# NEMT Credit Card Payments in 2027: Cards on File, Deposits, and Facility Invoices

Canonical URL: https://nemtguide.com/guides/private-pay-payments/ · Updated 2026-09-30

To take NEMT credit card payments, set up card processing on your business bank account, charge private riders at booking or after each ride, and get a signed authorization before you keep a card on file. Never store the card's security code. Invoice facilities monthly, agree on cancellation fees in writing first, keep diagnoses off receipts, and never charge Medicaid members for covered rides.

- Never keep a card's security code, even with the rider's permission. Let your card processor store the card for later charges.
- Charge a deposit or a cancellation fee only on terms the payer accepted in writing before the ride.
- Connecticut and Massachusetts ban card surcharges. Where they are allowed, Visa caps them at your processing cost or 3 percent, whichever is lower, and bars them on debit cards.
- Facilities pay invoices on their own terms, such as Mass General Brigham's net 45 days, so ask for their vendor rules before the first ride.
- A receipt with the date, the trip, and the amount paid gives families the proof an FSA claim needs, without naming a diagnosis.

Private riders and facilities pay you directly, so you set the terms: how they pay, when you charge, and what happens when a ride is cancelled. Card rules, consumer protection laws, and privacy rules still apply to every charge, and a few of them catch NEMT companies by surprise.

## Who can pay you by card, and who cannot

Private pay means the rider, a family member, or a facility pays you instead of Medicaid or a broker. Seniors on Original Medicare, adult children paying for a parent's rides, hospitals, dialysis centers, and senior living communities are the usual payers. [Private pay NEMT](https://nemtguide.com/guides/private-pay-nemt/) covers who they are and how to price their rides.

Medicaid members are the exception. Federal rule 42 CFR 447.15 requires Medicaid providers to accept the program's payment as payment in full, and CMS says states and providers may not charge members for no-shows (SMD 23-006, September 28, 2023). Broker agreements go further. MTM Health's standard agreement, in the January 1, 2023 version Pennsylvania posts, bars billing a member even when MTM or its client does not pay (section 6.C). A card in a Medicaid member's hand does not change that. See [billing for no-shows](https://nemtguide.com/guides/billing-for-no-shows/).

## Ways to take payment, compared

Offer the methods your payers already use, and write down which ones you accept.

| Method | Best for | What you need first | What to watch |
|---|---|---|---|
| Card by phone or online at booking | One-time rides, deposits | Card processing on your business bank account | Enter the card straight into the processor. Never write the number on a notepad or in an email. |
| Card at pickup | Riders who pay on the day | A mobile card reader in each van | Electronically printed receipts may show no more than the last 5 digits and no expiration date |
| Card on file | Standing rides, families paying for a parent | A signed authorization, and a processor that stores the card for you | Charge only what the authorization allows |
| Bank debit from a family's bank account | Monthly statements for regular riders | A written, signed or similarly authenticated authorization, with a copy to the payer (Regulation E, 12 CFR 1005.10) | If amounts change from month to month, notify the payer of each amount and date at least 10 days before the debit, unless they chose to be told only when it falls outside a set range |
| Check | Facilities, some families | A written check policy | Wait for the check to clear before you count it as paid |
| Cash | Occasional one-time rides | A numbered receipt book | Cash over $10,000 from one payer in one or related transactions must be reported to the IRS on Form 8300 within 15 days |
| Invoice | Hospitals, clinics, dialysis centers, senior living | A signed agreement and the facility's vendor setup | Each facility sets its own terms, such as net 45 days |

Card and app payments are also reported to the IRS. Your card processor sends you a Form 1099-K for card payments no matter how many you received or how much they totaled. A payment app or online marketplace must send one when payments top $20,000 in more than 200 transactions, and may send one for less (IRS, June 28, 2026). Match every deposit to its rides in your books. See [NEMT bookkeeping](https://nemtguide.com/guides/nemt-bookkeeping/).

