In the wake of complex high-deductible plans, many health care providers request that patients provide credit card information, which the provider securely stores and later processes based on its communicated policies and procedures. Effective Oct. 1, 2025, providers can no longer require patients to provide bank account information, a credit card number, a debit card number or any other form of electronic payment to be kept on file with the provider as a condition of accepting the patient or providing care. Notably, the law does not prohibit a provider from asking for such payment information and storing it if the patient agrees to provide it.

Violations will be considered an unfair trade practice with penalties of up to $5,000.

Providers should review their intake forms and procedures in light of this new law. In many cases, the forms and procedures may require only minor changes, but providers should take a few moments to review them to ensure they cannot be interpreted as requiring a card on file as a condition of care.

Michele Krpata, BSW, CPC, CPMA

Compliance Officer, Quality Reporting Analyst