PaySec LLCVisit Website →
← Back to blog

3% Cap: Surcharge Rules and Low Cost Options for U.S. Providers

October 6, 2026
3% Cap: Surcharge Rules and Low Cost Options for U.S. Providers

Whether a healthcare provider can add a surcharge depends on four separate layers of rules: card network permissions, state law, Medicare requirements, and private payor contracts. Medicare beneficiaries cannot be singled out for surcharges, and debit or prepaid cards cannot carry a surcharge under any circumstance. Where surcharging is otherwise allowed, strict notice and disclosure rules apply before a provider can act on it.

TL;DR:

  • Card network rules require at least 30 days' notice and disclosures at purchase point, while caps are limited to the lesser of processing cost or 3%.
  • Medicare prohibits surcharges on covered services, except for missed appointments, which must be applied equally to all patients and never billed to Medicare.
  • State laws vary widely; some outright ban surcharges or impose disclosure and fee caps, requiring providers to verify current local regulations before implementation.
  • Private payor contracts often restrict passing processing fees to members, so legal review and written consent are essential even when state and network rules allow surcharges.
  • Automatically excluding debit and prepaid cards from surcharging and conducting post-launch audits are critical to staying compliant and avoiding penalties.
Paysec
paysec.ai
Reduce Costs Without Patient Surcharges
PaySec helps healthcare practices pursue transparent payment processing with detailed transaction reporting and no hidden fees.
Explore PaySec

Table of Contents

Surcharging a patient's bill is never a single yes-or-no decision. Four separate rule-makers govern the practice, and each one can independently block it even when the others allow it.

  • Card networks (Visa, Mastercard, American Express) set the baseline technical and disclosure rules a merchant must follow before adding any fee.
  • State law can prohibit surcharging entirely in a provider's outlet location, regardless of what the card networks permit.
  • Medicare and other federal programs restrict what providers can bill beneficiaries directly, independent of card network rules.
  • Private payor contracts frequently include their own prohibitions on passing processing costs to members.

A provider operating in a state that allows surcharging and following every card network rule can still be in violation if a payor contract forbids the practice for its members. That is the core challenge for healthcare administrators: compliance means satisfying every layer at once, not just the most visible one. A single gap, a missed contract clause, an out-of-date state list, a misconfigured point-of-sale system, is enough to trigger fines or clawbacks. The sections below walk through each layer in the order a provider should check it.

Card network rules for Visa, Mastercard, and American Express

Visa and Mastercard permit credit-card surcharges in most U.S. states, but the rules come with firm limits. Merchant Surcharge Q&A.

  1. Notify the acquirer at least 30 days before implementing any surcharge program.
  2. Cap the fee at the lesser of the actual processing cost or 3%, and configure transaction messaging (Visa requires correct Field 28 data) so the surcharge amount is passed accurately.
  3. Post disclosure at point of entry (the entrance or website homepage) stating that a surcharge applies to credit card transactions.
  4. Disclose again at point of sale, before the transaction is completed, and separately line-item the surcharge on the printed or digital receipt.
  5. Exclude debit and prepaid cards from the surcharge at the terminal or gateway level, since neither network permits a surcharge on these card types.

Visa's guidance also notes that its list of state prohibitions and requirements may be incomplete and should be verified against current state law before a program launches, a point we return to in the state law section below. Noncompliance risks range from acquirer-level fines to forced removal of surcharge privileges. For a deeper walkthrough of network notification timing and transaction messaging, our card brand surcharge rules guide covers the technical setup in more detail.

Pro Tip: Configure your point-of-sale system to automatically block surcharges on debit and prepaid cards rather than relying on staff to catch them manually.

What Medicare rules mean for provider surcharges

Medicare's assignment and limiting-charge rules exist specifically to prevent providers from collecting more from a beneficiary than the program allows for a covered service, which rules out adding a payment-processing surcharge on top of the Medicare-approved amount. The one narrow exception involves missed-appointment fees, and even that comes with conditions.

  • Medicare does not pay for missed appointments, so a provider may charge a beneficiary directly for a missed appointment only if the same charge and policy apply equally to Medicare and non-Medicare patients.
  • Missed-appointment charges must never be billed to Medicare itself; Medicare will deny any such claim, according to CMS MLN Matters CR5613.
  • A missed-appointment policy that applies only to Medicare patients, or charges Medicare patients a different amount than everyone else, falls outside this guidance and risks a compliance violation.
  • Violations of Medicare billing rules can lead to repayment demands, civil monetary penalties, denied claims, and in cases of repeated or knowing violations, exclusion from the program.

