Get Paid Faster. Stay Compliant. Pay Less.

A fully automated patient payment solution powered by Rectangle Health's Practice Management Bridge®.

Reduce compliance exposure and processing costs and recover outstanding A/R — without disrupting how your practice operates. Bridge® sits on top of the practice management system you already use.

Request a free statement analysis, or see your potential savings in under 2 minutes with the ROI calculator.

Try the ROI Calculator

Request a Free Statement Analysis

We'll calculate your potential processing fee reduction, A/R recovery potential, and compliance exposure, with no obligation.

Prefer to talk? Call (888) 641-6131

BBB A+ Rated
40,000+ Facilities Served
Since 2009
PCI DSS Level 1 Partner
Free Statement Analysis

Quick Answer

A patient payment platform automates how a practice collects what patients owe: payment reminders and text-to-pay, online and in-office card payments, stored cards, payment plans, and posting to the practice ledger. Practices that take patient payments have to meet overlapping rules. PCI DSS governs how card data is protected. The TCPA governs consent for automated calls and texts. HIPAA requires safeguards for electronic protected health information, including when it's transmitted. A good platform builds those protections into every transaction.

Key Takeaways

PCI DSS v4.x (v4.0.1, published June 2024) is the card-security standard in force; v3.2.1 was retired on March 31, 2024, and v4's future-dated requirements took effect March 31, 2025.
The TCPA lets consumers recover $500 per unwanted automated call or text — and courts can triple that for willful or knowing violations.
The FCC's TCPA exemption for healthcare messages is narrow: no more than one message a day and three a week, with no telemarketing.
HIPAA's Security Rule requires technical measures to protect ePHI transmitted over electronic networks — including billing communications.
Tokenizing stored cards keeps full card numbers out of staff view and out of your practice management system.
Rectangle Health reports an average 47% reduction in outstanding A/R within the first 90 days for its client practices.

Average reduction in outstanding A/R within 90 days, as reported by Rectangle Health: 47%
Ways for patients to pay, including text, online, in-office, and payment plans: 15+
Of practice management systems Bridge® integrates with, per Rectangle Health: 99%
Staff time recovered per week on average, per Rectangle Health: 5+ hrs
Statutory damages per TCPA violation — up to 3x if willful: $500

Federal Payment Obligations

Your Practice Has Payment Obligations — Are You Meeting Them?

Most practices assume they're compliant. The violations live in the details of how payments are collected, stored, and communicated.

Collecting from patients touches three sets of rules at once: card-data security (PCI DSS), consent for automated texts and calls (the TCPA), and privacy and security for patient information (HIPAA). They're specific, technical, and actively enforced — and most practices don't discover an exposure until after a complaint or audit.

Card Data Security (PCI DSS)

Card numbers visible to staff, kept in spreadsheets, or stored outside a secure vault create PCI DSS exposure regardless of transaction volume. PCI DSS v4.x replaced v3.2.1, which was retired on March 31, 2024, and the requirements that were future-dated in v4 became effective March 31, 2025. Card brands and acquiring banks can impose fines and restrict card processing for non-compliance.

Text Consent (TCPA) and Secure Billing (HIPAA)

Texting payment reminders without documented consent risks TCPA claims of $500 per message, up to three times that if the violation is willful or knowing. Separately, HIPAA's Security Rule requires technical measures to guard electronic PHI sent over electronic networks, so billing summaries and payment details belong in secure, HIPAA-compliant channels.

Rectangle Health

Rectangle Health Handles It Automatically

Rectangle Health's platform is built to cover the compliance details most practices miss:

Built-in consent management — patient consent captured and documented automatically at every touchpoint, for TCPA compliance.
Secure patient communications — billing and payment communications delivered through HIPAA-compliant channels.
Tokenized card data (Vault) — card numbers are never visible to staff or stored in your PMS. PCI DSS Level 1.
HITRUST and SOC 2 Type 1 certified healthcare data security, applied across all packages.

Bridge™ Payments

What's Included in Bridge™ Payments

Optimized payment capture at every point in the patient journey, from pre-visit through post-care follow-up.

Automatic Payment Posting

Payments post directly to your ledger.

Text-to-Pay

Individual and bulk text payment campaigns.

Balance Collect

Online payment links patients can use anytime.

Vault & Card Account Updater

Secure card on file that auto-updates expired cards.

Contactless, Terminals & Plans

Tap to pay, in-office hardware, recurring plans, and patient financing.

PayerSync

Insurance payment management and reconciliation.

Know the Rules

The Rules That Apply to Patient Payments

Three frameworks, three different risks.

The Rules That Apply to Patient Payments
Rule	What It Covers	What It Means for Your Practice
PCI DSS v4.x	Security of payment card data	Protect stored card data, restrict staff access, and use validated, secure payment tools
TCPA (47 U.S.C. §227)	Automated calls and texts to consumers	Get and document consent before automated payment texts; $500 per violation, up to 3x if willful
HIPAA Security Rule	Electronic protected health information	Use secure channels for billing communications that include PHI (45 CFR 164.312(e))

Getting Started

How to Get Started

Request a Quote

1
Estimate Your Savings
Use the ROI calculator or request a free statement analysis.
2
Review Your Analysis
A 20-minute call covering your rates, A/R trends, and compliance posture.
3
Onboard
Most practices are fully onboarded within a few business days.
4
Collect More
Bridge® layers on your PMS — posting, reminders, and payments run automatically.

