TL;DR: Healthcare payment processing in 2026 requires HIPAA-compliant processors that can handle FSA/HSA cards, offer online patient billing, and sign a Business Associate Agreement (BAA). Credit card fees typically run 2.4%–3.5% per transaction. Based on Merchant Alternatives' independent healthcare processor rankings, top-rated options include Easy Pay Direct, Bank Associates Merchant Services, and Dharma Merchant Services. Choosing the wrong processor costs your practice money — and patients — every single month.
Payment processing for healthcare practices is nothing like running a card through a retail POS. Your practice deals with insurance reimbursements, patient balances, FSA and HSA cards, HIPAA regulations, and the ever-rising cost of credit card fees — all at the same time. If you're a physician, dentist, therapist, chiropractor, or any other small practice owner, your payment infrastructure directly affects how fast you get paid, how much you keep, and how satisfied your patients are. This guide breaks down exactly how healthcare payment processing works in 2026, what it costs, and which processors are worth considering.
Healthcare practices face a uniquely complex payment environment that standard merchant accounts simply aren't designed for. Unlike a retail store or restaurant, your practice accepts payments from multiple sources — insurance payers, patients paying their share, FSA/HSA cardholders, and sometimes government programs like Medicare or Medicaid — all of which have different rules, timelines, and fee structures.
The patient portion of payments has surged dramatically over the past decade. According to the J.P. Morgan 15th Annual Trends in Healthcare Payments Report, patient collections as a primary revenue concern for providers have increased 133% from 2011 to 2024. That means the financial burden on patients — and the collection challenge for your practice — is dramatically larger than it was just a few years ago. Your payment processor needs to be able to handle this reality, not just swipe cards.
On top of that, healthcare practices must comply with HIPAA, accept FSA/HSA benefit cards, manage recurring billing, handle large patient invoices, and often integrate with electronic health record (EHR) systems. A standard Square or PayPal account set up for a coffee shop won't cut it — and using the wrong processor can actually create compliance risk.
HIPAA — the Health Insurance Portability and Accountability Act — governs how protected health information (PHI) is stored, transmitted, and accessed. When it comes to payments, HIPAA applies any time your payment processor handles data that connects a patient's identity to their medical care or billing details.
Here's where it gets nuanced: a payment processor that simply runs a credit card transaction — with no access to patient names, diagnoses, or treatment codes — is generally not considered a HIPAA business associate, according to Jotform's HIPAA payment processing guidance. Financial institutions processing routine credit card transactions fall under standard banking exemptions. But the moment a processor also handles invoicing, billing statements, or practice management functions — meaning they're touching data that links a patient to their care — HIPAA compliance and a signed Business Associate Agreement become mandatory.
The practical implication: if your processor only handles the card swipe and you keep all patient data in a separate, secured system, you may have more flexibility. But for most small practices that want integrated billing, online statements, and patient portals, you need a processor that is explicitly HIPAA-compliant and willing to sign a BAA.
A Business Associate Agreement (BAA) is a legally required contract between a healthcare provider and any vendor that handles protected health information on their behalf. It obligates the vendor to safeguard PHI, notify you of any breaches, and comply with HIPAA security standards. Without a BAA in place, both your practice and the vendor can face federal penalties.
HIPAA penalties for non-compliance are not trivial. Violations can carry penalties up to $50,000 per incident, and organizations can face criminal charges in severe cases, according to GeBBS Healthcare Solutions. For a small practice, one breach could be financially catastrophic. That's why vetting your payment processor's willingness and ability to sign a BAA is a non-negotiable step.
Not every major processor offers BAAs. Notably, standard PayPal and basic Stripe accounts do not sign BAAs for healthcare providers. Square, on the other hand, is fully HIPAA-compliant and will sign a BAA — one of the few mainstream platforms that will. Among processors that specialize in serving healthcare practices, top-rated options on Merchant Alternatives include Easy Pay Direct, Bank Associates, and Dharma Merchant Services — all of which offer healthcare-focused features and HIPAA-compliant processing. Always ask for a BAA before onboarding any payment vendor that will access patient billing data.
Healthcare providers pay an average of 2.4% per credit card transaction, according to Blue Yonder Corp. The full range is typically 1.5% to 3.5% of the transaction amount, plus a flat per-transaction fee of roughly $0.25 to $0.30, according to Valant's fee analysis for behavioral health practices. On a $200 copay, that's $4.80 to $7.00 in processing costs — per transaction.
For a practice running $30,000 per month in patient card payments at a blended 2.5% rate, that's $750 per month — or $9,000 per year — going to processing fees. Choosing the right pricing model and negotiating your rate isn't optional; it's a meaningful line item on your P&L. Many practices also unknowingly pay fees they never agreed to. A 2023 MGMA survey found that 60% of medical group leaders were being charged EFT or virtual card fees they didn't agree to, often totaling 2% to 3%.
Not all processors serve healthcare practices equally. The right choice depends on your monthly volume, EHR system, need for HIPAA compliance, and whether you primarily see patients in-office or via telehealth. Based on Merchant Alternatives' independent healthcare processor rankings, here's how the top-rated options compare.
| Processor | MA Rating | Pricing Model | Healthcare Strengths | Full Review |
|---|---|---|---|---|
| Easy Pay Direct | 5/5 | Interchange Plus (1.59% + $0.17 swiped) | HIPAA-compliant processing, fraud prevention, recurring billing, QuickBooks integration | Read Review |
| Bank Associates (BAMS) | 5/5 | Interchange Plus | Dedicated healthcare platform, HIPAA/PCI compliant, MedicalCRM analytics, next-day funding | Read Review |
| TransGlobal Payment Systems | 4.9/5 | Interchange Plus | HIPAA-compliant POS, appointment management with SMS/email reminders, Apple/Google Pay | Read Review |
| Helcim | 4.8/5 | Interchange Plus (+ 0.30% + $0.08 in-person) | HIPAA compliance with BAA, annual audits, HSA/FSA support, EMR integration, Fee Saver program | Read Review |
| Dharma Merchant Services | 4.5/5 | Interchange Plus (+ 0.15% + $0.08 swiped) | HIPAA-compliant, HSA card acceptance, in-person and online billing, ideal for small practices | Read Review |
Ratings from Merchant Alternatives' healthcare processor rankings and Healthcare/Medical category. All five processors actively market healthcare-specific payment solutions and maintain dedicated healthcare pages. Rates subject to change — confirm current pricing directly with the processor.
Healthcare payment processors typically offer one of three pricing structures: flat-rate, interchange-plus, or subscription-based. The best fit depends on your monthly card volume, and choosing the wrong model can cost you thousands per year.
Flat-rate pricing (like Square's 2.6% + $0.15 in-person) is simple and predictable. It's ideal for practices just starting out or those running less than $10,000 per month in card payments. You pay the same percentage regardless of card type, which means simplicity at the cost of potentially higher fees on low-cost interchange cards.
Interchange-plus pricing (like Helcim or Dharma) passes the actual interchange cost through to you, then adds a small markup. This model becomes more cost-effective as your volume grows, typically at $10,000 or more per month in card sales. At $30,000 per month, the savings over flat-rate can easily exceed $200–$400 per month.
Subscription-based pricing (like Stax at $99–$199 per month) charges a flat monthly fee plus a small per-transaction cost, eliminating the percentage markup on each transaction. This model pays off most at very high volumes — $20,000 or more per month — where the percentage savings on each transaction exceed the monthly subscription cost. For a solo practice seeing 50 patients per week with modest copays, the monthly fee likely isn't worth it.
Flexible Spending Accounts (FSA) and Health Savings Accounts (HSA) represent a significant and growing pool of patient funds. Accepting these cards removes friction for patients and can directly improve your collection rates. There were approximately 72 million Americans with HSA accounts in 2022, according to Finix, and contribution limits have continued rising — making HSA/FSA acceptance increasingly important for practices.
Good news: most healthcare practices can accept FSA and HSA cards simply by being classified under an eligible Merchant Category Code (MCC). Physicians, dentists, chiropractors, optometrists, and most licensed healthcare providers qualify automatically, meaning your payment processor can configure your account to accept these cards without additional certification. You don't need to do anything special — but you do need to confirm that your processor properly categorizes your business under the correct MCC.
