Can a Doctor’s Office Charge Your Card Without Permission?

A doctor’s office can charge your card without permission only in a narrow sense: if you previously signed a card-on-file or patient financial agreement, that signature is the permission, and the office can legally charge the card later without calling or emailing first. Without a signed authorization that covers the specific charge, the transaction is unauthorized and you have federal remedies to get the money back. Almost every dispute over a surprise medical charge comes down to what the intake paperwork actually says.

Where the “Permission” Usually Comes From

New-patient intake packets typically include a credit card authorization or patient financial agreement tucked among privacy notices and insurance forms. Signing it gives the office ongoing permission to charge your card for whatever your insurance doesn’t cover, including deductibles, co-insurance, and co-payments determined after the claim is processed.

That is why a charge can appear weeks after the visit. Your appointment may have been in March, but the insurer might not finalize your share until May. When the balance lands, the office runs the card on file. You already consented, so no call is required.

The terms vary. Some agreements set a dollar cap and require verbal approval for anything above it. Others contain no cap at all. Under the HIPAA Privacy Rule, you can revoke an authorization you previously gave, and the revocation process must be described in the authorization form or the provider’s Notice of Privacy Practices.¹ Until you submit that revocation in writing, the authorization stays in effect, sometimes for years after your last visit.

When the Charge Is Actually Unauthorized

The clearest case is that you never signed a card-on-file agreement at all. If you handed over your card for a single co-payment and nothing more, any later charge to that card lacks authorization.

Even with a signed agreement, a charge can be improper if it steps outside the agreement’s terms. If the form promises advance notice before a payment is processed and the office skips that step, the charge is disputable. If the agreement covers only post-insurance balances but the office runs a missed-appointment fee through the same card, that fee wasn’t within the scope of what you authorized.

Incorrect amounts, duplicate charges, and charges for services you never received are problematic regardless of what you signed. And if the authorization language was buried in a way designed to prevent you from noticing it, the validity of the whole agreement is open to challenge. The Federal Trade Commission treats hidden fees and deceptive billing disclosures as unfair business practices.

Get the Paperwork Before You Argue

Before disputing anything, look at what you signed. Federal law gives you the right to inspect and obtain copies of your billing records held by any provider covered by the HIPAA Privacy Rule, and that includes financial records, not just clinical notes.² A provider cannot refuse copies because you haven’t paid your bill. They may charge a reasonable, cost-based fee for copying, supplies, and postage, but not for searching or retrieving records.³

Then call the billing department. Keep the tone cooperative; a lot of these situations turn out to be clerical errors or a timing mismatch between the insurer’s payment and the office’s billing cycle. Ask for two specific things:

A copy of the signed authorization the office believes permits the charge. If they can’t produce one, your dispute just got much stronger.
An itemized statement showing every service and fee in the charge. Compare it against your insurer’s explanation of benefits.

Document the date, time, and name of every person you speak with. If they acknowledge the error, ask for written confirmation and a refund timeline. If they insist the charge was proper and you disagree, escalate to your card issuer.

Disputing the Charge on a Credit Card

The Fair Credit Billing Act defines a “billing error” to include a charge that was not made by you, was not in the correct amount, or was for goods or services never delivered as agreed.⁴ A charge you never authorized fits that definition.

To preserve your rights, notify the card issuer in writing within 60 days of the date the first statement showing the error was sent to you.⁴ Most issuers also take disputes through their online portal or by phone, but a written letter creates the strongest paper trail. Include the transaction date, the amount, why the charge is unauthorized, and what you already did to resolve it with the provider.

Once the issuer receives your dispute, it must acknowledge the complaint in writing within 30 days and resolve the investigation within two full billing cycles, not to exceed 90 days. While the investigation is open, you are not required to pay the disputed amount, and the issuer cannot report your account as delinquent or close it over the unpaid charge.⁴ Card networks add their own layer on top. Mastercard’s zero-liability policy, for example, covers unauthorized purchases in stores, over the phone, online, or through a mobile device, provided you used reasonable care with the card and reported the problem promptly.⁵

If You Signed the Authorization but the Charge Is Still Wrong

Sometimes the card was on file legitimately, but the specific charge is inflated, covers a service you didn’t agree to, or ignores the office’s own billing procedure. Federal law lets you assert claims and defenses against your card issuer for the underlying transaction if the charge exceeds $50 and you first made a good-faith attempt to resolve it with the provider.⁶ This is separate from the billing-error process and covers disputes over the transaction itself rather than the fact of the charge.

If the Office Charged a Debit Card

Debit cards carry meaningfully weaker protection, and the clock runs faster. Under the Electronic Fund Transfer Act, your maximum liability for an unauthorized debit transaction depends on how quickly you report it:

Within 2 business days of learning of the loss: liability capped at $50, or the amount transferred before you notified the bank, whichever is less.⁷
Between 2 and 60 days: liability can rise to $500.⁷
After 60 days from the statement showing the transfer: you could be responsible for the full amount of unauthorized transfers occurring after the 60-day window closes.⁷

The practical difference from a credit card: with a debit card, the money leaves your account immediately, and you may be out the cash while the bank investigates. The burden of proof falls on the bank to show the transfer was authorized, but that protection erodes the longer you wait.⁸ If a doctor’s office has your debit card on file, check your bank statement within days, not weeks.

Stopping Future Charges

To prevent another surprise, submit a written revocation of the card-on-file authorization to the office. Revocation takes effect when the provider receives it, not when you send it.¹ Certified mail or a signed acknowledgment from the office removes any ambiguity about the date.

Revoking the authorization doesn’t erase any balance you actually owe. The office can still bill you by paper invoice, offer a payment plan, or send the account to collections. What it removes is the office’s ability to charge your card without contacting you. Some offices will ask you to sign a new authorization at your next visit, and you can decline or negotiate terms, such as a dollar cap or a requirement for advance notice before any charge is processed.

When the Office Won’t Back Down

If the card dispute doesn’t resolve the issue, or if the debit-card reporting windows have already closed, you still have options. A complaint filed with your state attorney general or consumer protection agency puts the practice on notice and builds a record other patients may benefit from. Most state AG offices accept complaints online.

For smaller amounts, small claims court is a practical route. Filing limits vary by state but generally fall between $2,500 and $10,000, which covers the vast majority of medical billing disputes. Attorneys usually aren’t required and filing fees are low. Bring the signed authorization form (or proof that one doesn’t exist), the itemized bill, your explanation of benefits, and any correspondence documenting your attempts to resolve the charge directly.

1
HHS.gov. Can an Individual Revoke His or Her Authorization
2
U.S. Department of Health & Human Services. Your Medical Records
3
eCFR. 45 CFR 164.524 – Access of Individuals to Protected Health Information
4
Office of the Law Revision Counsel. 15 USC Chapter 41, Subchapter I, Part D – Credit Billing
5
Mastercard. Mastercard Zero Liability Protection Policy
6
Office of the Law Revision Counsel. 15 USC 1666i – Assertion by Cardholder Against Card Issuer
7
Consumer Financial Protection Bureau. Regulation E – 1005.6 Liability of Consumer for Unauthorized Transfers
8
Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability