The Best Credit Card Processing For Dental Offices

Most dental offices don’t need anything fancy when it comes to processing hardware. Getting an expensive POS system with many additional functions is usually overkill, as you’ll be using a separate dental practice management program to run your office and manage appointments.

All you really need is a way to accept credit and debit cards in person. It can be a simple countertop terminal, a mobile processing system, or a virtual terminal on your computer that’s connected to a card reader. To future-proof your setup, we recommend a device that will accept EMV and NFC-based payment methods (such as Apple Pay and Google Pay). You might also want a “smart” terminal that includes a customer-facing display, especially if you live in a state that now requires them.

If you’d like your customers to be able to pay for expensive procedures over time, be sure to include a recurring billing feature in your setup. This will usually require a payment gateway, but as the payments processing industry increasingly moves to the cloud, you’ll probably be using a gateway anyway.

Be aware that some providers charge an additional monthly fee for recurring billing, while others include it at no extra cost.

Interest in alternate payment methods has surged in recent years due to the high cost of accepting credit and debit cards. The COVID-19 pandemic also increased interest in contactless payment methods, which are particularly important in a healthcare setting. The processor you select should support as many of these methods as possible, including ACH transfers, eCheck payments, invoice payments, and QR code payments.

One unique requirement for dental offices and other healthcare professionals is the need to support payments made from a patient’s Health Savings Account (HSA) or Flexible Spending Account (FSA). These accounts come with cards that function similarly to debit cards but are tied to the patient’s HSA or FSA account rather than a traditional bank account. Your provider should be able to reprogram your terminal to accept these types of payments.

Another requirement is that your merchant account must be assigned one or more of the following Merchant Category Codes (MCCs):

• 8011: Doctors and physicians (not elsewhere classified)
• 8021: Dentists and orthodontists
• 8062: Hospitals
• 8071: Dental and medical laboratories
• 8099: Health practitioners, medical service (not elsewhere classified)

If you’d like your patients to be able to pay their bills online through your website, your payment gateway or integrated payments platform should include a customer information management (CIM) feature. A CIM securely stores your patient’s payment information (credit card numbers, etc.) on your processor’s server, keeping the data off your website and simplifying your PCI compliance scope. Also, HIPAA requirements dictate that your patients’ payment information be kept separately from their dental record information.

Almost all modern payment gateways include a customer information management feature, but some providers make it easier than others to export that data if you switch to a different gateway provider.

Most dental offices today use specialized dental practice management software. While it would be extremely convenient to use the same practice management software to keep track of payments, this isn’t always a good idea in actual practice.

Here’s a brief rundown of the major dental practice management programs and how they integrate with payment processing:

Dentrix

Dentrix is the most popular dental practice management program, and it offers fully integrated payment processing through a third-party provider. Using the Dentrix Pay feature, you can establish a merchant account, and your payment information and patient records will be fully integrated. The only downside is that you’ll have to manually copy the payment information into Dentrix after accepting a patient’s payment.

Unfortunately, Dentrix Pay is offered through FIS Worldpay, a huge direct processor with a reputation for high prices and poor customer support. Dentrix Pay uses the overpriced tiered pricing model, and you’ll have little or no opportunity to negotiate for a better deal before you sign up. No matter how happy you are with Dentrix, we recommend skipping Dentrix Pay and signing up with a better provider. You’ll save a lot of money and frustration in the long run.

Open Dental

Another popular dental practice management software suite, Open Dental offers integrated credit card processing through X-Charge, a subsidiary of Open Edge.

Open Edge is owned by Global Payments, another large, direct processor. Like FIS Worldpay, Global Payments is known for overcharging small businesses for its services and providing lousy customer support. You’ll invariably be set up with an expensive tiered pricing plan, and you probably won’t be given a chance to negotiate the terms of your contract during the account setup process.

Sensei Cloud/Carestream Dental

Sensei Cloud is a popular dental practice management program offered by Carestream Dental. Carestream Dental previously featured integrated payment processing through TSYS Merchant Solutions, but has now re-branded this service as ‘Payment Solutions for Sensei Cloud.’

These accounts appear to be underwritten by Global Payments, which acquired TSYS several years ago. Given Global Payments’ poor reputation within the small business community, we highly encourage Sensei Cloud users to get a detailed price quote and compare it against other non-integrated providers before signing up. In many cases, using a separate merchant services provider (like the ones recommended above) will cost less overall and provide far better customer support when you need it.

According to the Department of Health & Human Services (DHS), basic credit card processing falls outside the scope of HIPAA requirements. As such, your credit card processor isn’t considered a “business associate,” and you won’t need to have a HIPAA agreement with them. The main reason for this is that your credit card processor usually won’t have access to protected health information (PHI). However, most processors today offer many services beyond simple credit card processing, and some of these services necessarily involve gaining access to PHI. Invoicing, billing, patient management, and accounting are examples of services where PHI could be passed to your processor, bringing it within HIPAA compliance requirements.

One way to protect yourself is to strictly limit the interaction between your office and your payment processor to payment information only. By doing this, your processor will remain outside the scope of HIPAA requirements, and you won’t need a business associate agreement with it. This can be very impractical, as you would have to establish strict procedures to ensure that PHI is never inadvertently passed on to your processor. Invoices, Explanations of Benefits (EOBs), and even patient notes in online payment forms would all have to be kept away from your processor. This approach might work for some very small practices that are only going to use basic credit card processing services and not integrated invoicing or other features.

However, for most practices, we recommend including your processor as a business associate and obtaining an agreement to secure HIPAA-protected information at all times. With many providers offering a HIPAA-compliant solution out of the box, there’s no reason not to take advantage of this feature. Having these agreements in place can also protect you in case of a data breach, where both payment and patient information could be compromised.

Since dental practices have the same PCI compliance requirements as any other business, it’s good to be familiar with them and ensure that your practice is taking all appropriate steps to maintain compliance. While some providers charge discrete PCI compliance fees for services such as security scans, others include this cost as part of your monthly account fee or subscription. Also, most providers will charge you a monthly PCI non-compliance fee if your account is determined to be out of compliance. You can usually avoid these fees by ensuring that your Self-Assessment Questionnaire (SAQ) is kept up to date.

If you’re using a customer information management database to store card-on-file information, it’s also a good idea to enable tokenization and encryption features to ensure that you have the highest level of security available.

Your payment security requirements will be fairly minimal if you just use a credit card terminal in your dental office for in-person payments. However, online payments through your website should be protected using every security measure available. This mostly means using tokenization and encryption, which virtually all credit card processors now offer. You might also want to consider using anti-fraud programs to protect against the chance of inadvertently accepting a stolen credit card.