The key requirement, according to Payrix Pro's FSA/HSA processing guide, is that your acquirer (the bank behind your processor) must register you under the correct medical MCC — codes like 8011 (physicians), 8021 (dental), 8041 (chiropractors), or 8049 (podiatrists and similar). If your practice is miscoded, FSA/HSA cards may be declined at point of sale even if the patient has funds available. Verify your MCC with your processor before assuming FSA/HSA acceptance is working.
Patient payment collection remains the single biggest revenue challenge for most healthcare practices. The numbers are sobering: according to J.P. Morgan's 2025 Healthcare Payments Trends Report, 71% of providers report it takes over 30 days to collect payments after a patient encounter. That's over a month of waiting on money that's already been earned.
The root causes are often preventable. Only 22% of consumers always know how much they owe before their visit, according to the same report — which means most patients receive an unexpected bill weeks later and are less motivated to pay promptly. Meanwhile, administrative hurdles, paper billing cycles, and lack of convenient payment options all compound the delay. Practices still relying on mailed paper statements and phone payments are fighting an uphill battle against patient inertia.
The fix isn't complicated, but it requires changing processes. Collecting copays and known patient-due amounts at the time of service — rather than billing after the fact — is the single most effective intervention. The MGMA's 2025 data shows that practices that tightened time-of-service collection standardized eligibility verification and offered clear upfront estimates consistently outperformed peers in collection rates.
Digital billing is one of the highest-leverage improvements a small practice can make. According to J.P. Morgan's annual healthcare payments report, 62% of patients prefer to pay their medical bills online — yet many small practices still rely on paper statements and phone-based payment. The result is a slow collection cycle, higher administrative costs, and avoidable patient friction.
The trend data is dramatic. There has been a 243% increase in the use of eStatements as the primary method for patient collections from 2016 to 2024, per J.P. Morgan — signaling that both patients and progressive practices have largely made the shift. Practices that haven't are at a growing disadvantage. In a separate finding, 94% of organizations that adopted online billing channels reported success in the transition, according to KUBRA's 2025 Healthcare Payment Trends report.
Practically speaking, your payment processor should offer a patient portal or text-to-pay feature, online invoice delivery via email, and ideally the ability to set up installment payment plans. Medical practices that provide real-time cost estimates and offer installment payment plans have seen a 10% or more increase in collections alongside improved patient satisfaction, according to Plutus Health. For a practice collecting $500,000 per year in patient payments, a 10% improvement is $50,000.
Insurance claim denials aren't directly a payment processor problem — but they are a revenue cycle problem that your payment infrastructure needs to account for. Initial claim denials hit 11.8% in 2024, up from 10.2% just a few years earlier, according to OS Healthcare. Commercial plans and Medicare Advantage are driving much of the increase.
Each denied claim costs a practice between $25 and $181 to correct and resubmit. And two-thirds of denied claims are never appealed, even though 50% of appealed claims are ultimately reimbursed, according to Unislink Medical Billing. This means the revenue lost to unappealed denials is largely avoidable — it's a workflow problem, not an insurmountable billing reality.
If your payment processor integrates with your EHR and billing system, it can help identify eligibility issues before the claim is submitted — reducing front-end denials that account for 50% to 60% of most practices' total denial volume. Automated verification systems powered by AI can reduce claim denials by up to 20%, according to KUBRA. Processors with deep EHR integration (like Chase via InstaMed, or Square with DrChrono) provide this kind of pre-authorization verification that prevents denials before they happen.
Many practices are asking whether they can pass credit card processing fees on to patients — and the short answer is: sometimes, with strict limits. Credit card surcharges are legal in most U.S. states, but they come with important restrictions and practical risks that every practice should understand before implementing them.
According to the MGMA's guidance on credit card surcharges for medical practices, surcharges cannot exceed the actual cost of processing and generally cannot exceed 3% in the United States. You are also required to disclose the surcharge clearly before the patient pays and cannot apply surcharges to debit card transactions — only credit cards. Some states, including Connecticut and Massachusetts, prohibit surcharges entirely.
The practical risk in healthcare is patient satisfaction. Unlike a gas station where price transparency is obvious, medical billing is already a source of stress and confusion for most patients. Unexpected surcharges can erode trust and trigger negative reviews. A better approach for many practices: implement a small cash or ACH discount instead, which achieves the same financial result while feeling more positive to patients. Your processor should support both options.
If your practice offers telehealth services — even part-time — your payment processing requirements shift in important ways. Telehealth payments are by definition card-not-present (CNP) transactions, which carry higher interchange rates than in-person swipes. That 2.6% + $0.15 in-person rate typically becomes 2.9% + $0.30 or higher when a card isn't physically present.
Telehealth has also created a category of practices that processors classify as "high-risk" — particularly for mental health, addiction treatment, and certain specialty services offered remotely. If you've been declined by a standard processor or quoted unusually high rates, PaymentCloud is specifically designed for high-risk healthcare providers and operates with a BAA, according to Merchant Alternatives' healthcare processor rankings.
For telehealth payments, you also need a virtual terminal or a patient-facing online checkout page. Text-to-pay links sent before or after the appointment have become standard in tech-forward practices. Square, Helcim, and Chase all offer virtual terminals as part of their base healthcare packages. Confirm that your chosen processor's online and virtual terminal rates are competitive — this will be where the majority of your telehealth revenue flows through.
Switching payment processors can feel risky, but staying with an expensive or poorly integrated solution costs real money every month. The good news: switching is manageable with a clear process, and most processors can have a new account active within 5 to 10 business days.
Start by auditing your current processor's fees. Pull your last three to six months of processing statements and calculate your effective rate — total fees divided by total volume. If your effective rate is above 2.8% and you're processing more than $10,000 per month, you almost certainly have room to reduce costs. Compare that rate against the interchange-plus models offered by Helcim or Dharma Merchant Services.
Next, confirm the new processor will sign a BAA before you commit. Verify EHR integration compatibility — if you use a system like DrChrono, Noterro, or Salucro, confirm the new processor integrates natively rather than requiring manual reconciliation. Finally, run both processors in parallel for two to four weeks during the transition. Update recurring billing and card-on-file arrangements carefully to avoid disrupting patients on payment plans. Notify your billing team of the switch and provide updated settlement timelines, as these may differ between processors.
Not always. A processor that only handles a raw credit card transaction — without storing or accessing patient names, diagnoses, or treatment codes — may fall under a HIPAA banking exemption. However, any processor that also handles billing statements, invoicing, patient records, or practice management functions must be HIPAA-compliant and sign a Business Associate Agreement (BAA). For most small practices using integrated billing, HIPAA compliance and a BAA are essential requirements when evaluating any processor.
For solo and small therapy practices, the answer depends on your volume and integration needs. Among Merchant Alternatives' top-rated healthcare processors, Dharma Merchant Services is a strong fit — it offers transparent interchange-plus pricing, HIPAA compliance, HSA card acceptance, and no early termination fee, making it well-suited for small practices. Helcim is another strong option with a formal HIPAA compliance program including annual audits and BAA availability, plus their Fee Saver program that can offset processing costs. For practices that primarily need a simple card-present solution, Square offers HIPAA compliance and a BAA with no monthly fee.
If you're a licensed healthcare provider (physician, dentist, chiropractor, optometrist, etc.), you likely qualify automatically under a healthcare Merchant Category Code. Your processor needs to register your business under the correct MCC for FSA/HSA auto-substantiation to work. In practice, this means telling your processor you're a healthcare practice and verifying your MCC assignment. You do not typically need separate SIGIS certification unless you're a pharmacy or retail health store operating under the 90% rule.
A well-optimized small practice should aim for an effective blended rate of 2.0%–2.5% on card transactions. If you're paying above 2.8% and processing more than $10,000 per month, you're likely overpaying. Practices processing $10,000–$20,000 per month typically benefit from flat-rate or interchange-plus pricing; those processing over $20,000 per month should compare subscription-based models like Stax, which eliminate percentage markups in favor of a flat monthly fee.
Yes, in most U.S. states — but with strict rules. Surcharges cannot exceed your actual processing cost (typically capped at 3%), cannot be applied to debit cards, must be disclosed before payment, and are prohibited in a handful of states including Connecticut and Massachusetts. Practices must also comply with card network rules from Visa and Mastercard, which require advance registration before implementing surcharges. A cash or ACH discount achieves the same financial effect and is often better received by patients.