Guide

The Card-on-File Authorization That Survives a Chargeback

Summary

A card-on-file authorization survives a disputed no-show charge when it names the specific charge, the amount or how the amount is computed, when the card can be run, and how the patient revokes it, signed and dated by the cardholder with a copy handed back. No federal rule prescribes the wording. Federal law defines the dispute grounds instead, and a stored card answers only the authority ground, never whether the fee was owed.

By Gale Editorial · Updated 2026-09-01. Every figure cited to a dated source. How we write.

What the authorization has to say

No federal regulation prescribes the wording of a card-on-file authorization for a medical practice, so the elements below are drafting convention rather than a cited requirement. What the regulations do supply is the list of things a dispute turns on, and each one has a line the form can close. Write those lines and the form does the only work a form can do.

the cardholder's name, the last four digits, and the date signed
the practice's name exactly as it will appear on the cardholder's statement
each charge the card may be run for, named one at a time, not a blanket line about any balance owed
the amount of each charge, or the method by which it is computed
the event that triggers the charge, and how soon after it the card is run
that the card is retained for later charges, and until when
how the patient revokes, in what form and to whom, and what happens to a charge already incurred
the cardholder's signature, and a copy handed back

A patient who does not recognize the merchant name on a statement has a reason to call the bank before calling the practice, and the call to the bank is the expensive one.

The wording is also the last question. Before any of it comes the test before a new fee: whether the practice may charge the thing at all, to whom, and on what disclosure.

No federal agency has written the clinic version of this document. The nearest thing is the Federal Trade Commission's enforcement policy statement on negative-option marketing, which addresses internet subscription billing and says on its face that it confers no rights and binds nobody. But its standard travels: obtain express informed consent before charging, separately from the rest of the transaction 1Ref 1Federal Trade Commission (2021).Enforcement Policy Statement Regarding Negative Option Marketing.The federal disclosure-and-consent standard used here as analogy and best practice only: clear and conspicuous disclosure of material terms before billing information is taken, and express informed consent obtained before the charge, separately from the rest of the transaction. Cited with its own limits stated in prose, since the statement addresses internet negative-option marketing, confers no rights and does not bind a clinic's no-show fee.. Separately is the operative word. An authorization buried on page four of an intake packet, initialed once with everything else, is consent to the packet.

What the patient is disputing

Two different things, and only one of them is about the card. Regulation Z counts as a billing error a charge for property or services the consumer did not accept or that were not delivered as agreed, and separately a charge that was not made to the consumer or to a person with actual, implied, or apparent authority to use the card 2Ref 2Consumer Financial Protection Bureau (2011).12 CFR 1026.13 — Billing error resolution.The federal credit-card billing-error mechanism: that a billing error includes a charge for services not accepted or not delivered as agreed and a charge not made to the consumer or to a person with actual, implied or apparent authority; the 60-day written-notice deadline running from the first periodic statement; the two-billing-cycle and no-later-than-90-day resolution clock; and the fact that this section does not describe network chargeback rules or merchant representment.. A signed authorization answers the second ground. It does not reach the first.

A missed visit is where the two grounds come apart. The fee is not payment for a service, and CMS says so plainly: a charge for a missed appointment is for the missed business opportunity rather than for a service, and it is not billed to Medicare 3Ref 3Centers for Medicare & Medicaid Services (2024).Medicare Claims Processing Manual, Chapter 1 — General Billing Requirements (CMS Pub. 100-04).Section 30.3.13, Charges for Missed Appointments, only: that a practice may charge Medicare beneficiaries for missed appointments provided it does not discriminate against them but also charges non-Medicare patients, that the charge is for a missed business opportunity rather than for a service, and that it is not billed to or paid by Medicare. Also cited for what the manual does not address, namely card storage, authorization wording and disputes.. No service could have been delivered as agreed. What was agreed is the appointment policy.

So the document that decides a no-show dispute is usually the policy the card form points at, not the card form.

That is why an authorization covering any balance owed is weaker than one covering the no-show fee set by the appointment policy the patient signed on a named date. The first asserts authority over an unnamed sum. The second names the charge, the obligation behind it, and the number.

How long the patient has, and how long the bank takes

Sixty days, counted from a statement rather than from the appointment. A Regulation Z billing error notice must be in writing and must reach the creditor no later than 60 days after the creditor transmitted the first periodic statement that reflects the alleged error 2Ref 2Consumer Financial Protection Bureau (2011).12 CFR 1026.13 — Billing error resolution.The federal credit-card billing-error mechanism: that a billing error includes a charge for services not accepted or not delivered as agreed and a charge not made to the consumer or to a person with actual, implied or apparent authority; the 60-day written-notice deadline running from the first periodic statement; the two-billing-cycle and no-later-than-90-day resolution clock; and the fact that this section does not describe network chargeback rules or merchant representment.. The issuer then has to complete the resolution procedures within two complete billing cycles, and in no event later than 90 days, after receiving that notice 2Ref 2Consumer Financial Protection Bureau (2011).12 CFR 1026.13 — Billing error resolution.The federal credit-card billing-error mechanism: that a billing error includes a charge for services not accepted or not delivered as agreed and a charge not made to the consumer or to a person with actual, implied or apparent authority; the 60-day written-notice deadline running from the first periodic statement; the two-billing-cycle and no-later-than-90-day resolution clock; and the fact that this section does not describe network chargeback rules or merchant representment..

The debit and ACH side runs on a different regulation and a looser front door. Under Regulation E the consumer's notice of error may be oral or written, and it is timely up to 60 days after the institution sends the statement on which the transfer first appeared 4Ref 4Consumer Financial Protection Bureau (2011).12 CFR 1005.11 — Procedures for resolving errors.The debit and ACH error-resolution path only: that the consumer's notice of error may be oral or written and is timely up to 60 days after the institution sends the periodic statement on which the transfer first appeared, and the bank's 10-business-day investigation with a 45-day extension conditioned on provisional credit.. The bank has 10 business days to investigate, and may take 45 if it credits the account provisionally in the meantime 4Ref 4Consumer Financial Protection Bureau (2011).12 CFR 1005.11 — Procedures for resolving errors.The debit and ACH error-resolution path only: that the consumer's notice of error may be oral or written and is timely up to 60 days after the institution sends the periodic statement on which the transfer first appeared, and the bank's 10-business-day investigation with a 45-day extension conditioned on provisional credit..

	Card charge (Regulation Z)	Bank draft (Regulation E)
Patient's notice	Written	Oral or written
Deadline	60 days from the statement showing the charge	60 days from the statement showing the transfer
Institution's clock	Two billing cycles, no later than 90 days	10 business days, 45 with provisional credit

The practical consequence is a retention rule. The window opens at a statement date the practice never sees, so the file behind a no-show charge has to outlive the month it was made in by a comfortable margin.

If the money comes out of a bank account instead of a card

Then a federal writing requirement applies that no single card charge triggers. A preauthorized electronic fund transfer from a consumer's account may be authorized only by a writing signed or similarly authenticated by the consumer, and the party that obtains the authorization has to give the consumer a copy 5Ref 5Consumer Financial Protection Bureau (2011).§ 1005.10 Preauthorized transfers..The bank-side mechanics for a recurring draft rather than a card charge: that a preauthorized electronic fund transfer may be authorized only by a writing signed or similarly authenticated by the consumer with a copy provided to the consumer, the three-business-day stop-payment right exercised through the consumer's own institution, and the 10-day advance written notice required when a transfer varies in amount.. Practices storing cards sometimes skip the copy. On the ACH side, that is not a style choice.

Two more mechanics point back at the wording. A consumer can stop a preauthorized transfer by telling their own bank at least three business days before the scheduled date, whatever cancellation process the practice runs 5Ref 5Consumer Financial Protection Bureau (2011).§ 1005.10 Preauthorized transfers..The bank-side mechanics for a recurring draft rather than a card charge: that a preauthorized electronic fund transfer may be authorized only by a writing signed or similarly authenticated by the consumer with a copy provided to the consumer, the three-business-day stop-payment right exercised through the consumer's own institution, and the 10-day advance written notice required when a transfer varies in amount.. And when a transfer varies in amount from the previous one or from the preauthorized amount, written notice of the amount and the date is due at least 10 days ahead 5Ref 5Consumer Financial Protection Bureau (2011).§ 1005.10 Preauthorized transfers..The bank-side mechanics for a recurring draft rather than a card charge: that a preauthorized electronic fund transfer may be authorized only by a writing signed or similarly authenticated by the consumer with a copy provided to the consumer, the three-business-day stop-payment right exercised through the consumer's own institution, and the 10-day advance written notice required when a transfer varies in amount..

A missed-appointment fee varies by nature. That is the concrete reason an authorization states the amount, or the method of computing it, rather than leaving the number open.

Your processor's ACH rulebook adds requirements on top of Regulation E. Ask for them in writing before the first draft, not after the first return.

Medicare patients and the equal-application condition

Charging a Medicare beneficiary for a missed appointment is allowed, on one stated condition: that the practice does not discriminate against Medicare beneficiaries but also charges non-Medicare patients for missed appointments 3Ref 3Centers for Medicare & Medicaid Services (2024).Medicare Claims Processing Manual, Chapter 1 — General Billing Requirements (CMS Pub. 100-04).Section 30.3.13, Charges for Missed Appointments, only: that a practice may charge Medicare beneficiaries for missed appointments provided it does not discriminate against them but also charges non-Medicare patients, that the charge is for a missed business opportunity rather than for a service, and that it is not billed to or paid by Medicare. Also cited for what the manual does not address, namely card storage, authorization wording and disputes.. CMS frames the charge as one for a missed business opportunity rather than for a service, and it is neither billed to Medicare nor paid by it 3Ref 3Centers for Medicare & Medicaid Services (2024).Medicare Claims Processing Manual, Chapter 1 — General Billing Requirements (CMS Pub. 100-04).Section 30.3.13, Charges for Missed Appointments, only: that a practice may charge Medicare beneficiaries for missed appointments provided it does not discriminate against them but also charges non-Medicare patients, that the charge is for a missed business opportunity rather than for a service, and that it is not billed to or paid by Medicare. Also cited for what the manual does not address, namely card storage, authorization wording and disputes.. The fee is a patient charge from beginning to end.

The condition reaches the card form too: one policy, one fee, one authorization document, put in front of everyone the practice schedules. A fee waived by habit for insured patients and enforced for the rest builds the very difference the condition is about.

The manual says nothing about storing a card, nothing about authorization language, nothing about disputes 3Ref 3Centers for Medicare & Medicaid Services (2024).Medicare Claims Processing Manual, Chapter 1 — General Billing Requirements (CMS Pub. 100-04).Section 30.3.13, Charges for Missed Appointments, only: that a practice may charge Medicare beneficiaries for missed appointments provided it does not discriminate against them but also charges non-Medicare patients, that the charge is for a missed business opportunity rather than for a service, and that it is not billed to or paid by Medicare. Also cited for what the manual does not address, namely card storage, authorization wording and disputes.. It answers whether the charge may exist. How it is collected is a question federal health policy does not touch.

The file that answers a dispute

Six documents, assembled at the time of the charge rather than at the time of the dispute. Keep the signed authorization with its date, the policy text in force on that date rather than the one on the website now, the appointment record with its booking and cancellation timestamps, the reminder that went out, the itemized receipt, and any message in which the patient acknowledged the policy.

The versioned policy is the one practices miss. A practice that shortens its cancellation window in March cannot show what a patient agreed to in January unless it kept January's text.

Answer the patient's email, and keep the reply. Regulation Z defines unauthorized use as use of a credit card by someone other than the cardholder who lacks actual, implied, or apparent authority 6Ref 6Consumer Financial Protection Bureau (2011).12 CFR 1026.12 — Special credit card provisions.The definition of unauthorized use of a credit card as use by a person other than the cardholder lacking actual, implied or apparent authority, and the cardholder's separate right to assert claims and defenses against the card issuer, together with the precondition that the cardholder first made a good-faith attempt to resolve the dispute with the merchant., which does not describe a patient's own stored card. But the same section gives the cardholder a separate right to assert claims and defenses against the card issuer, conditioned on a prior good-faith attempt to resolve the dispute with the merchant, and on limits of amount and location 6Ref 6Consumer Financial Protection Bureau (2011).12 CFR 1026.12 — Special credit card provisions.The definition of unauthorized use of a credit card as use by a person other than the cardholder lacking actual, implied or apparent authority, and the cardholder's separate right to assert claims and defenses against the card issuer, together with the precondition that the cardholder first made a good-faith attempt to resolve the dispute with the merchant..

A practice that replies, itemizes the charge and offers a resolution is dealing with that precondition.

What federal law does not decide

The chargeback itself. Regulation Z and Regulation E govern what a patient may raise with their bank and what the bank owes them in return. The Regulation Z billing-error section describes none of the card-network chargeback rules, the reason code a dispute arrives under, what evidence a merchant may submit, or the deadline for submitting it 2Ref 2Consumer Financial Protection Bureau (2011).12 CFR 1026.13 — Billing error resolution.The federal credit-card billing-error mechanism: that a billing error includes a charge for services not accepted or not delivered as agreed and a charge not made to the consumer or to a person with actual, implied or apparent authority; the 60-day written-notice deadline running from the first periodic statement; the two-billing-cycle and no-later-than-90-day resolution clock; and the fact that this section does not describe network chargeback rules or merchant representment.. Those sit in the card networks' operating rules and in your processor's contract.

So ask the processor, in writing, before the next dispute arrives: which reason codes a missed-appointment dispute comes in under, how long the practice has to respond, what evidence it accepts and in what format, and what a dispute costs whether it is won or lost.

No published federal source prescribes the wording of a clinic's card-on-file form. The elements at the top of this page are drafting convention assembled from the regulations that do apply. Have counsel read the final wording once, and ask the processor for its evidence list in the same week.

Common questions

No. It answers one of the two grounds a patient can raise, which is whether the charge was authorized. It does not answer the other, which is whether services were accepted or delivered as agreed. A missed-appointment fee is not payment for a service, so the document carrying the weight is the appointment policy the authorization points at, kept in the version the patient signed under.

