cost for online, phone and keyed transactions | Is the markup the same, or is there an added percentage for keyed and online? |
| Monthly account or service fee | A fixed monthly charge for the merchant account | Amount, and whether it is waived above a volume threshold |
| Gateway fee | Monthly and per-transaction charge for the online payment connection | Included, or billed separately by a gateway vendor? |
| PCI compliance fee and PCI non-compliance fee | An annual or monthly program fee, and a penalty when the self-assessment questionnaire is not on file | Both amounts; how the SAQ is submitted; who reminds you |
| Statement, batch and minimum fees | Small fixed charges per statement, per daily settlement, or when volume is low | List every fixed fee on the schedule |
| Chargeback and retrieval fees | Charged when a patient disputes a payment, whether or not you win | Amount per dispute; process for responding |
| American Express rate | Often priced separately and higher | Is it interchange-plus as well? |
| Equipment | Terminals purchased, rented or leased | Never lease; a terminal costs a few hundred dollars to buy |
| Early termination and auto-renewal | Contract length, cancellation penalty, renewal terms | Month-to-month or a one-year term with no penalty |
| Integration and posting fees | Charges for the connection that posts payments to the practice management system | Included with the PM vendor, or a separate per-transaction fee? |
| Text-to-pay and card-on-file features | Per-message or per-token charges for payment plans and reminders | Amounts, and whether tokens transfer if you leave |
Ask every vendor to fill in the same table, then compute the effective rate for your actual volume. Most vendors will run your last three statements through their pricing if you ask; the ones that will not are telling you something.
A worked example: $62,000 a month
Take the practice from the opening: $62,000 a month across about 1,250 transactions, roughly 55 percent debit and HSA cards, 45 percent credit, 60 percent card-present at the desk and 40 percent online or keyed. Under its flat-rate contract, 2.9 percent plus 30 cents, the base processing cost is $1,798 plus $375 in per-item fees, or $2,173. Add a $25 monthly fee, a $15 gateway fee, a $35 PCI non-compliance fee and four chargebacks at $25: $2,368, an effective rate of 3.8 percent.
On an interchange-plus quote of 0.25 percent plus 10 cents, the same volume looks different. Interchange for that card mix works out to roughly 1.5 percent, or $930, because more than half the volume is debit and most of it is card-present; assessments add about 0.14 percent, or $87. The markup is $155 plus $125 in per-item fees. A $20 monthly fee, a $10 gateway fee and the same four chargebacks bring the total to about $1,427, an effective rate of 2.3 percent. The difference is about $940 a month, or $11,300 a year, and $420 of the annual gap was a PCI non-compliance fee that a completed questionnaire would have eliminated at either processor.
Those interchange figures are illustrative; your card mix decides yours. The method is what matters.
Surcharging, cash discounts and convenience fees
Surcharging means adding a fee to credit card transactions to recover the cost of acceptance. The card brand rules allow it under conditions: credit cards only, never debit or prepaid, even when the debit card is run as a signature transaction; a surcharge no higher than 3 percent or your actual cost of acceptance, whichever is lower (Visa lowered its cap to 3 percent in April 2023); written notice to the card networks and your processor at least 30 days before you start; and disclosure at the entrance, the point of sale, the online checkout page and as a separate line on the receipt. Most processors will configure the terminal to detect debit cards and exempt them automatically.
State law sits on top of the brand rules. Connecticut and Massachusetts prohibit surcharges outright, and other states impose caps or disclosure requirements (New York, for example, requires the full card price to be posted). The rules have shifted repeatedly through litigation and legislation, so check your state's current law and ask counsel before you post a sign. Payer contracts rarely address surcharges on patient cost sharing, but a few do; read yours.
Two alternatives avoid most of the complexity. A cash discount program posts the card price as the standard price and offers a discount for cash or check, which the card brands permit without the surcharge notice process, though state price-posting rules still apply. A convenience fee is a flat fee charged only for using an alternative payment channel, and the brand rules for it are narrow. In our experience, most independent practices are better off negotiating the processing rate down than adding a fee patients notice, and the practices that do surcharge see it in their online reviews. Write the front desk script before the sign goes up.
PCI scope and HIPAA
PCI DSS version 4.0 became the only active standard on March 31, 2024, and its future-dated requirements took effect March 31, 2025. A small practice's obligation is a self-assessment questionnaire (SAQ) and, for online payments, quarterly vulnerability scans, but which questionnaire depends on how card data touches your systems. A practice that uses validated point-to-point encryption (P2PE) terminals and a hosted payment page that keeps card numbers off its own website qualifies for the shortest questionnaires. A practice that keys card numbers into a browser or stores them in a spreadsheet for payment plans is in the longest one, and is one lost laptop from a very expensive problem. Ask each processor which SAQ their solution puts you in and whether they provide P2PE-listed terminals; that answer is worth more than a tenth of a point on the markup.
The HIPAA question comes up in every contract review. Payment processing itself is excepted from HIPAA under the statute's financial institution provision, so a processor that only authorizes and settles transactions is generally not a business associate. A patient payment platform that displays balances, hosts statements, sends reminders with visit details or stores payment plans tied to accounts is handling protected health information and needs a business associate agreement. Most patient payment vendors are both at once, and most will sign; a vendor that refuses is a vendor to avoid. Our website and technology team checks this on every payment page we build, and our billing team insists on the posting integration because a payment that does not post itself costs a person time every day.
Questions we hear
Our practice management vendor bundles a processor. Should we just use it?
Often yes, because the integration posts payments automatically and tokenizes cards for payment plans, and that labor saving can outweigh a higher markup. But get the fee schedule in the same twelve-line format, and ask whether you can use a different processor with the same integration; some vendors charge a per-transaction fee for outside processors, which changes the math.
Can we store card numbers for payment plans?
Not on paper and not in a spreadsheet. Use the processor's tokenization, which stores the card in the processor's vault and gives you a token to charge against, and get written card-on-file consent with the amount, frequency and end date. Ask whether the tokens are portable if you change processors; if not, the vendor has made leaving expensive on purpose.
Why did our rate go up when we started taking payments by text?
Because text-to-pay and online payments are card-not-present transactions, which carry higher interchange, and many processors add their own percentage for keyed and online volume. The convenience is usually still worth it, since patients pay faster and statement costs fall, but push for the same markup across channels.
What to do this week
- Pull the last three processor statements and compute the effective rate: total fees divided by total volume.
- Count transactions by type (debit versus credit, card-present versus online or keyed) so quotes can be priced against real volume.
- Send the twelve-line fee table to your current processor and two others and ask each to price your actual volume on interchange-plus.
- Check whether your PCI self-assessment questionnaire is current and which SAQ you are completing; stop any non-compliance fee.
- Look up your state's surcharge law and your payer contracts before deciding on surcharging, cash discounts or neither.
- Confirm a business associate agreement is in place with any vendor that hosts statements, balances or payment plans.