The equal-treatment requirement is the detail administrators miss most often. A missed-appointment fee is defensible under CR5613 guidance precisely because it treats every patient the same way; a credit card processing surcharge applied only to Medicare beneficiaries, or applied in a way that increases what they pay beyond the program's limiting charge, is not comparable and is not protected by this guidance. Review your scheduling and billing policies against this standard before applying any fee to a Medicare patient's account.

Checking state and local surcharge laws before you implement

State law is the layer most likely to change without notice, and it is the one Visa itself flags as incomplete in its own published guidance. Some states prohibit credit card surcharging outright; others permit it but add disclosure requirements or their own fee caps, and the list shifts as legislatures and courts act.

  • Verify your specific state's current surcharge law directly, since Visa's own published state list is explicitly non-exhaustive and subject to change, per Visa's merchant surcharge guidance.
  • Confirm the rule applies to your outlet's physical location, not your corporate headquarters, if you operate across multiple states.
  • Consult your acquirer and legal counsel before finalizing a program, since network permission and state permission are two separate checks.

San Francisco adds a local wrinkle worth knowing even outside direct surcharge law. The city's Health Care Security Ordinance lets employers impose an optional health care surcharge at their own discretion, but it comes with its own compliance burden: employers must file annual reporting on what was collected and spent, and any excess collected above what was spent on covered employees must be irrevocably spent on their health care within a set timeframe, according to San Francisco's HCSO administrative guidance. That is a distinct legal framework from patient-facing credit card surcharging, but providers operating in San Francisco should treat it as a separate check alongside state card-surcharge law, not a substitute for it.

Reviewing payor contracts before adding any fee

Even when card networks and state law both allow surcharging, a private payor's contract can override both. Commercial insurer agreements routinely include language that limits what a provider can collect from a member beyond the contracted rate, and surcharges fall squarely into that territory.

  1. Search the contract for explicit surcharge prohibitions, which are common in commercial payor agreements and typically appear near billing and collection clauses.
  2. Review assignment and limiting-charge language, since many payor contracts mirror Medicare-style caps on what a provider can collect directly from a member.
  3. Check billing and collection restriction clauses that govern how and when a provider may bill a patient for amounts beyond the contracted rate.
  4. Request written clarification from the payor when the contract language is ambiguous, and keep that written approval on file.

Legal commentary on this issue is consistent on one point: network rules and state law permitting surcharging do not automatically mean a payor's members can be surcharged, according to Burr & Forman LLP's analysis. If a payor contract is silent or unclear, document your inquiry and the payor's written response before rolling out any surcharge tied to that payor's members.

Building a compliant surcharge program step by step

Providers who confirm surcharging is legally available to them still need a clean operational rollout. The sequence matters: legal review comes first, technical configuration second, and patient communication last.

  • Complete legal and contract review across card network rules, state law, Medicare guidance, and every applicable payor contract before touching your point-of-sale configuration.
  • Notify your acquirer at least 30 days in advance and confirm your merchant account is configured to apply correct transaction messaging for the card networks you accept.
  • Post disclosures at point of entry and again at checkout, and itemize the surcharge as its own line on every receipt.
  • Keep at least one no-fee payment option available, such as cash, check, or ACH transfer, so patients are never forced into a surcharged transaction.
  • Configure your terminal or gateway to automatically detect and exclude debit and prepaid cards from any surcharge.
  • Build refund and dispute workflows that automatically reverse the surcharge portion whenever the underlying transaction is refunded.
  • Train front-desk and billing staff with a short script for explaining the surcharge and pointing patients to the no-fee alternative.

Pro Tip: Run a 30-day internal audit after launch to confirm debit and prepaid cards were never surcharged. This is the single most common compliance gap once a program goes live. Our healthcare payment processing best practices guide covers receipt formatting and disclosure placement in more depth.

What happens when a surcharge program goes wrong

Noncompliance carries real financial and operational consequences of every layer of the framework, and the penalties compound when more than one rule is broken at once.

