A card on file feels like it should make payment simple.
The patient signed an authorization. Their card is saved. They owe you money. Charge the card.
Except there are four different questions hiding inside that one workflow:
A card on file answers the last one, and often not as clearly as the practice assumes. It answers none of the first three.
On Monday I argued that a policy is a set of decisions you already made, written down. This is what that looks like when you take one deceptively simple policy apart. "Card on file" is not one thing. It is five different situations that practices collapse into a single sentence.
A fixed copay is the cleanest case.
If the plan says the visit carries a $30 copay, you generally know what you are trying to collect. The decision left is when. Before the appointment, at check-in, at the end, or automatically from the card on file afterward. Monday covered those tradeoffs. The useful part here is that you are starting from a known patient responsibility rather than predicting what the insurer will do.
Even so, having the card is not the same as being free to use it however you like. A stored payment credential is something the patient agreed to have kept and used in described circumstances. It is not blanket permission created by the fact that you possess the number. Your authorization should describe what the stored payment method may be used for and, where applicable, what event triggers the charge or how the amount will be determined.
You can often verify useful benefit information before the appointment. Plans make eligibility information available, and it can include deductible status, copays and coinsurance.
That is not the same as knowing the final patient-responsibility amount for this particular claim. Coinsurance runs off the plan's allowed amount. Deductible responsibility depends on how the plan ultimately applies this claim, including claims you do not control that may process first. After processing, the remittance tells you what portion the payer assigned to the patient.
So there are two legitimate workflows.
One practice says: we will estimate what you are likely to owe, collect it now, and reconcile after the claim processes.
Another says: we will submit the claim first, and charge or bill you after the payer determines your responsibility.
I use the second. As I said Monday, I am not neutral about it, and it is still a policy choice rather than a universal rule.
If you take the estimation approach, the reconciliation process is not an afterthought. It is part of the policy, and it should be written down. What happens when you estimated $120 and the patient actually owed $68? How fast is the $52 back? Who notices that it is owed?
There can also be a direct cost that is easy to miss. Depending on your processor and pricing arrangement, the original processing fee may not be returned when you refund an overpayment. So if your estimate was too high, you return the excess to the patient while the practice may still absorb processing costs on the amount originally collected.
Now the claim processes and the remittance says patient responsibility is $86.42.
That is a different thing from having estimated $86.42 three weeks earlier. You now have a payer determination assigning that amount to the patient, identified as such on the remittance.
But a second question is still open. What did your authorization actually say?
If the patient signed something that reads only "I authorize this practice to keep my credit card information on file," I would not treat that sentence as clearly communicating "you may automatically charge any balance remaining after my insurance processes a claim." Those are different statements, and the patient did not necessarily hear the second one.
A useful authorization matches the workflow you actually run.
If your policy is to submit insurance, wait for adjudication, notify the patient of the balance and then charge the authorized card, write that. If your policy is to charge adjudicated balances automatically once posted, write that. If there is a dollar amount above which you contact the patient first, write that.
The document should describe the practice you operate, not a practice in general.
Here is where a fourth category gets mixed in.
The patient misses the appointment. Your policy says there is a $100 fee.
There is no claim to adjudicate, because you did not provide the scheduled service. So the question is not what insurance assigned to the patient. It is whether this administrative charge is permitted for this patient at all, and whether your policy and authorization let you collect it this way.
Those answers vary by payer and program, and this is one of the few places in this post where there are concrete rules worth knowing:
Medicare permits charging beneficiaries for missed appointments where the policy is applied equally to Medicare and non-Medicare patients. Medicare does not pay the fee, and it is not billed to Medicare.
Medicaid is different. CMS has generally treated missed appointments as a cost of doing business rather than a separately billable service, and has generally not permitted billing the beneficiary. State programs vary, so check yours.
Commercial contracts and state law can add their own limits.
Which means: having a card on file does not make an otherwise impermissible fee collectible. Authorization is downstream of permission. Whether you may impose the charge comes first.
If someone is self-pay and you agreed today's appointment is $200, there is far less mystery about the amount.
The questions become whether you disclosed the price clearly, whether a Good Faith Estimate applies, when your policy says payment is due, and whether the patient authorized the method you intend to use.
Again, the card is only the mechanism.
This is why I do not think a useful card-on-file form can just say "I authorize the practice to keep my card on file." That leaves almost the entire workflow unstated.
The categories a practice may want covered:
And then the operational rules around them. Do you charge automatically or notify first? Do you wait a set number of days? Is there an amount above which you call? How are disputed charges handled? What happens when the card declines? How does a patient replace or revoke a stored method?
One more reason not to treat "card on file" as a single thing: some recurring arrangements that pull directly from a bank account fall under federal electronic fund transfer rules, which carry their own authorization requirements, including a signed or similarly authenticated authorization and giving the consumer a copy. Not every stored-payment arrangement sits in the same regulatory category.
The clearest way I have found to think about it:
Only at step five does having a card on file become useful. Most of the arguments I see about charging patients are actually arguments about steps one through four, conducted as though they were about step five.
This is the question that convinced me a template library was not enough.
I could hand everyone the same card-on-file authorization. That would assume everyone runs the same collection process. They do not, and the form would be wrong for most of them in a way nobody would notice until a charge was disputed.
So in the Policy Builder the payment decisions come before the language. Do you collect known copays before, during or after the visit? Do you estimate deductible and coinsurance, or wait for adjudication? Do you charge adjudicated balances automatically, or notify first? Do you charge missed-visit fees, and from which occurrence? Only once those are answered does it make sense to generate wording.
Because the goal is not to have a card-on-file policy.
The goal is to have a payment policy, a card authorization, and an actual workflow that all say the same thing. Right now, in a lot of practices, those three documents describe three different businesses.
None of this is legal advice, and the rules that apply to you depend on your payer contracts, your state, and the programs you participate in. What I can tell you is which decisions are yours to make, and that making them deliberately is the difference between a policy and a paragraph.