PCI Compliance for Medical Offices: Get Card Numbers off Intake Forms

On this page 8 sections

1. The Security Code Rule Most Intake Forms Break
2. Follow One Patient's Card Through the Office
3. PCI vs. HIPAA: Why One Form Can Be Two Problems
4. Keep the Consent, Drop the Card Number
5. Phone Payments Without a Notepad
6. How Card Handling Sets Your Medical Office's PCI Scope
7. Clean up the Card Numbers Already in Your Charts
8. Front-Desk Rules That Keep a Medical Office PCI Compliant

Key takeaways

• If a single intake form asks for the card security code, the practice is out of line with PCI DSS Requirement 3.3.1. Encrypting the form or locking it in a cabinet doesn't fix that.
• Visa and Mastercard stored-credential rules require consent before a card is kept on file. You can keep that consent while storing only a token and the last four digits.
• Call recordings that capture a spoken security code count as stored sensitive authentication data. Pause recording during payments or take them on a line that isn't recorded.
• Since 2025, practices using a hosted bill-pay page under SAQ A must confirm their site isn't open to script attacks and are expected to run scans every three months.

For most practices, PCI compliance in a medical office fails at the clipboard long before it fails at the card reader. The usual culprits are a "card on file" box on the intake form and a card number typed into a practice management (PM) note so billing can run the balance later. The fix is to keep the patient's signed consent but move the card itself onto a terminal or secure payment page, so your systems hold a token instead of a number. Then redact the card numbers already sitting in your charts.

This is general information, not legal or compliance advice. Confirm your obligations with your processor and a qualified professional, and bring your HIPAA privacy officer into any change to patient records.

The Security Code Rule Most Intake Forms Break

The three- or four-digit security code sits in a stricter category than the card number. PCI DSS, the card industry's data security standard, sorts card data into two groups. Cardholder data, such as the card number and expiration date, may be stored if it is protected. Sensitive authentication data may not be kept at all once a transaction is authorized. That second group covers the PIN and the full magnetic-stripe or chip data. It also covers the security code, which is the piece intake forms tend to ask for.

Requirement 3.3.1 of PCI DSS v4.0.1 says sensitive authentication data is not retained after authorization, even if encrypted. That is the only active version, because the PCI Security Standards Council retired v4.0 on December 31, 2024. The Council's data storage do's and don'ts fact sheet makes the same point and names the validation code printed on the front or back of the card. Encryption doesn't fix it. Neither does a locked file cabinet.

The card number has its own rule. Under Requirement 3.5.1, a stored card number must be rendered unreadable, for example with strong cryptography. A full number in a free-text PM note or on a scanned PDF is stored in readable form.

So an intake form that asks for the security code breaks the rule the first time a patient fills it in, and a properly built card-on-file setup never needs the code. If your form asks for it, change the form before anything else.

Follow One Patient's Card Through the Office

This walk-through is illustrative. The practice is made up, but every step is a common front-office habit.

A new patient fills out a paper registration packet whose card-on-file section asks for everything on the card, security code included. The front desk scans the packet into the EHR and files the paper original in the chart. Billing types the card number, minus the code, into a PM account note so it can charge the post-insurance balance in six weeks. Before the patient's procedure, the surgery scheduler faxes the signed authorization page to billing, and the fax server keeps a PDF.

Count the copies. The office now holds four readable copies of the card number, one in every place the packet went. It holds three copies of the security code, because only the PM note left it out. None is encrypted, and each sits next to the patient's name and insurance details.

Now run the same visit with a tokenized setup. The patient signs a consent section with no card fields. At check-in, the patient taps or inserts the card on a front-desk terminal. The processor's gateway keeps the card data in its vault and returns a token: a stand-in value your system can use to charge the card later without ever holding the number. The PM system stores the token and the last four digits, linked to the signed consent. Readable copies of the card number in the office: zero.

PCI vs. HIPAA: Why One Form Can Be Two Problems

A strong HIPAA program doesn't cover payment data on its own, because the two frameworks come from different places.

A card number on an intake sheet that also shows a reason for visit is cardholder data and PHI at once. Every number you remove lowers your exposure under both. Our plain-English guide to PCI DSS compliance covers the card side in more depth.

Keep the Consent, Drop the Card Number

You need the patient's documented agreement before charging a stored card for a post-insurance balance or a payment plan installment, and the card networks require it too. Visa and Mastercard issued stored-credential rules in October 2017. As CardPointe's summary of the mandate explains, a merchant keeping a card or token for future charges must say how it will be used and get the cardholder's consent to store it. If those terms change, the cardholder has to be told. These are network rules that reach you through your merchant agreement, so ask your processor what consent records it expects you to keep.

The change is to separate the consent from the card number:

1. Keep the consent language. Spell out what you will charge, such as the patient's share after the insurer processes the claim, and any per-charge maximum. Say how you'll notify the patient before a charge and how they can withdraw consent.
2. Capture the card on a device or a secure payment page the patient fills in, never on paper.
3. Store only the token your gateway or integrated system returns, plus the last four digits staff need to identify the card.
4. Link the signed consent to that token, so billing can show a patient exactly what they agreed to if a charge is questioned.

Our guide to charging a card on file after insurance pays covers how to word the patient notice, and our comparison of credit card terminals for medical and dental front desks walks through check-in setups. MannyPay sells smart terminals for chip and tap card capture, including Clover and PAX models.

Phone Payments Without a Notepad

Billing teams take a steady stream of phone payments, from parents paying for a child's visit to surgical patients sending deposits. The risk is the pen between the phone and the keyboard.

Key the card straight into a virtual terminal for phone payments while the patient is on the line. It runs in a web browser, so nothing gets written down. Better still, text or email a secure payment link and let the patient enter the card, so staff never hear the number. Our article on text-to-pay for medical bills shows how practices use links for balances.

Call recordings are the copy most offices miss. If a patient reads the security code aloud on a recorded line, the recording holds sensitive authentication data after authorization, which Requirement 3.3.1 forbids. Ask your phone vendor whether recording can pause during payment, or route payments to a line that isn't recorded. Print on statements that the office never accepts card numbers by voicemail or email.

Keyed and link payments are card-not-present transactions. They are priced differently and carry more fraud risk than a tapped card. Our guide to taking card payments over the phone safely covers how to verify callers.

How Card Handling Sets Your Medical Office's PCI Scope

Most small merchants confirm PCI compliance each year with a self-assessment questionnaire. The Council publishes several versions, and the one you file depends on how card data moves through your practice. Your processor or acquiring bank decides which one applies, so get its answer in writing. The table is a general guide, not an eligibility test.

The conditions for hosted pages changed in 2025. Requirements 6.4.3 and 11.6.1, which govern scripts on payment pages, took effect March 31, 2025, but the Council removed both from SAQ A, the shortest online questionnaire. In their place, merchants must confirm their site isn't open to script attacks on their e-commerce systems. SAQ A merchants are also expected to run vulnerability scans every three months through an Approved Scanning Vendor. If your patient portal links to a hosted payment page, ask the portal vendor how it meets that condition.

The last row is why cleaning up intake forms matters. Getting rid of stored card data is often the change that simplifies your questionnaire most.

Clean up the Card Numbers Already in Your Charts

Changing the form stops new copies but leaves years of old ones, so plan a one-time sweep. Search PM and EHR notes for long runs of digits and for the shorthand staff use when jotting cards down, such as "exp" or "cc." Then check scanned financial documents and the fax archive, followed by shared drives and billing inboxes. Boxed paper files come last.

This is where HIPAA and PCI collide. An intake form may be part of a record your practice must keep under state law or its own policy, so shredding the whole page may not be an option. Black out the card number and security code on the paper original or scanned image and keep the rest of the record intact. In PM notes, replace the number with something like "card captured on terminal; token on file." For patients whose cards you still need, collect them again with a tap at the next visit or through a secure link. Agree on the procedure with your privacy officer before anyone starts.

Log where you searched and what turned up. Then note each redaction and whether the material was cross-cut shredded or securely deleted. That record supports both your PCI questionnaire and your HIPAA documentation.

Front-Desk Rules That Keep a Medical Office PCI Compliant

Front-desk staff turn over often, and new hires pick up the last person's habits. Put the rules in writing and into onboarding.

Give staff a line for the awkward moments. When a patient starts reading a number aloud: "Thanks. For your security, I'll have you tap it right here instead." If a card photo arrives by email, delete it and reply with a payment link. When a provider asks for a shortcut, point to the written policy. Review it each year alongside your questionnaire, and again whenever your systems or staff change.

This week, pull your intake packet and every authorization form and strike out the card number and security code fields. Then ask your processor in writing which questionnaire it expects from your practice. If you want a second look at how your office takes payments, MannyPay works with medical practices and healthcare providers on in-office terminals and on gateways such as Authorize.net and NMI. Request a free quote and a MannyPay specialist will respond within one business day.

Sources

1. Payment Card Industry Data Security Standard v4.0.1 (PCI Security Standards Council; copy hosted by Middlebury College)
2. PCI Data Storage Do's and Don'ts (PCI Security Standards Council fact sheet)
3. Just Published: PCI DSS v4.0.1 (PCI Perspectives blog, PCI Security Standards Council)
4. Important Updates Announced for Merchants Validating to Self-Assessment Questionnaire A (PCI Security Standards Council)
5. Now Is the Time for Organizations to Adopt the Future-Dated Requirements of PCI DSS v4.x (PCI Security Standards Council)
6. Visa and Mastercard Stored Credential Transaction Framework Mandate (CardPointe support documentation)

IC

About the author

Isabella Cruz

Isabella Cruz is Business Growth & Commerce Editor for Beyond the Swipe, writing for small businesses, restaurants, retailers, entertainment venues and e-commerce sellers.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.