Longer than a month, because the clock does not start at the appointment. On the credit card side the patient's written notice is timely up to 60 days after the creditor sent the first periodic statement showing the charge. On the debit and ACH side the notice may be oral or written, on the same 60-day count from the statement. Keep the file accordingly.

Yes, on the condition CMS states: the practice does not discriminate against Medicare beneficiaries but also charges non-Medicare patients for missed appointments. CMS treats the charge as one for a missed business opportunity rather than for a service, and it is neither billed to Medicare nor paid by it. One policy and one fee, applied to everyone scheduled, is what the condition asks for.

Yes, and it is stricter. A preauthorized electronic fund transfer from a consumer's account may be authorized only by a writing signed or similarly authenticated by the consumer, and the consumer has to be given a copy. The consumer can also stop a transfer through their own bank at least three business days ahead, and a transfer varying in amount needs written notice at least ten days out.

Name the method, the recipient and the effect. State how a patient revokes, whether written notice is required, who at the practice receives it, and what happens to a charge already incurred before the revocation arrived. Leaving revocation unaddressed is what turns a routine cancellation into a disputed charge, and it is a clause templates commonly omit.

Four things, in writing, before the next dispute: which reason codes a missed-appointment dispute arrives under, how many days there are to respond, exactly what evidence is accepted and in what format, and what a dispute costs whether it is won or lost. Federal law sets none of those. They come from the card networks' rules and the processor's contract.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.Federal Trade Commission (2021). Enforcement Policy Statement Regarding Negative Option Marketing. Federal Trade Commission. link ✓The federal disclosure-and-consent standard used here as analogy and best practice only: clear and conspicuous disclosure of material terms before billing information is taken, and express informed consent obtained before the charge, separately from the rest of the transaction. Cited with its own limits stated in prose, since the statement addresses internet negative-option marketing, confers no rights and does not bind a clinic's no-show fee.
2.Consumer Financial Protection Bureau (2011). 12 CFR 1026.13 — Billing error resolution. Electronic Code of Federal Regulations (eCFR), Title 12, Chapter X, Part 1026 (Regulation Z), Subpart B. link ✓The federal credit-card billing-error mechanism: that a billing error includes a charge for services not accepted or not delivered as agreed and a charge not made to the consumer or to a person with actual, implied or apparent authority; the 60-day written-notice deadline running from the first periodic statement; the two-billing-cycle and no-later-than-90-day resolution clock; and the fact that this section does not describe network chargeback rules or merchant representment.
3.Centers for Medicare & Medicaid Services (2024). Medicare Claims Processing Manual, Chapter 1 — General Billing Requirements (CMS Pub. 100-04). CMS Internet-Only Manuals (cms.gov). link ✓Section 30.3.13, Charges for Missed Appointments, only: that a practice may charge Medicare beneficiaries for missed appointments provided it does not discriminate against them but also charges non-Medicare patients, that the charge is for a missed business opportunity rather than for a service, and that it is not billed to or paid by Medicare. Also cited for what the manual does not address, namely card storage, authorization wording and disputes.
4.Consumer Financial Protection Bureau (2011). 12 CFR 1005.11 — Procedures for resolving errors. Electronic Code of Federal Regulations (eCFR), Title 12, Chapter X, Part 1005 (Regulation E), Subpart A. link ✓The debit and ACH error-resolution path only: that the consumer's notice of error may be oral or written and is timely up to 60 days after the institution sends the periodic statement on which the transfer first appeared, and the bank's 10-business-day investigation with a 45-day extension conditioned on provisional credit.
5.Consumer Financial Protection Bureau (2011). § 1005.10 Preauthorized transfers.. Regulation E, 12 CFR Part 1005 (implementing the Electronic Fund Transfer Act), Consumer Financial Protection Bureau. link ✓The bank-side mechanics for a recurring draft rather than a card charge: that a preauthorized electronic fund transfer may be authorized only by a writing signed or similarly authenticated by the consumer with a copy provided to the consumer, the three-business-day stop-payment right exercised through the consumer's own institution, and the 10-day advance written notice required when a transfer varies in amount.
6.Consumer Financial Protection Bureau (2011). 12 CFR 1026.12 — Special credit card provisions. Electronic Code of Federal Regulations (eCFR), Title 12, Chapter X, Part 1026 (Regulation Z), Subpart B. link ✓The definition of unauthorized use of a credit card as use by a person other than the cardholder lacking actual, implied or apparent authority, and the cardholder's separate right to assert claims and defenses against the card issuer, together with the precondition that the cardholder first made a good-faith attempt to resolve the dispute with the merchant.

https://www.gale.care/for-providers/pq-card-on-file-consent-chargeback · 6 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers