The Ethics of Keeping Card Information on File
Professional ethic codes outline circumstances and requirements of payments. When these circumstances are defined, communicated to patients and agreed to by both parties, the practice is ethical and a good business policy. 

Define Charges
Let patients know when charges occur and what they will be. Spell out the terms – services delivered, no-show fees, deductibles, money owed and so on. People are willing to pay for valuable services when the terms are reasonable, thought out, and presented well.  

Informed Consent
Practices keeping card information should get permission to do so, in writing, by the cardholder. It protects everyone and mitigates the risk of chargebacks. 

Communicate Convenience
Maintaining cards on file means office managers can bill on their own time. It also removes the invasive process of running a card or handling checks at the session time. It’s easier for the business and the patient. 

Security
PCI (security measures accepted by the payment card industry) is, in many ways, similar to HIPAA (just for credit card data, rather than patient data). PCI requires much the same risk management process but also requires (or strongly encourages) specific security protocols. At the very least, credit card information is never stored at the office or on local machines. Rather, data is encrypted and kept off-site – accessible but private so the card may be changed, yet office managers never see the card information.