  • Card networks can fine merchants directly or require acquirers to impose penalties, including fines reported in the range of $1,000 per identified violation in some cases, according to Visa's merchant surcharge Q&A.
  • Visa monitors compliance through complaint tracking and mystery shopping, meaning violations can surface well after a program has launched.
  • Operating in a state that prohibits surcharging exposes a provider to state consumer-protection enforcement or municipal penalties specific to that jurisdiction.
  • Medicare-specific violations can trigger claim denials, repayment obligations, civil monetary penalties, and, for repeated or knowing violations, exclusion from the program.

Taken together, these risks make a strong case for treating surcharge compliance as an ongoing governance task, not a one-time setup project.

Reducing processing costs instead of passing them to patients

Surcharging is one route to offsetting processing costs, but it is not the only one, and for many healthcare organizations it is not the simplest. We built Network Offset Pricing to pass through true wholesale interchange rates instead of flat-rate markups, which typically saves merchants 30-60% compared to major processors, reducing the pressure to recover costs from patients in the first place.

  • Audit your current processing fees against interchange-plus pricing to see where markup is hiding in your current rate structure.
  • Explore ACH and bank transfer options for recurring balances, which typically cost less per transaction than card processing.
  • Put a written governance policy in place for any patient-facing fee, surcharge or otherwise, so billing and compliance teams work from the same rules.

A fee-reduction audit is a lower-friction starting point than a surcharge rollout, since it touches your cost structure rather than your patients' bills. Our payment processing fees guide for healthcare providers breaks down where those costs typically originate.

Why governance matters more than the fee itself

Why governance matters more than the fee itself — overview diagram

The providers who get surcharging right are not the ones with the cleverest fee structure. They are the ones who treat it as a governance problem: a written policy, a standing schedule for reviewing payor contracts and state law changes, and a default toward transparency with patients at every step.

Surcharging rules change state by state and payor by payor, so a policy written once and never revisited is a policy that drifts out of compliance quietly. When a specific case is unclear, the right move is a conversation with legal counsel before a surcharge touches a single patient account, not after.

— PaySec Marketing Team

How we help healthcare organizations cut costs without surcharging patients

Paysec

Reviewing card network rules, state law, Medicare guidance, and payor contracts takes real time, and many healthcare organizations find it faster to close the cost gap on the processing side instead. Network Offset Pricing passes through true wholesale interchange rates with no hidden markups, and healthcare payment solutions are designed for providers managing patient billing alongside compliance requirements.

  • Network Offset Pricing eliminates flat-rate markups and shows the real interchange cost on every transaction.
  • ACH and recurring billing options give patients lower-cost ways to pay balances over time.
  • Pricing is transparent and does not require long-term commitments while evaluating potential savings.

If reducing processing costs looks like a better fit for your organization than a patient-facing surcharge, visit our healthcare payment processing page to see how the setup works, or check current pricing options to request a quote for your organization.

FAQ

What is a surcharge in health insurance?

A surcharge in a healthcare billing context is an added fee a provider charges on top of the service cost to cover credit card processing expenses, separate from the health insurance premium itself. It appears as its own line item on a receipt and applies only to the payment method, never to the medical service or insurance coverage.

What states can't surcharge?

Several states prohibit or restrict credit card surcharging, though the list changes over time and should be verified against current state law before implementation, per Visa's merchant surcharge guidance. Visa's own published list names examples such as Connecticut, Maine, Massachusetts, Oklahoma, and Puerto Rico, but Visa notes the list may be incomplete.

What does surcharge mean in insurance?

In billing terms, a surcharge is a fee added specifically to offset the cost of processing a card payment, distinct from any insurance premium, deductible, or copay. It is governed by card network rules, state law, and payor contracts rather than by insurance regulations themselves.

Can Medicare beneficiaries be charged a surcharge?

No. Medicare's limiting-charge rules prevent providers from collecting more than the program-approved amount from a beneficiary for covered services, which rules out a processing surcharge. The narrow exception is a missed-appointment fee, which is allowed only if applied equally to Medicare and non-Medicare patients and never billed to Medicare, according to CMS MLN Matters CR5613.

Can providers surcharge debit or prepaid cards?

No. Card network rules prohibit surcharging debit and prepaid cards under any circumstance, regardless of state law or payor contract terms. Providers should configure their point-of-sale systems to automatically exclude these card types from any surcharge program.

Sources

Before implementing any surcharge, review Visa's merchant surcharge Q&A, CMS MLN Matters CR5613, San Francisco's HCSO guidance, and Burr & Forman's legal analysis, then confirm your plan with counsel and your acquirer. For general small-business context on surcharge mechanics, see this compliance overview.