Self-Check

Patient Payment Compliance Check-Up

Five questions to ask about how your practice collects today.

Card numbers are never visible to staff or stored in spreadsheets or your PMS.
Your payment tools meet the current PCI DSS v4.x standard.
You have documented consent before sending automated payment texts.
Billing communications that include PHI go through secure channels.
You've reviewed your processing rates and platform fees in the last year.

Your Self-Check

0/5in place

Tick what your facility already has in place. MedPro can help close the gaps.

Get Compliant Help

Why MedPro

Compliant, Cost-Effective, and Off Your Team's Plate

Outcomes as reported by Rectangle Health.

Average A/R reduction within 90 days

47%

Payment methods across every channel

15+

PMS/EMR compatibility

99%

Support from day one

24/7

Why Practices Switch

Why Practices Switch to MedPro's Patient Payment Partner

The same reason practices come to MedPro for waste disposal — compliant, cost-effective, and off your team's plate. Average outcomes across Rectangle Health client practices, as reported by Rectangle Health:

47% reduction in outstanding A/R on average within the first 90 days, driven by 15+ ways to pay.
Zero disruption to your workflow — integrates with 99% of practice management systems.
5+ staff hours recovered per week by automating posting, reminders, and follow-up.
Full compliance coverage from day one: TCPA, PCI DSS, HIPAA, HITRUST, and SOC 2.
24/7 support and personalized onboarding connecting Bridge® to your existing PMS/EMR.
Rectangle Health typically matches and beats incumbent rates, with no separate monthly platform fee.

Reference

Patient Payments Glossary

PCI DSS: The Payment Card Industry Data Security Standard — security requirements for any organization that stores, processes, or transmits card data.

Tokenization: Replacing a card number with a non-sensitive token so the real number is never stored in your systems.

TCPA: The Telephone Consumer Protection Act, which restricts automated calls and texts to consumers without consent.

Text-to-Pay: Sending patients a text message with a secure link to pay their balance.

A/R: Accounts receivable — balances patients and payers owe the practice.

HITRUST: A certifiable security framework widely used in healthcare.

SOC 2: An audit of a service organization's controls for security, availability, and confidentiality.

FAQ

Frequently Asked Questions

Still have a question? Call (888) 641-6131 and talk to a real person.

What is Rectangle Health's Practice Management Bridge®?

Rectangle Health's end-to-end patient payment platform. It automates payment capture, posting, reminders, and compliance across the patient journey — from scheduling through post-care follow-up — and connects directly to your existing practice management system.

Will it work with our practice management software?

Rectangle Health says Bridge® is compatible with 99% of practice management and EMR systems. Compatibility is confirmed during onboarding; if your system isn't supported, you'll be told upfront. Payments post directly to your ledger with no workflow changes.

Do we need consent to text patients about payments?

Get and document it. The TCPA allows consumers to recover $500 per violating automated call or text, and courts can triple that for willful or knowing violations. The FCC's exemption for healthcare messages is narrow — limited to one message a day and three a week, with no telemarketing — so documented consent is the safest foundation for payment reminders. Rectangle Health captures consent automatically.

What version of PCI DSS applies now?

PCI DSS v4.x — v4.0.1, a limited revision published in June 2024, clarified v4.0. The PCI Security Standards Council retired v3.2.1 on March 31, 2024, and the requirements that were future-dated in v4.0 became effective March 31, 2025.

Can we email billing statements to patients?

Billing communications that include PHI need appropriate safeguards — HIPAA's Security Rule requires technical measures to protect ePHI transmitted over electronic networks. Rectangle Health delivers billing and payment communications through HIPAA-compliant channels.

What compliance standards does the platform meet?

According to Rectangle Health, its platform maintains HIPAA safeguards, PCI DSS Level 1 compliance, HITRUST certification, and SOC 2 Type 1 certification across all packages, with automated TCPA consent management built in.

How long does implementation take?

Most practices are fully onboarded within a few business days, with personalized onboarding support, direct PMS/EMR workflow connections, and 24/7 support from day one.

Can I estimate my savings before committing?

Yes. Use the ROI calculator to enter your monthly volume and current processing rate for a personalized estimate in under two minutes, or request a free savings analysis — a 20-minute call reviewing your rates, A/R trends, and compliance posture, with no obligation.

Sources & Further Reading

Related Services

One vendor for every waste stream

All services →

HR Services

Practical HR support for healthcare employers — handbooks, background checks, and compliance-aligned personnel policies.

Learn More

HIPAA Certification

Staff HIPAA training and certification, risk assessments, and policy support for Privacy, Security, and Breach Notification compliance.

Learn More

Healthcare Compliance Certification & Training

A complete, survey-ready compliance program covering OSHA, HIPAA, and infection control training for your whole team.

Learn More

Data & Document Destruction

Secure, certified shredding of paper records and destruction of electronic media containing PHI or other sensitive data.

Learn More

See Your Savings in Under 2 Minutes

Estimate your savings with the ROI calculator

Use Rectangle Health's interactive ROI calculator to estimate how much your practice could save on processing fees, A/R recovery, and staff time, personalized to your volume and current rates.

ROI Calculator

Request Pricing