Integrated Payments FAQ

PCI DSS Level 1 is the highest tier of Payment Card Industry Data Security Standard compliance, required for organizations processing large volumes of card transactions and involving the most rigorous security assessment and validation requirements.

Typically the payment processor/platform maintains PCI DSS Level 1 compliance for the infrastructure, while the practice follows simpler compliance steps like not storing raw card numbers — confirm the specific division of responsibility with your vendor.

Non-compliance can expose a practice to data breach liability and potential fines from card networks, which is why using a compliant integrated payment platform matters.

Yes, storing card-on-file data requires tokenization or similarly secure storage methods so raw card numbers are never directly stored by the practice.

PCI DSS compliance validation is typically an annual process for the entity holding Level 1 status — confirm your vendor's current compliance status and validation date.

Typical options include card-on-file, HSA/FSA cards, and structured payment plans, in addition to standard one-time card or cash payment.

Many payment platforms can detect HSA/FSA card types at the point of sale, which matters for reporting and patient recordkeeping — confirm this detection is supported.

Patients can typically be set up on a recurring auto-charge schedule against their card on file for a larger balance, with configurable installment amounts and frequency.

Card-on-file is generally required to support automated payment plan charging, since there needs to be a payment method to charge on each scheduled date.

A patient self-service option to update payment info reduces staff workload — confirm whether this is available via patient portal or requires calling the office.

An integrated terminal connects directly to the practice management system so payments post automatically to the patient's ledger; a standalone terminal processes payment separately, requiring staff to manually enter the amount into the PMS afterward.

Yes, automatic posting removes the manual re-entry step that's a common source of reconciliation errors with standalone terminals.

Pricing varies by vendor and hardware — confirm the cost comparison directly, since integration value (time saved, fewer errors) needs to be weighed against any price difference.

This depends on hardware compatibility — some standalone terminals can be integrated via a software update, others require new hardware. Confirm compatibility with your current terminal.

Offline fallback behavior varies by vendor — confirm whether transactions can still be processed and reconciled later during an outage.

Statements are typically generated automatically based on outstanding balances and sent via the patient's preferred channel — mail, email, or text — reducing manual statement preparation.

Yes, triggering a patient balance notification once the insurance payment has posted — revealing the true remaining balance — is a common automated billing workflow.

Faster, more frequent balance communication generally correlates with faster patient payment compared to relying on monthly paper statements alone.

A direct pay-now link in the notification, rather than requiring a separate login, significantly increases payment conversion — confirm this is included.

Yes, statement and reminder frequency should be configurable rather than fixed to a single schedule.

ERA matching automatically reconciles the electronic payment and adjustment details a payer sends after processing a claim against the corresponding patient ledger entries, rather than staff manually posting each line from a paper EOB.

It eliminates most routine posting, but exceptions — unmatched payments, unusual adjustment codes — typically still require manual review.

Unmatched ERAs should be flagged for staff review rather than silently discarded or misapplied to the wrong patient account.

Yes, reconciliation logic should handle sequential primary/secondary ERA postings correctly, matching each payment to the right portion of the claim.

Time savings depend on claims volume — ask your vendor for a benchmark specific to your practice size rather than a generic figure.

Contactless/NFC payment support — Apple Pay, Google Pay, tap-enabled cards — is standard on most modern integrated payment terminals; confirm this is included with your specific terminal model.

Yes, NFC transactions use tokenized, encrypted data rather than transmitting raw card numbers, generally making them more secure than a magnetic stripe swipe.

No — contactless payment works with a patient's existing phone wallet, like Apple Pay or Google Pay, or a tap-enabled physical card; no separate app is required.

Processing fees are typically the same across payment methods for card-present transactions, though confirm your specific merchant agreement for any variation.

Auto-charges for payment plans typically run against the stored card token regardless of how it was originally captured, so this shouldn't be a limiting factor.

This depends on state law — some states restrict or ban credit card surcharging entirely, while others allow it with specific disclosure requirements, so this varies significantly by state.

Automated, state-aware surcharge compliance is a valuable feature since manually tracking rules across states is error-prone — confirm whether this is built into your platform, especially important for multi-state DSOs.

Yes — surcharging adds a fee for card payment, while a cash discount program frames pricing the other way, as a discount for paying cash, and the two are regulated somewhat differently.

States that permit surcharging generally require clear disclosure of the surcharge amount or percentage before the transaction completes — confirm your posted signage and checkout flow meet your state's specific requirement.

Yes — given how much surcharge law varies by state and changes over time, confirming with legal counsel before enabling it is a reasonable precaution.

Yes, automated balance reminder sequences that escalate in frequency and tone are typically used before an account is considered for collections, reducing how often accounts need to be sent externally at all.

Yes, thresholds — such as balances over 90 days or above a certain dollar amount — should be configurable to trigger different follow-up steps.

Direct collections agency integration is a more advanced feature — confirm whether this is built in or whether accounts need to be exported manually for outside collections.

Offering a payment plan option as part of the balance follow-up sequence is a common way to resolve balances before external collections becomes necessary.

Communication and consent tracking matters here since debt collection communications can be subject to separate regulations like the FDCPA — confirm how this is handled if the practice or its collections partner is subject to those rules.