Payment Processing for Telehealth Providers in San Jose and Silicon Valley

Telehealth providers payment processing in San Jose and Silicon Valley has a specific texture because the companies here are rarely a single doctor with a Zoom link. They are venture-backed platforms in Palo Alto and Mountain View building virtual primary care, behavioral health apps out of downtown San Jose, men's and women's health brands shipping prescriptions from Sunnyvale, and physician groups near Stanford, Valley Medical and Good Samaritan extending their practices online. The card networks and the underwriters do not care about the pitch deck; they care about what is being sold, to whom, and how it renews.

What you sell determines your MCC and your risk tier

There are really three telehealth businesses hiding under one label:

• Consultations only (MCC 8011, 8099 or similar): a licensed clinician sees a patient by video and bills per visit or takes copays. This is close to standard risk. Disputes are rare and usually about billing errors.
• Membership and subscription care: a monthly fee for unlimited messaging and visits. Now you are a recurring card-not-present merchant, and the underwriter cares about the cancel flow and the chargeback ratio.
• Consult plus prescription fulfillment: hair loss, weight management, sexual health, hormone therapy. The pharmacy side is MCC 5912 and the networks require specific registration for online pharmacies; the combination is treated as elevated risk, and drugs with abuse potential or compounded GLP-1 products get extra scrutiny.

Describe your model precisely on the application. "Virtual dermatology, per-visit fees, prescriptions sent to the patient's own pharmacy" is a different account from "subscription weight-loss program with compounded medication shipped monthly."

Who is the merchant of record

California's corporate practice of medicine doctrine restricts non-physician entities from practicing medicine or employing physicians to do so, which is why most Silicon Valley telehealth platforms use a management services organization paired with a professional corporation owned by physicians. The underwriter needs to understand which entity is the merchant of record for clinical fees and which is collecting platform fees, because the two may need separate merchant accounts and the descriptor on the patient's statement must match the entity that provided the service. Get your corporate structure diagram ready; a good underwriter will ask for it, and the Medical Board of California has published guidance you and your counsel should review.

HIPAA meets PCI

You are holding protected health information and cardholder data at the same time, and the two regimes reinforce each other. Practical rules:

1. Never store card numbers in the EHR or the app database. Vault them through the processor using tokenization so your systems hold a token, not a PAN.
2. Use hosted fields in your checkout so card entry happens in the processor's iframe, keeping your web app out of most of PCI scope.
3. Keep the statement descriptor generic. "Acme Health" rather than "Acme Erectile Dysfunction Clinic" both protects the patient and reduces the embarrassment-driven "I did not make this charge" dispute.
4. Sign a business associate agreement only where a vendor actually touches PHI; the processor generally sees name, card and amount, not diagnoses.

Subscriptions under California law

Membership-based care is a subscription, and the Automatic Renewal Law applies: clear terms before consent, affirmative consent, an acknowledgment with cancel instructions, and cancellation as easy as sign-up. Card-network rules add a pre-renewal reminder for trials and a requirement that the descriptor be recognizable. SB 478 requires the advertised membership price to include mandatory fees, so a "$49/month" plan with a mandatory "platform fee" is a problem. Build the consent screen and the cancel button before the growth team starts running ads, because the disputes from a bad flow arrive in months two and three and push you toward the 0.9%-1% ratio that puts accounts into monitoring.

Insurance, HSA cards and patient balances

Practices that take insurance also collect patient responsibility after adjudication, often weeks later, by card on file. Get written consent to charge the card for the adjudicated balance, cap it, and send the EOB-linked receipt. HSA and FSA cards are debit cards with IIAS restrictions; for telehealth they generally work for qualifying medical services, and your MCC affects whether they are approved at all. If you sell non-medical products on the same site (supplements, skincare), those should not be run against an HSA card, and mixing them on one MID can cause problems. Where balances are large, ACH at 1-3 business day settlement is cheaper than cards for payment plans.

Silicon Valley specifics

Local telehealth companies often serve tech employees through employer benefits and process a large share of corporate or benefit-card payments, which changes interchange. Many serve Spanish- and Vietnamese-speaking populations in East San Jose and the South Bay and need bilingual consent and receipt templates. And venture-scale volume growth is itself an underwriting event: a jump from $50,000 to $2 million a month without warning looks like a compromised account. Tell your processor before you scale.

The telehealth companies in the Valley that avoid payment problems treat the merchant account like they treat the clinical license: something you set up carefully, keep documented, and do not change without telling the regulator. In this case the regulator is the acquirer, and it wants the same thing the Medical Board does: a clear picture of who is treating the patient and who is charging the card.