Medical Billing Payment Processing in 2026: HIPAA-Compliant Patient Payments, HSA/FSA Acceptance, and High-Risk Considerations

Call Bridge Capital Partners now at 866-305-6454 for medical billing payment processing support.

Medical practices, medical billing firms, laboratories, dental offices, behavioral health providers, and specialty clinics need payment systems that work across every patient channel.

The system must also protect card data.

It must support patient portals.

It must handle recurring payment plans.

It must accommodate HSA and FSA cards.

It must send accurate transaction data.

It must limit unnecessary exposure to protected health information.

Medical billing payment processing in 2026 requires more than a standard retail terminal. The account structure, merchant category code, gateway, data flow, billing language, and chargeback process all matter.

The correct setup depends on the business model.

A physician practice has different needs from a third-party medical billing company. A hospital has different needs from a telehealth provider. A dental group has different needs from a recurring concierge-care business.

This article explains the major requirements and risk considerations.

It is not legal, tax, HIPAA, or PCI compliance advice. Practices should confirm their final controls with qualified compliance counsel, their acquiring bank, their gateway provider, and their benefits-card administrator.

Start with the risk profile, not the label

Medical payment processing is not automatically high risk.

Healthcare providers are generally legitimate, regulated businesses. Many practices process ordinary office visits with established patient relationships and predictable billing patterns.

However, medical billing payment processing can receive elevated underwriting attention.

The risk usually comes from the transaction structure.

Common factors include:

• Card-not-present transactions.
• Mail-order and telephone-order payments.
• Patient portal payments.
• Recurring payment plans.
• Delayed insurance adjustments.
• Large balances.
• Third-party billing arrangements.
• Refunds after claim adjudication.
• Disputes about services, balances, or authorization.
• Multiple locations or provider entities.
• Cross-border patients or settlement.
• Sensitive patient information connected to payment records.

A card-not-present transaction carries a different dispute profile from a card-present transaction. The patient may not be physically present when the payment is processed. The practice must then establish that the patient authorized the transaction and that the amount was accurate.

Recurring billing creates another control requirement. A patient may authorize a payment plan, but the balance may later change after insurance processing. A practice that charges an outdated amount can create disputes and reconciliation problems.

Third-party medical billing creates additional complexity.

The billing firm may process payments for one provider or many providers. It may operate a virtual terminal. It may use a patient portal. It may receive account data from an electronic health record system. It may send statements and collect balances on behalf of a provider.

Those activities must be described accurately during underwriting.

Do not present a medical billing company as a generic software business if it is collecting patient payments. Do not present a provider as a billing agency if it is operating its own practice. The acquiring bank needs an accurate view of:

• The legal entity receiving funds.
• The business name shown to patients.
• The services being billed.
• The expected transaction channels.
• The average and maximum ticket.
• The monthly processing volume.
• The refund process.
• The recurring billing model.
• The countries involved.
• The software and gateway integrations.
• The role of each third-party vendor.

A correct risk profile supports better account stability.

It can also help avoid unexpected reserves, funding delays, transaction limits, or account closures.

Use a specialized high risk merchant account when the business has significant card-not-present exposure, prior processing problems, recurring billing, elevated dispute activity, or an unusual healthcare payment structure.

Separate HIPAA obligations from PCI DSS obligations

HIPAA and PCI DSS address different risks.

HIPAA protects protected health information.

PCI DSS protects payment account data.

The frameworks can overlap in the same payment environment. They do not replace each other.

HIPAA focuses on protected health information

The U.S. Department of Health and Human Services Office for Civil Rights defines protected health information broadly. It can include individually identifiable health information held or transmitted by a covered entity or business associate.

A payment record may become PHI when it connects an identifiable patient with healthcare services, diagnosis information, treatment information, procedure information, or an account balance tied to care.

A basic authorization record containing only payment data may not create the same HIPAA obligations as a billing record linked to a patient chart.

The data flow determines the analysis.

HHS guidance recognizes a financial institution exception for ordinary payment activities. A financial institution processing consumer-initiated credit card or electronic funds transfer payments for healthcare is generally not acting as a business associate for that ordinary payment function.

The analysis can change when a vendor performs additional services.

A vendor may become a business associate when it performs medical billing, practice management, claims processing, data analysis, or another service that requires access to PHI on behalf of a covered entity.

Review the official HHS business associate guidance before signing a payment technology agreement.

