Preauthorized Health Care Transactions: The Card Rules

A preauthorized health care transaction is how a medical practice charges a patient's card for the balance left after insurance pays. Visa's US rules require a signed order form carrying three specific elements, and they bar you from requesting authorization until the insurance company has told you what it's covering. Most practices get the form roughly right and the timing wrong.

What Counts as a Preauthorized Health Care Transaction#

This isn't the copay you collect at the front desk. That's an ordinary card-present sale, settled the same day for a known amount.

A preauthorized health care transaction is the deferred one. The patient is seen, the claim goes to the insurer, weeks pass, and eventually some portion comes back as patient responsibility. You already have the card on file and permission to charge it. The rules that follow govern that second charge, not the copay.

It's a common arrangement in medical billing, dental practices, physical therapy, and increasingly in telehealth, where nobody is ever standing at a counter.

The Order Form Needs Three Things#

In the US Region, a health care merchant must obtain an order form from the cardholder containing all of the following (ID# 0008706, Visa Core Rules and Product and Service Rules, 18 April 2026):

• A description of the requested services
• Permission for the merchant to charge the cardholder's account for the balance due following the merchant's receipt of any applicable insurance payment
• A time period, not to exceed one year, for which permission is granted

Read the second one closely. The permission is specifically to charge the balance due after the insurance payment arrives. It isn't blanket permission to charge the card for whatever the practice decides it's owed.

Plenty of intake forms say something closer to "I authorize the practice to charge my card for any outstanding balance." That's broader than the rule contemplates and narrower in practice, because a cardholder who disputes has a written record that says nothing about insurance.

You Cannot Run the Card Before Adjudication#

Here's the sharp one. A health care merchant must not request authorization for the amount due until it has received notification of adjudication from the cardholder's insurance company.

Not when the claim is submitted. Not on a billing cycle. Not when the practice management system generates a statement. After adjudication.

This is the rule practices break most often, and usually without meaning to. A billing system set to charge cards on the first of the month doesn't know whether the insurer has responded. A staff member clearing an aging report doesn't either. The charge goes out, the amount turns out to be wrong once the explanation of benefits lands, and now you're issuing a refund on a transaction that shouldn't have run.

The dispute exposure is the real cost. A patient who sees a charge before they've seen their own explanation of benefits has a straightforward story to tell their bank, and you have a signed form that says you'd charge them after the insurance payment. That's a chargeback you're likely to lose on the merits, not on paperwork.

The One Year Cap Is Doing More Work Than It Looks#

The permission runs for a stated period not exceeding one year. Two things follow from that.

An open-ended authorization doesn't satisfy the rule. If your form has no end date, it isn't a compliant order form, whatever else it says.

And a card you've held for three years under a form signed once at intake isn't covered either. The permission expired. Long-running patient relationships are exactly where this drifts, because nobody re-signs a form for a patient they've seen quarterly since 2023.

If you're keeping cards on file across years, the practical fix is a renewal on the same cadence as any other annual paperwork. An account verification confirms the card is still good. It does not refresh your permission to charge it.

FSA and HRA Cards Run on a Separate System#

Flexible spending and health reimbursement arrangement cards look like ordinary Visa cards and do not behave like them.

A merchant that participates in healthcare auto-substantiation must be licensed and certified by SIGIS, the industry body that maintains the eligible-product standards (ID# 0025549). That's a requirement on the merchant, not something an acquirer can absorb on your behalf.

The acquirer carries its own list (ID# 0003106). It has to be SIGIS licensed and certified, provide the FSA or HRA BIN list only to eligible merchants, make sure those transactions originate only from a SIGIS-certified merchant, supply an IIAS merchant verification value and include it in the authorization request, and respond to issuer requests for transaction data.

The tax side is where the requirement comes from. The IRS allows employer-issued debit, credit, and stored value cards to reimburse health FSA participants, and where card use meets certain substantiation methods the participant doesn't have to submit additional documentation (IRS Publication 969). Those methods trace back to Revenue Ruling 2003-43, which set out how a plan substantiates claimed medical expenses after a card is used. The inventory-based systems came later, and SIGIS certification is how a merchant demonstrates it runs one.

If your practice sells anything beyond services, supplements, braces, over-the-counter products, this is the part that determines whether those cards work at all.

Why Underwriting Asks About This#

A deferred charge against a card on file, for an amount the patient hasn't seen yet, sitting weeks after the service date, is a recognizable dispute profile. Acquirers know it.

That's why a medical or telehealth merchant account file gets questions a retail file doesn't: how long you hold cards, what your order form actually says, whether your billing system can distinguish an adjudicated balance from an open one. A practice that can answer those cleanly underwrites better, and prices better, than one that can't.

The MCC assigned to the account matters here too, since health care categories carry their own expectations about card-on-file behavior. Visa publishes the merchant category framework alongside its other acceptance regulations.