Credit Cards are always a tricky aspect of private practices. As this is a relatively new thing for practitioners, they're unsure how to do it properly. So we're writing a bit of a mini cheat sheet for you.
Have a cybersecurity plan in place. What happens if a team member writes the credit card details down in their notebook, they take that notebook home and lose it on the train? What is your protocol? If you feel that isn't feasible, think about aspects of your practice that have a weakness and write your cybersecurity plan around your perceived shortcomings. This plan should include in-depth training for your team members.
Use a system that stores the details securely. If you are still using a paper and pen(cil) diary, then news flash, this isn't an appropriate system to store credit card details. Systems like Power Diary allow integration with stripe, which means your credit card details are stored securely. If your clients are required to write their numbers down for you (say on their new client information sheets) then you have a plan to ensure these details are scanned into the system and the information is shredded.
Encryption, Encryption, Encryption If (for some reason?!) you are recording your phone calls, you're using google drive, one drive, Dropbox, any cloud system that you have encryption set up. None of this matters though if your staff leave for the bathroom and neglect to turn their computer on the "lock" screen.
Lastly, we encourage you to do an audit. Every quarter you should be testing the systems that you have in place, reviewing for weaknesses and assessing any changes that need to occur. With the new health data breach regulations, we need to stay on top of our own policies and procedures in private practice.
If you're a member of our Private Practice Academy, read our article on Cyber Security.