Ask these questions:

• Does the vendor see patient names?
• Does the vendor see account balances?
• Does the vendor receive procedure or diagnosis codes?
• Does the vendor connect payment data to an EHR?
• Does the vendor provide billing or practice management?
• Does the vendor generate patient-level reports?
• Does the vendor store receipts containing patient details?
• Does the vendor access the patient portal backend?
• Does the vendor use payment data for analytics on behalf of the practice?

If the answer is yes, the practice should determine whether a business associate relationship exists.

A business associate agreement may be required.

A payment processor may still be covered by the financial institution exception for ordinary card authorization and settlement while another part of the vendor’s service remains subject to HIPAA. Treat each service and data flow separately.

PCI DSS focuses on card data

PCI DSS applies to organizations that store, process, or transmit payment card data.

PCI DSS applies even when the transaction is for medical care.

PCI DSS v4.0.1 is the active version after PCI DSS v4.0 retirement. The PCI Security Standards Council describes v4.0.1 as a limited revision. It corrected errors and clarified requirements. It did not add or delete requirements.

The official PCI SSC v4.0.1 announcement identifies clarifications involving payment page scripts, cryptographic hashes, multi-factor authentication, and third-party service provider relationships.

A healthcare practice should map the cardholder data environment.

That map should include:

• Front-desk terminals.
• Mobile readers.
• Virtual terminals.
• Call-center workstations.
• Patient portals.
• Mobile applications.
• Hosted payment pages.
• Gateway connections.
• EHR integrations.
• Practice management systems.
• Token vaults.
• Reporting tools.
• Call recordings.
• Email and text payment links.
• Batch files.
• Refund and chargeback systems.

The safest architecture usually minimizes the number of systems that see raw card data.

Use hosted payment pages or hosted fields where appropriate.

Use point-to-point encryption where supported.

Use tokenization for recurring payments.

Keep full card numbers out of EHR notes, customer service tickets, email, spreadsheets, call recordings, and internal chat.

Do not record CVV or other sensitive authentication data after authorization.

PCI DSS and HIPAA can both be relevant to a patient portal. The portal may contain PHI. The payment page may contain card data. The integration between them may create the highest risk.

Build the payment flow around patient choice

Patients may need several ways to pay.

A practice should not force every patient into one channel.

The system should support appropriate payment methods while keeping the data flow controlled.

Card-present payments at check-in

A card-present transaction occurs when the patient presents a card at the office and the card is read by an approved terminal.

Use EMV-capable equipment.

Use contactless acceptance where appropriate.

Train staff to avoid writing card numbers on paper.

Do not store card details in a patient file.

Give the patient a receipt that does not expose unnecessary payment data.

The terminal should be assigned to the correct merchant account and location. The descriptor should identify the practice clearly. A confusing descriptor can lead to a “merchant not recognized” dispute.

Front-desk controls should cover:

• Terminal access.
• Staff permissions.
• Refund authority.
• End-of-day batching.
• Receipt handling.
• Lost or stolen device procedures.
• Device replacement.
• Network access.
• Physical inspection.
• Transaction review.

A payment terminal does not remove HIPAA responsibilities. Staff should still avoid saying sensitive patient information aloud where others can hear it.

Patient portal payments

Patient portals support convenient online payments.

They also create a card-not-present environment.

A portal should use a secure payment page or hosted fields when possible. The payment component should return a token and limited transaction metadata to the practice system.

The practice should not place the full primary account number in the portal database.

The payment page should be reviewed for:

• Script inventory.
• Third-party scripts.
• Content Security Policy.
• Change monitoring.
• Access control.
• Authentication.
• Session timeout.
• Error messages.
• Mobile usability.
• Receipt delivery.
• Refund handling.

PCI DSS v4.0.1 includes clarified applicability notes for payment page scripts. Healthcare organizations should review whether their portal payment page falls within the relevant e-commerce controls.

Patients should see:

• The legal or recognizable practice name.
• The amount.
• The payment date.
• A support phone number.
• The payment purpose in a privacy-conscious format.
• The refund or cancellation contact.
• The applicable merchant location information when required.

Avoid displaying diagnosis names, treatment descriptions, or detailed clinical information on a payment page unless the workflow requires it.

Phone payments

Phone payments remain common for medical billing firms and practices.

They are also vulnerable to manual-entry errors and unauthorized access.

Use a controlled virtual terminal or secure interactive voice response system.

Do not allow staff to collect card details in free-form notes.

Do not store card numbers in call recordings.

If calls are recorded, configure the recording system to pause or suppress payment data. Test the control. Document the test.

A phone payment script should confirm:

• The patient or authorized payer.
• The account or invoice reference.
• The amount.
• The payment method.
• The practice name.
• Whether the payment is one-time or recurring.
• The authorization for stored credentials, if applicable.
• The receipt delivery method.
• The dispute and refund contact.

A billing representative should not disclose unnecessary medical details during payment collection.

Use role-based access.

Limit payment tools to employees who need them.

Log refunds and voids.

Review unusual activity.

Recurring payment plans

Payment plans can help patients manage balances.

They also create ongoing authorization and reconciliation duties.

Before starting a payment plan, provide clear written terms. The terms should identify:

• The initial amount.
• The recurring amount or calculation method.
• The payment frequency.
• The expected number of payments.
• The estimated end date.
• The treatment of insurance adjustments.
• The refund policy.
• The cancellation process.
• The contact method for changes.
• The authorization for stored credentials.

Do not treat a recurring agreement as open-ended permission to charge any future balance.

If the balance changes, communicate the change.

If insurance pays part of the balance, update the scheduled amount.

If the patient cancels, stop future charges promptly.

If a card expires, use an approved account updater or ask the patient to provide a new payment method through a secure process.

A gateway with tokenization, recurring billing, automated retries, and reporting can reduce manual work. It cannot replace patient consent or accurate account reconciliation.

Accept HSA and FSA cards with the right controls

HSA and FSA acceptance is often requested by patients.

The payment processor alone does not decide whether a medical expense is tax-qualified.

The IRS defines qualified medical expenses under Internal Revenue Code section 213(d). In general, the expense must relate to the diagnosis, cure, mitigation, treatment, or prevention of disease, or affect a structure or function of the body.

The IRS rules differ between HSA distributions and employer-sponsored FSA card programs.

HSA payment considerations

The IRS states in Publication 969 that HSA distributions used for qualified medical expenses are generally not taxed. The expense must meet the applicable requirements.

For HSA purposes, the expense generally must:

• Be for the account holder, spouse, or qualifying dependent.
• Be incurred after the HSA is established.
• Not be reimbursed by insurance or another source.
• Be supported by records retained by the account holder.

The patient remains responsible for determining whether an expense qualifies.

A practice should not promise that every service can be paid tax-free with an HSA card.

The practice can provide an accurate description of the service and a compliant receipt. It should not provide tax advice.

FSA payment considerations

The IRS states that health FSA reimbursements must be for qualified medical expenses incurred during the coverage period.

Employer-sponsored card programs may use merchant controls and substantiation methods. Those controls can include merchant category codes, approved provider categories, and other administrator procedures.

A declined FSA card does not necessarily mean the medical service is ineligible. It may mean the card program cannot automatically substantiate the transaction.

The patient may need to pay another way and submit documentation to the plan administrator.

The practice should provide receipts that clearly show:

• Provider name.
• Date of service.
• General service description.
• Amount charged.
• Amount paid.
• Patient or account reference.
• Insurance adjustment, when applicable.
• Remaining balance, when applicable.

Avoid including unnecessary diagnosis information.

The practice should also confirm whether its merchant category code supports the relevant benefits-card program. Acceptance depends on the card issuer, the benefits administrator, the acquiring setup, the MCC, and the transaction environment.

2026 HSA figures

For 2026, IRS Publication 969 lists the following HDHP thresholds:

2026 HDHP measure	Self-only coverage	Family coverage
Minimum annual deductible	$1,700	$3,400
Maximum annual deductible and other out-of-pocket expenses	$8,500	$17,000

These figures concern HSA-qualified plan requirements. They do not determine whether a specific provider charge is a qualified medical expense.

IRS Publication 969 also lists 2026 HSA contribution limits of $4,400 for self-only coverage and $8,750 for family coverage. Those limits apply to contributions, not provider payment acceptance.

The IRS controls these tax rules.

The payment processor should not market a card acceptance configuration as a tax determination.

Assign the correct healthcare MCC

A merchant category code identifies the merchant’s primary business.

It can affect:

• Underwriting.
• Risk review.
• Benefits-card authorization.
• Transaction reporting.
• Cardholder recognition.
• Interchange treatment.
• Network monitoring.
• Dispute analysis.

The MCC must reflect the actual business.

Do not select a healthcare MCC solely because it produces a preferred rate or improves HSA/FSA approval odds.

Visa’s April 2026 Merchant Data Standards Manual states that the acquirer must assign the MCC that most accurately describes the merchant’s business. Visa also explains that a merchant with multiple lines of business may use the code for the business with the highest sales volume or use separate MCCs for separate lines of business when appropriate.

Common healthcare MCCs include:

MCC	Network description	Typical use
8011	Doctors and Physicians, not elsewhere classified	Licensed physicians providing general or specialized medicine
8021	Dentists and Orthodontists	Dental and orthodontic practices
8049	Podiatrists and Chiropodists	Licensed podiatry and foot-care practices
8099	Medical Services and Health Practitioners, not elsewhere classified	Medical practitioners not covered by a more specific healthcare code
8050	Nursing and Personal Care Facilities	Nursing, hospice, and personal care facilities
8062	Hospitals	Hospitals providing extensive medical and hospital services
8071	Medical and Dental Laboratories	Medical and dental laboratory services
8931	Accounting, Auditing, and Bookkeeping Services	Certain business billing or accounting services, not a default healthcare code

The Visa manual lists physical therapists, psychologists, fertility clinics, sports medicine clinics, and other providers under examples associated with MCC 8099 when no more specific code applies.

The correct code depends on the actual business.

A medical billing company should not automatically use 8011, 8099, or another provider MCC if it is not the healthcare provider delivering the service.

The payment structure must also be reviewed.

If a billing firm collects on behalf of multiple providers, the acquirer may need to evaluate the firm’s role, the providers, the patient-facing descriptors, the settlement flow, and the underlying merchant agreements.

Mastercard’s Quick Reference Booklet: Merchant Edition also lists healthcare codes such as 8011, 8021, 8049, 8050, 8062, 8071, and 8099. The booklet states that MCCs must accurately reflect the merchant’s primary business.

Review the MCC when the business changes.

Review it after a merger.

Review it when a practice adds a new service line.

Review it when a billing company begins collecting funds for other entities.

Reduce healthcare chargeback exposure

Healthcare chargebacks often involve confusion rather than fraud.

A patient may recognize the practice but not recognize the descriptor.

A patient may dispute a balance because insurance later paid part of it.

A patient may believe a recurring payment plan was canceled.

A family member may submit a payment without understanding the account relationship.

A patient may claim that a service was not received.

Common healthcare-related dispute scenarios include:

• Unauthorized card-not-present transaction.
• Duplicate patient payment.
• Incorrect balance after insurance adjudication.
• Refund not processed.
• Recurring charge after cancellation.
• Payment for a service the patient claims was not received.
• Confusing merchant descriptor.
• Incorrect amount entered by phone.
• Payment made to the wrong provider entity.
• Dispute caused by a billing statement that lacks detail.

The defense must start before the dispute.

Use a recognizable descriptor.

Send receipts promptly.

Provide itemized statements.

Match every payment to the correct patient account.

Reconcile insurance payments before initiating collection.

Record refunds and adjustments.

Document payment-plan consent.

Track cancellations.

Use address verification and card security controls where appropriate.

Avoid excessive retries on declined recurring payments.

When a dispute occurs, build an evidence package from accurate records.

Potential evidence can include:

• Transaction date.
• Authorization response.
• AVS result.
• CVV result, where available.
• Card-entry channel.
• Patient authorization.
• Payment-plan terms.
• Receipt delivery record.
• Statement delivery record.
• Service date.
• Amount due.
• Insurance payment.
• Contractual adjustment.
• Refund record.
• Cancellation record.
• Patient communication.
• Provider or billing-firm account notes.

Healthcare evidence requires special care.

A chargeback response may contain patient information. Access should be limited to authorized personnel. Send only the information reasonably necessary to address the dispute. Do not attach an entire medical record when a payment receipt and account ledger are sufficient.

If clinical information is necessary, consult the practice privacy officer or qualified counsel.

Confirm the amount before collection

Medical balances can change.

Insurance may pay.

A government program may pay.

A charity-care policy may reduce the amount.

A provider may waive part of the balance.

A patient may make a partial payment.

A billing error may require correction.

The Consumer Financial Protection Bureau’s medical debt collection advisory opinion addresses collection of amounts that were already paid, amounts not legally owed, amounts above federal or state limits, amounts for services not received, and amounts affected by upcoding.

