Taking card payments over the phone safely

Phone payments are normal in healthcare: a deposit before a first appointment, a balance for a patient who has already left. Doing them safely is rarer than it should be.

The risk is the piece of paper

The most common failure is not a hacker. It is a card number written on a sticky note to be keyed in later, a scanned form in a shared drive, or a number read out and typed into the wrong field. Once card details exist anywhere in the practice, the practice is responsible for protecting them, and the rules that apply become far heavier.

What the rules ask

The Payment Card Industry Data Security Standard applies to anyone taking card payments. The lightest category applies when card data is entered directly into fields provided by a certified payment provider and never touches the practice's own systems. The heavier categories apply when the practice stores, processes or transmits card data itself. The practical difference is the amount of work a practice has to do to stay compliant, and how exposed it is if something goes wrong.

How a virtual terminal changes it

• Reception keys the card into secure fields served by the payment partner, not into anything the practice owns
• Nothing is written down, because there is nothing to write down: the payment is taken while the patient is on the line
• Every payment carries the patient's name and a reference, so it can be matched later without anyone remembering who called
• Duplicate-charge protection stops the same payment being keyed twice in a busy moment
• Refunds and voids are permission-controlled, so a mistake is fixed by the right person

A simple rule for the desk

If a card number would need to be stored, even for an hour, use a pay link instead. Send it by text while the patient is on the phone; they pay on their own device and you see it arrive.

More guides