## How to set up card payments

1. **Open card processing linked to your business bank account.** Keep private pay money out of your personal account from the first ride.
2. **Ask your processor how it stores cards.** The PCI Security Standards Council's guide for small merchants (version 2.0, August 2018) says the best protection is not to store card data at all. It suggests asking your processor or bank how to run recurring payments without keeping the card's security code, and asking about tokenization, which swaps the card number for a stand-in value that is worthless to a thief but still lets you charge the card again.
3. **Ask which merchant category code your account carries.** It can decide whether FSA cards work at your terminal, as explained below.
4. **Build your receipt.** Use the receipt checklist later on this page.
5. **Write your payment terms.** Cover when you charge, deposits, cancellations, refunds, and how a payer ends a card-on-file authorization. Have every payer accept them before the first charge.
6. **Decide on surcharges before you post a price.** Some states ban them.
7. **Train your dispatchers.** If a family emails a card number, the PCI guide says to process the payment, delete the email right away, and tell the sender how you prefer to take card details. Never reply to the email with the number still in it.

## Keeping a card on file

A card on file lets you charge a standing rider after each ride or once a week without calling the family. It needs two things: the cardholder's written permission and a safe place for the card.

**The authorization.** Get it signed before the first charge. It should name the cardholder, the card type, and the last four digits, and say:

- What you may charge: each ride at the prices on your [rate sheet](https://nemtguide.com/templates/nemt-rate-sheet/), deposits, and agreed cancellation fees
- When you charge: after each ride, weekly, or monthly
- That you send a receipt for every charge
- How the cardholder cancels the authorization, and how much notice you need

The payment authorization form has these fields.

**The security code.** Never keep it. The PCI Security Standards Council says a card verification code may not be kept once the charge it was collected for is approved, and that no customer's permission makes storing it acceptable (FAQ 1280, October 2023). Card-on-file and recurring charges do not need it. If a form you use has a box for the security code, remove the box.

**The card number.** Enter the card into your processor's secure storage, then black out the full number on any paper copy. The PCI guide says that if you must keep paper with card data, mark through the data with a thick black marker until it cannot be read and lock the paper away. The FTC's guide for businesses says not to keep a card's account number and expiration date without an essential business need, and to dispose of paper records by shredding, burning, or pulverizing them.

## Deposits and cancellation charges

A deposit protects you on rides that tie up a van for hours, such as long-distance trips or trips far outside your service area. Put the full quote in writing: the price, the deposit, when the balance is charged, and when the deposit is refunded. See [how much to charge for NEMT](https://nemtguide.com/guides/how-much-to-charge-for-nemt/) for building the price.

A cancellation or no-show fee is fair when the rider agreed to it before booking. Charge the same fee to every private rider, and only the amount agreed. Record your arrival time, how long you waited, and every call or text to the rider, so you can show what happened. The [no-show policy template](https://nemtguide.com/templates/nemt-no-show-policy/) has wording to start from.

Two laws shape those charges:

- **Card disputes.** Under Regulation Z, a credit cardholder can dispute a charge as a billing error when a service was not delivered as agreed, in writing within 60 days after the first statement showing it ([12 CFR 1026.13](https://www.ecfr.gov/current/title-12/section-1026.13)). The signed terms, the trip record, and your messages are your answer.
- **All-in prices.** As of September 2026, California Civil Code 1770(a)(29) and Minnesota Statutes 325D.44 bar advertising a price that leaves out mandatory fees. In those states, if every rider pays a booking or fuel fee, include it in the price you post or quote.

## Card surcharges and cash discounts

A surcharge passes your card processing cost on to the payer. State law and the card networks both limit it.

| Rule | What it says |
|---|---|
| Connecticut, General Statutes 42-133ff | No person may impose a surcharge on any transaction. A discount for paying by cash, check, or debit card is allowed if you disclose it: posted on your premises, shown online before payment, or said out loud before a phone payment. |
| Massachusetts, General Laws chapter 140D, section 28A | No seller may impose a surcharge on a cardholder who pays by credit card instead of cash or check |
| Visa rules (U.S. Merchant Surcharge Q and A, February 15, 2024) | Notify your processor at least 30 days before you start. Surcharge credit cards only, never debit or prepaid cards, even when a debit card is run as credit. Charge no more than your processing cost or 3 percent, whichever is lower. Post a notice where customers first reach you, such as your door or website, and at the point of sale, and show the surcharge on every receipt. |

Visa's own list of states that prohibit or limit surcharges is longer than these two, but Visa says its list is not legal advice. Check your state's law before you add a surcharge to any price.

