Home › PCI compliance by business › Medical, dental and veterinary offices

PCI compliance for medical, dental and veterinary practices

Short answer. Each way your practice takes cards is a separate payment method with its own PCI Self-Assessment Questionnaire (SAQ), so a front-desk terminal, a patient payment link and phone payments are usually three short SAQs, not one long one. A standalone front-desk terminal is usually SAQ B-IP (or SAQ P2PE if it is part of a PCI-listed P2PE solution), a payment link or portal page hosted by your payment provider is usually SAQ A, and card numbers your staff type into a provider's virtual terminal are usually SAQ C-VT. HIPAA compliance does not make a practice PCI compliant, and PCI compliance does not satisfy HIPAA.

PCI DSS (the Payment Card Industry Data Security Standard) is the set of security rules the card brands require of every business that accepts card payments. A doctor's, dentist's, chiropractor's, physical therapist's, optometrist's or veterinarian's office that takes cards is covered the same way a shop is. Most small practices prove compliance once a year with a Self-Assessment Questionnaire (SAQ), a form your bank or payment processor asks you to complete and sign.

The part most practices miss: the SAQ depends on how each payment is taken, not on the fact that you are a healthcare practice. A practice usually takes cards three or four ways, at the front desk, through a link or portal, over the phone and sometimes from a card kept on file, and each of those is its own payment method with its own SAQ.

How medical, dental and veterinary offices usually take cards, and the SAQ for each

Each way you take cards is its own payment method, and each one gets its own SAQ. Most businesses have two or three.

Payment method	Usually	Why
Front-desk card terminal The card machine at check-in or checkout where patients or pet owners tap, insert or swipe for copays, balances and treatment.	SAQ B-IP / SAQ P2PE / SAQ C SAQ B-IP for a standalone internet-connected terminal; SAQ P2PE if it is part of a PCI-listed P2PE solution; often SAQ C if it runs through the front-desk computer	A standalone terminal that talks only to your processor keeps card numbers off your computers. P2PE (point-to-point encryption) means the card is encrypted inside the terminal by a solution PCI SSC has validated and listed, which is the shortest SAQ for in-person payments. Watch out: If the terminal is wired into your practice management software or front-desk computer, it is no longer standalone and is often SAQ C, unless your provider confirms it is a PCI-listed P2PE solution. SAQ C is also for a single location only.
Patient payment portal, text-to-pay and emailed statement links A 'pay your bill' link in a text message or emailed statement, or an online portal from your billing or practice management vendor, where the patient types their own card details.	SAQ A / SAQ A-EP SAQ A, when the page where the card is typed is hosted entirely by your payment provider	If the patient enters the card on the provider's own payment page, your staff and systems never see the number. PCI SSC FAQ 1588 treats sending customers a payment link as fully outsourcing the payment. Watch out: A pay-your-bill form embedded in your own practice website is SAQ A only if the card fields come entirely from the provider and you can confirm your site is protected against malicious scripts. If your website builds the card form itself, it is SAQ A-EP.
Phone payments keyed into a virtual terminal A patient calls to pay a balance and front-desk or billing staff type the card number into the processor's payment web page (a virtual terminal) in a browser.	SAQ C-VT / SAQ D SAQ C-VT, if the computer used meets its conditions	The virtual terminal is your processor's page, but your staff's computer handles the card number while they type it, so that computer is part of the payment and needs protecting. Watch out: SAQ C-VT expects the computer to be kept apart from your other systems, in one location, with no card reader attached and no software that saves card numbers. A shared front-desk PC that also runs your records software and email may not qualify; ask your processor, or send the patient a payment link instead.
Cards keyed or saved in your practice management software Staff type a card into the payment screen of your practice management, dental or veterinary software, or save it to the patient or client record for payment plans and future visits.	SAQ C-VT / SAQ C / SAQ D Depends on the software: often SAQ C-VT if the card screen is really the processor's virtual terminal, SAQ C if card numbers pass through your computers, SAQ D if they are stored in your system	Some software shows the processor's own payment page or card fields and keeps only a token (a stand-in reference that is useless to a thief); others pass card numbers through software and computers you run. Which one you have decides the SAQ. Watch out: Storing full card numbers electronically anywhere, in the software, a notes field, a scanned form or a spreadsheet, takes this channel to SAQ D. Ask your vendor in writing whether card numbers ever touch your systems.
Phone or tablet card reader A small reader paired with a phone or tablet, used for house calls, mobile vet or farm visits, mobile dental or screenings off site.	SAQ SPoC / SAQ P2PE SAQ SPoC if the solution is PCI-listed as SPoC; SAQ P2PE if it is a PCI-listed P2PE solution	Validated mobile solutions keep card data inside the reader and the provider's app, so your phone or tablet does not handle readable card numbers. Watch out: Not every phone reader is validated. If yours is not on the PCI SSC list of SPoC or P2PE solutions, ask your provider which SAQ it supports.

Find out which SAQ fits each way you take payments, free

Describe how you take payments in your own words. We'll tell you which SAQ fits each one, free, before you pay anything.

One SAQ per way you take cards, not one for the whole practice

Write down every way money arrives by card: the front desk, links you text or email, the phone, any portal, any mobile reader, and any card you charge later from a file. Each one is a separate payment method, and each one gets the SAQ that fits it.

A dental office with a standalone front-desk terminal, text-to-pay links and phone payments typed into a virtual terminal would usually look at SAQ B-IP, SAQ A and SAQ C-VT, three short questionnaires. Taking cards several ways is not, by itself, a reason to file the long SAQ D. SAQ D applies to a channel only when that channel stores card numbers electronically, sends them through your own systems, or does not fit any shorter SAQ.

Your acquiring bank or payment processor has the final say on which SAQs you file and how you submit them. If your billing or practice management vendor is also your payment processor, it is the one to ask.

HIPAA and PCI DSS are separate

HIPAA is a U.S. federal law administered by the Department of Health and Human Services (HHS). According to HHS, its Security Rule protects electronic protected health information and applies to health plans, health care clearinghouses and health care providers that conduct certain transactions electronically, plus their business associates.

PCI DSS is not a law. It is an industry standard written by the PCI Security Standards Council (PCI SSC) and required by the card brands through your agreement with your bank or processor. It protects payment card data.

Because they protect different information under different authorities, meeting one does not meet the other. A HIPAA risk analysis is not an SAQ, and a signed SAQ says nothing about patient records. Some habits help with both, such as locking up paper, shredding, limiting who can use which computer and training staff, but each still needs its own paperwork. This is general information, not legal advice; ask your own advisers about HIPAA.

Cards on file and payment plans

Payment plans and 'charge the balance after insurance pays' are common in practices, and they are where card numbers most often end up stored somewhere they should not be.

The safer setup is to let your payment provider keep the card. The patient enters it once, through the provider's page, terminal or card fields, and your software keeps only a token that lets you charge it again. Your systems never hold the number.

If your practice keeps full card numbers electronically, in the practice management software, a notes field, a spreadsheet or a scanned form, that channel is SAQ D, the full questionnaire. The three- or four-digit security code on the back of the card (the CVV or card verification code) may never be kept after the payment is authorized, on paper or electronically, even if encrypted.

Paper forms, faxes and card numbers in the chart

Many practices still use paper card authorization forms or intake forms with a card number on them. The shorter SAQs allow card data you keep to be on paper only, and only if it was never received electronically. So the paper has to stay paper.

The common trap is scanning. If a form with a card number is scanned into the patient chart or document system, or arrives by fax-to-email or an online fax service, the practice is now storing or receiving card data electronically, which no SAQ except SAQ D allows. PCI SSC FAQ 1139 says faxes received over the internet or routed to email are covered by PCI DSS encryption requirements and that security codes on faxes should be removed before a paper copy is kept.

Better: replace paper card forms with a payment link or the provider's card-on-file feature.
If you must use paper: never write down the security code, keep forms locked away, and limit who can see them.
Do not scan, photograph, email or fax card details into any system.
When a form is no longer needed, destroy it so it cannot be reconstructed. PCI DSS Requirement 9.4.6 calls for cross-cut shredding, incinerating or pulping.

Questions to ask your practice management or billing vendor

Your vendor's payment setup decides several of your SAQs, so get answers in writing and keep them with your SAQ records.

When patients pay through your portal or a text or email link, whose page is the card typed into?
When my staff take a card in your software, is the card screen the processor's own page or fields, or does the card number pass through our computers?
Do you store full card numbers for us, or only a token from the processor?
Is the front-desk terminal you supply standalone, connected to our computers, or part of a PCI-listed P2PE solution?
Can you give us your PCI DSS Attestation of Compliance (AoC), the signed summary of your own assessment, for the services we use?
Which SAQ do you or our processor expect us to file for each payment method?

Your checklist

List every way your practice takes cards: front desk, links and portals, phone, mobile readers and cards charged later from a file.
For each one, find out whose page or device the card number is entered on.
Ask your processor or vendor whether your front-desk terminal is standalone, connected to your computers, or a PCI-listed P2PE solution.
Move balance and payment-plan collection to provider-hosted payment links or the provider's card-on-file feature, so your software keeps only tokens.
If staff key phone payments, confirm the computer they use meets SAQ C-VT conditions, or switch those patients to a payment link.
Search your practice software, shared drives and scanned documents for stored card numbers, and have them removed.
Stop writing down security codes, and shred paper card forms with a cross-cut shredder when they are no longer needed.
Tell patients not to email or text card numbers, and give them a payment link instead.
Collect your vendors' PCI Attestations of Compliance, and complete one SAQ for each payment method that your processor confirms.

Common questions

We are HIPAA compliant. Does that make us PCI compliant?

No. HIPAA is a federal law, administered by HHS, that protects health information; PCI DSS is a card-industry standard, required through your agreement with your bank or processor, that protects card data. Meeting one does not meet the other, so a practice that takes cards needs its PCI SAQs as well as its HIPAA program.

Do veterinary clinics need to be PCI compliant?

Yes. PCI DSS applies to any business that accepts card payments, whatever it treats. A vet clinic usually has the same channels as a medical office, a front-desk terminal, payment links and phone payments, and each gets its own SAQ.

Our practice management vendor handles payments. Are we still responsible?

Usually yes. Your practice is still the business accepting the card, so your processor will normally ask you to validate each payment method, even if the vendor's setup makes those SAQs short. The SAQs also ask you to confirm you have checked your vendor's PCI Attestation of Compliance for the services you use.

Is a text-to-pay link SAQ A?

Usually, when the link opens a payment page hosted entirely by your payment provider and the patient types their own card details there. PCI SSC FAQ 1588 treats sending a payment link as fully outsourcing the payment. If staff take the card details instead and type them in, that is a different payment method.

Can we keep patients' cards on file for payment plans?

Yes, if your payment provider stores the card and your software keeps only a token. Keeping full card numbers yourself, electronically, puts that channel on SAQ D, and the security code may never be kept after authorization by anyone.

A patient emailed us their card number. What should we do?

Do not reply with the number in the message, and do not save it anywhere. Delete it securely, then send the patient a payment link so they can enter the card themselves. Receiving card numbers by email or text is outside every short SAQ, so tell patients up front how to pay.

We take cards at the desk, by link and over the phone. Do we have to file SAQ D?

No, not just because you take cards several ways. Each way is its own payment method with its own SAQ, often SAQ B-IP or P2PE for the desk, SAQ A for the link and SAQ C-VT for phone payments. SAQ D comes in only for a channel that stores card numbers electronically, runs them through your own systems, or fits no shorter SAQ.

Ready to see your SAQs?

Describe how you take payments in your own words. We'll tell you which SAQ fits each one, free, before you pay anything.

Other businesses

Hotels and lodgingRestaurants, bars and cafesRetail storesSalons, spas and barbershopsSmall online storesContractors and home service prosNonprofits and charities

Sources

General guidance, not legal advice. Your acquirer or payment processor decides which SAQ you must file. PCI DSS v4.0.1; content checked 2026-10-23.