At many practices, "payment collection" means staff sending links by hand, chasing balances by phone, and reconciling who paid what. You can trigger payment requests from events, send reminders on a schedule, and sync payments back to your records automatically. The question is how to do it without opening security holes or spending weeks building it.
What It Means
Payment requests go out from rules you define instead of a staff member clicking "send" for every patient. The pieces:
- Triggers: booking, appointment completion, form submission, a denied claim, or a date
- Payment processing: tokenized cards, PCI-compliant payment pages, ACH
- Messages: email and SMS with payment links
- Sync: payments written back to your EHR or practice management system
Trigger Points That Work
Copay before the visit. When a patient books through online booking, request the estimated copay right away.
Balance after the visit. When the appointment is marked complete, request the remaining balance, ideally from a webhook on status change or a regular API check.
Payment plans. Recurring requests on set dates, with retry logic for failures.
Denied claims. A patient responsibility notice with a payment link, which needs a connection to your clearinghouse or billing system.
The technical question for each: which system exposes the event, and does it send webhooks or need polling?
The Architecture
Scheduling creates the appointment and sends a webhook when it's booked or completed.
An automation layer applies your rules ("new patient: request payment now") and triggers the action.
The payment processor hosts a secure, tokenized payment page, ideally with stored payment methods for recurring charges.
Notifications send the link and handle delivery failures.
Sync writes completed payments back, by API, webhook, or a scheduled batch.
In Formisoft, online payments live alongside scheduling and patient notifications, so payment links and appointment data are in one place, and payments can be collected inside any form. Webhooks, the REST API, and Zapier can push completed payments to your other systems. Patient payments carry a 5% processing fee.
HIPAA for Payment Workflows
Payment workflows touch PHI: patient names, appointment details, balances.
Agreements. Your email, SMS, and automation vendors need signed BAAs. Payment processors often rely on HIPAA's exemption for processing payments and may not sign one, so keep clinical details out of anything the processor sees.
Encryption. HTTPS for payment links; webhook data encrypted in transit and at rest. Leave SSNs, birth dates, and diagnosis codes out of webhook bodies.
Access. Only authorized staff configure workflows, view payment history, or issue refunds.
Audit logs. Who sent which request, when links were opened, and who viewed payment records.
Card data falls under PCI DSS: never store card numbers; use tokens and let the processor handle storage and recurring billing.
Implementation, One Step at a Time
Step 1: pre-visit copays for new patients. Simplest logic, biggest effect: request payment when a new patient books online.
Step 2: post-visit balances for established patients, after insurance has processed and patient responsibility is known.
Step 3: payment plans for larger balances, with recurring requests and retries.
Step 4: sync completed payments to the patient ledger, ending manual reconciliation.
Test each with test webhooks and test cards, and check that data writes back without duplicates.
Automate vs. Keep Manual
Automate: standard copays, routine balance requests, plan installments, overdue reminders, receipts, ledger updates.
Keep manual: hardship cases, negotiating plans for large balances, refunds, disputes, and exceptions.
Automate what's predictable; keep a person on anything that needs judgment.
Integration Challenges
Webhook reliability. Deduplicate events by ID, retry failed deliveries, and queue payloads before processing.
API rate limits. EHR APIs often cap requests. Batch syncs during quiet hours.
Field mapping. Your EHR and processor name fields differently. Build and document a mapping layer.
Time zones. Store times in UTC and convert to the patient's local time before sending.
Without IT staff, Zapier covers common cases without code, and webhooks and the REST API handle anything custom.
Measure It
- Collection rate: balances collected within 30 days, before vs. after
- Staff time on payment follow-up
- Link click-through
- Days to payment from the date of service
Measure what you collect and how fast, not how many requests you send. Start with one high-volume, simple workflow, run it for two weeks, measure, then add the next.
Connect intake to the rest of your front desk.
- Forms, consents, and signatures before the visit
- Your paper forms converted by AI
- BAA included