## Invoicing hospitals, clinics, and senior living communities

Facilities rarely pay by card. They pay invoices through an accounts payable office with its own rules, and an invoice that breaks them waits. Mass General Brigham's supplier page shows what large systems expect (as of September 2026):

- Standard payment terms of net 45 days from the invoice date
- Every invoice shows the invoice number, invoice date, purchase order number, and remit address
- One purchase order per invoice, and one invoice per page
- No interest or late payment charges on invoices
- No statements or spreadsheets in place of an invoice

Before the first ride for any facility, ask its accounts payable office for its purchase order process, payment terms, and invoice format. If you want late fees, they must be in the signed agreement, and some facilities will refuse them. Put the rates, the billing cycle, and the payment terms in the [facility transportation agreement](https://nemtguide.com/templates/facility-transportation-agreement/), and bill each month on the [NEMT invoice template](https://nemtguide.com/templates/nemt-invoice-template/).

List each trip on the invoice with the date, the rider's name or the facility's patient number, the pickup and drop-off, the level of service, and the charges. If your company is a HIPAA covered entity, you may disclose health information to get paid ([45 CFR 164.506](https://www.ecfr.gov/current/title-45/section-164.506)), but the minimum necessary rule applies to payment disclosures (45 CFR 164.502(b)). The facility does not need a diagnosis to pay for a ride. Keep facility pricing separate from any referrals of Medicaid trips, as [anti-kickback rules for NEMT](https://nemtguide.com/guides/anti-kickback-rules-for-nemt/) explains.

## Receipts that protect privacy and still work for FSA claims and taxes

Paying by card does not make your processor part of your HIPAA duties. Section 1179 of the Social Security Act ([42 U.S.C. 1320d-8](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title42-section1320d-8&num=0&edition=prelim)) keeps HIPAA's administrative simplification rules from applying to banks, and to companies processing payments for them, when they authorize, process, clear, or settle a payment for health care by card, check, or electronic transfer.

Your own paperwork is different if your company is a covered entity. Whether a van company is one depends on whether its rides count as health care and how it bills, as [HIPAA for NEMT providers](https://nemtguide.com/guides/hipaa-for-nemt/) explains. If it is, three rules apply:

- **Minimum necessary.** Put only what the payer needs on a receipt or invoice (45 CFR 164.502(b)).
- **Family members who pay.** You may share information directly relevant to a family member's involvement in paying for the rider's care, following the rider's wishes where the rider can decide (45 CFR 164.510(b)).
- **Rides paid in full out of pocket.** If a rider pays for a ride in full and asks you not to share it with their health plan for billing or business operations, you must agree, unless a law requires the disclosure (45 CFR 164.522(a)(1)(vi)).

### What to put on a receipt

| Include | Leave off |
|---|---|
| Your company name, address, and phone | Diagnoses and the reason for the visit |
| Receipt number and date | The name of a specialist or clinic department that reveals a condition |
| Rider's name, and the payer's name if different | The full card number |
| Date of the ride, pickup and drop-off, one way or round trip | The card's expiration date |
| Level of service: ambulatory, wheelchair, or stretcher | The security code, ever |
| Each charge and the total paid | Medication or equipment details beyond what the ride needed |
| Payment method and the last four digits of the card | Notes from dispatch about the rider's health |

Federal law already limits printed card receipts. A business that accepts cards may print no more than the last 5 digits of the card number, and no expiration date, on an electronically printed receipt given at the point of sale ([15 U.S.C. 1681c(g)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section1681c&num=0&edition=prelim)).

### How families use your receipt

- **Health FSA.** To be reimbursed, the family gives the plan a written statement from an independent third party showing that the expense was incurred and its amount (IRS Publication 969, 2025). IRS guidance on FSA debit cards lets them work at merchants with health care merchant category codes, and at some stores with an approved item-checking system, and treats charges the plan cannot verify on the spot as conditional until a receipt arrives (Notice 2006-69). Your receipt is that statement.
- **HSA.** The account holder keeps records showing each withdrawal paid a qualified medical expense (IRS Publication 969, 2025).
- **Tax deduction.** Amounts paid for transportation primarily for and essential to medical care count as medical expenses, and only the part of total medical expenses above 7.5 percent of adjusted gross income is deductible on Schedule A (IRS Publication 502, 2025). Leave the tax advice to the family's preparer.

## Frequently asked questions

### Can I keep a private rider's credit card on file?

Yes, with the cardholder's signed authorization that says what you may charge and when. Let your card processor store the card, so you never keep the full number yourself. The PCI Security Standards Council says a card's security code may never be kept after the charge it was collected for is approved, even with the customer's permission, and is not needed for card-on-file charges.

### Can I charge a no-show or late cancellation fee to a rider's card?

Only to a private rider who agreed to the fee in writing before booking, and only in the amount agreed. Document the no-show with your arrival time, how long you waited, and your attempts to reach the rider. Never charge a Medicaid member: CMS says states and providers may not charge members for no-shows (SMD 23-006, September 28, 2023).

### Can I add a surcharge for credit card payments?

It depends on your state and the card networks. Connecticut and Massachusetts ban surcharges by statute. Where surcharges are allowed, Visa's rules (February 15, 2024) require 30 days' notice to your processor, allow them on credit cards only, cap them at your processing cost or 3 percent, whichever is lower, and require a notice where riders first reach you and at checkout, plus the surcharge on every receipt.

### Do card payments break HIPAA rules?

No. Section 1179 of the Social Security Act keeps HIPAA's administrative simplification rules from applying to banks and the companies that process payments for them, for authorizing, processing, and settling a payment for health care by card, check, or electronic transfer. If your company is a HIPAA covered entity, your own invoices and receipts still follow the minimum necessary rule, so leave diagnoses off.

### Can families pay for rides with an FSA or HSA card?

It depends on the plan and on how your card account is coded. IRS guidance lets FSA debit cards work at merchants coded as health care providers, and at some stores with an approved item-checking system, and treats charges it cannot verify on the spot as conditional until the family sends a receipt. Ask your processor which merchant code your account carries, and give the family an itemized receipt either way.

### What should a NEMT receipt show?

Your company name and contact details, a receipt number and date, the rider's name, the date of the ride, the pickup and drop-off, the level of service, each charge, the amount paid, and the payment method with only the last four digits of the card. Leave off diagnoses, the reason for the visit, and the card's expiration date and security code.

### Can a Medicaid member pay me by card to skip the broker?

Not for a ride Medicaid covers. Federal rule 42 CFR 447.15 requires Medicaid providers to accept the program's payment as payment in full, and broker agreements such as MTM Health's standard agreement bar billing members even when the broker does not pay. Read your state provider manual and every broker agreement before you take any payment from a member.

## Official resources

- [FTC: Protecting Personal Information, A Guide for Business](https://www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business)
- [PCI Security Standards Council: Guide to Safe Payments for small merchants](https://listings.pcisecuritystandards.org/documents/Small_Merchant_Guide_to_Safe_Payments.pdf)
- [Visa: U.S. merchant surcharge questions and answers](https://usa.visa.com/content/dam/VCOM/global/support-legal/documents/merchant-surcharging-qa-for-web.pdf)
- [IRS: Form 8300 reference guide (cash over $10,000)](https://www.irs.gov/businesses/small-businesses-self-employed/irs-form-8300-reference-guide)
- [IRS: Understanding your Form 1099-K](https://www.irs.gov/businesses/understanding-your-form-1099-k)
- [IRS: Publication 502, Medical and Dental Expenses](https://www.irs.gov/publications/p502)
- [IRS: Publication 969, Health Savings Accounts and Other Tax-Favored Health Plans](https://www.irs.gov/publications/p969)