The CFPB also explains that Regulation F and the Fair Debt Collection Practices Act prohibit false, deceptive, or misleading representations and unfair or unconscionable collection methods.

The guidance is especially important for third-party collection agencies and medical billing firms that meet the definition of a debt collector.

Before sending an account to collection, confirm:

• The patient is the correct debtor.
• The balance reflects all payments.
• Insurance adjustments are complete.
• Financial assistance rules were applied.
• The service was actually provided.
• The amount complies with applicable law.
• The patient agreement supports the charge.
• The account is not under an active dispute.
• The collection notice is accurate.
• The data transfer complies with privacy requirements.

The No Surprises Act can limit patient responsibility in certain circumstances. State laws can provide additional protections.

Nonprofit hospitals and other providers may also have financial assistance obligations.

Payment technology cannot correct an inaccurate balance. Accurate revenue-cycle controls must come first.

Select gateway features that support medical payments

A gateway should support the practice’s actual payment channels.

Use a payment gateway integration that fits the EHR, practice management system, patient portal, billing platform, and accounting workflow.

Important features include the following.

Tokenization

Tokenization replaces sensitive card data with a payment token.

The practice can use the token for future charges without storing the raw card number in its internal system.

The token vault remains in scope for PCI DSS. Tokenization does not eliminate all PCI responsibilities. It can reduce exposure when designed correctly.

Keep the token vault separate.

Restrict detokenization.

Use least-privilege access.

Log administrative activity.

Do not send tokens and PANs to the same reporting tools without a documented reason.

Hosted payment pages and hosted fields

Hosted payment pages can keep raw card fields outside the practice application.

Hosted fields can support an embedded experience while the payment provider controls the sensitive inputs.

The practice should review:

• The provider’s PCI documentation.
• The page ownership.
• Script controls.
• Redirect behavior.
• Mobile security.
• Branding.
• Receipt handling.
• Accessibility.
• Integration logs.
• Error handling.

A hosted page is not automatically compliant. The practice remains responsible for understanding its scope and completing applicable validation requirements.

Stored credentials

Stored credentials are useful for payment plans.

Use patient consent.

Explain how the credential will be used.

State the charge frequency.

Explain how changes will be communicated.

Provide a cancellation process.

Store only the minimum necessary metadata.

Never store sensitive authentication data after authorization.

The payment gateway should support appropriate stored-credential transaction indicators and network requirements. Confirm the current implementation with the acquiring bank and gateway.

Recurring billing and installment schedules

Recurring billing should support:

• Fixed schedules.
• Installment counts.
• Variable balances.
• Start and end dates.
• Automatic receipts.
• Decline retries.
• Account updater.
• Cancellation.
• Pause and resume.
• Refunds.
• Reporting.
• Webhooks.
• Patient notifications.

Do not allow a failed payment retry process to create repeated unauthorized attempts.

Do not continue billing after the plan ends.

Do not charge a new amount without the required consent or notice.

Virtual terminal

A virtual terminal supports phone and mail payments.

It should include:

• Employee permissions.
• Transaction notes that exclude full card data.
• Address verification.
• Refund controls.
• Receipt delivery.
• Search by transaction ID.
• Audit trails.
• Batch reporting.
• User-level activity logs.

Use a virtual terminal for payment processing, not as a substitute for a secure patient billing system.

ACH and electronic checks

ACH can help with recurring plans and larger patient balances.

It has different authorization, return, and dispute rules from cards.

The practice should provide clear ACH authorization terms.

The gateway should identify returns.

The billing team should not treat an ACH authorization as permanent permission for unrelated charges.

Use a broker to compare fit, cost, and stability

A merchant account broker can coordinate the application across acquiring banks and payment technology providers.

This can be useful when the business has:

• High card-not-present volume.
• Medical billing operations.
• Recurring patient payments.
• Multiple provider clients.
• Prior account termination.
• High average tickets.
• Complex refunds.
• EHR or practice management integration.
• International patients.
• ACH and card requirements.
• HSA/FSA acceptance goals.
• Multiple locations.
• Chargeback history.

A broker should review the complete payment model before recommending an account.

That review should include:

• Legal entity.
• Ownership.
• Provider licenses.
• Service descriptions.
• Website and patient portal.
• Patient agreement.
• Billing statement.
• Refund policy.
• Volume projections.
• Ticket sizes.
• Payment channels.
• MCC selection.
• Gateway requirements.
• Reserve terms.
• Funding schedule.
• Chargeback process.
• Privacy and security vendors.

The broker should also compare the full cost.

Review:

• Interchange.
• Acquirer markup.
• Gateway fees.
• Monthly platform fees.
• Batch fees.
• ACH fees.
• Chargeback fees.
• Retrieval fees.
• PCI fees.
• Account updater fees.
• Currency conversion fees.
• Reserve requirements.
• Early termination terms.

Request a statement-level explanation.

Bridge Capital Partners provides transparent credit card processing pricing and can compare pricing structures based on business type, volume, risk profile, and payment channels.

A broker should also help document the underwriting file.

A complete package can include:

• Corporate formation documents.
• Ownership information.
• Government identification.
• Processing statements.
• Bank statements.
• Website access.
• Patient terms.
• Refund policy.
• Privacy policy.
• Compliance contacts.
• Processing history.
• Chargeback history.
• Projected monthly volume.
• Average and maximum ticket.
• Provider agreements.
• Gateway and software details.

Use the available merchant account features to evaluate reporting, virtual terminal access, recurring billing, fraud screening, chargeback management, ACH, funding, and support.

A broker cannot make a healthcare business HIPAA compliant.

A broker cannot approve a medical expense for HSA or FSA tax treatment.

A broker cannot replace legal advice.

The broker’s role is payment infrastructure, account placement, pricing analysis, processor coordination, and ongoing account support.

The healthcare business remains responsible for its own billing accuracy, privacy, security, patient communications, and regulatory compliance.

Apply a practical 2026 review checklist

Use this checklist before changing processors or launching a new patient payment flow.

Business and underwriting

• Identify every legal entity.
• Identify every provider and billing firm.
• Document who receives funds.
• Describe every payment channel.
• Estimate average and maximum ticket.
• Document recurring billing.
• Document refund timing.
• Disclose prior processing history.
• Disclose chargeback history.
• Confirm domestic and international activity.

HIPAA and privacy

• Map every PHI data flow.
• Determine whether each vendor is a business associate.
• Sign BAAs where required.
• Limit patient data in payment tools.
• Restrict access by role.
• Review vendor security terms.
• Protect payment-related support tickets.
• Control call recordings.
• Minimize data in dispute responses.
• Maintain incident procedures.

PCI DSS

• Identify all systems that touch card data.
• Prefer hosted payment pages or hosted fields.
• Tokenize stored credentials.
• Keep PAN out of EHR notes.
• Keep SAD out of logs and recordings.
• Review payment page scripts.
• Complete the applicable SAQ or validation.
• Review third-party service providers.
• Use MFA where required.
• Segment the cardholder data environment.

HSA and FSA acceptance

• Confirm the correct MCC.
• Confirm issuer and administrator rules.
• Do not promise tax eligibility.
• Provide accurate receipts.
• Support manual documentation when appropriate.
• Separate HSA rules from FSA substantiation rules.
• Review 2026 IRS updates.
• Train staff to answer payment questions without giving tax advice.

Patient collection

• Reconcile insurance payments.
• Apply adjustments before collection.
• Confirm patient responsibility.
• Document financial assistance decisions.
• Track disputes.
• Track cancellations.
• Confirm services were rendered.
• Use accurate descriptors.
• Provide clear statements.
• Review federal and state collection requirements.

Get medical billing payment processing support now

Medical payment processing should be designed around the practice’s real operations.

Start with the data flow.

Confirm the merchant identity.

Assign the correct MCC.

Choose the right gateway.

Use tokenization.

Control stored credentials.

Support patient payment choice.

Protect PHI.

Limit PCI scope.

Reconcile balances before collection.

Document patient authorization.

Prepare accurate chargeback evidence.

Then compare the total account cost.

Bridge Capital Partners supports medical practices, medical billing firms, laboratories, dental providers, telehealth businesses, recurring-care companies, and other specialized merchants.

Call 866-305-6454 now for a payment processing review.

Sources

• HHS OCR: Business Associates
• PCI Security Standards Council: Just Published: PCI DSS v4.0.1
• IRS Publication 969: Health Savings Accounts and Other Tax-Favored Health Plans
• Visa Merchant Data Standards Manual, April 2026
• Mastercard Quick Reference Booklet: Merchant Edition
• CFPB Advisory Opinion: Deceptive and Unfair Collection of Medical Debt