Complete Home Care, Inc.

To whom it may concern; 9/8/2015On 7/29/*** *** *** came into our office for some medical equipmentOne requirement of our office is to collect all co-pay amounts due at time of service*** ***'s deductible had not been met, and he had asked if we could not
charge his credit card until we find out for sure if it had been met. *** *** signed a credit card authorization agreement allowing us to automatically debit his credit card on the th of the monthOn the agreement it states to verify if the customer deductible has been met before we process the paymentOur respiratory therapist did call to verify if the deductible had been met and was told it had been, but she did not realize that it had posted to our claim at blue cross blue shield which caused the balance of the copay to include the deductibleSo the billing department was told the deductible had been met and to only charge the credit card the $42.92, which was done on 8/20/Below you will see where we came up with all our figuresIt does not state anywhere to notify the customer before running the credit card just to verify if deductible had been met which was done.Total co-pay if deductible not met would have been $*** *** paid $cash towards his balance on 7/29/which brought his balance due to $When the insurance company said his deductible had been met this brought his balance down to $We offer a 10% discount when a customer pays their co-pay in fullWe gave him a 10% discount which then brought his balance down to $This is where some confusion came into play because of the $cash payment one of our associates saw the $and that's what ended up being charged on 8/When *** *** called Katie on 08/27/she explained that there was a posting error and his balance due was going to be $and he will have paid in fullHe was content with this and said it was okay to charge his credit card on the 20th of SeptemberThis is when *** *** called and was questioning how we store all our credit card information.We are a paperless company and all our paperwork is scanned and stored on a password protected server including our credit card informationOnce the paperwork is scanned and filed all the original paperwork is shredded and destroyedWhen Katie told the customer that she had the credit card information it was because Katie has access to our password protected serverWhen I said we do not have the credit card I was talking about the original credit card agreement.Sincerely,*** ***Billing Supervisor###-###-#### Ext ***

Revdex.com:
I have reviewed the response made by the business in reference to complaint ID [redacted], and have determined that this does not resolve my complaint.  For your reference, details of the offer I reviewed appear below. If you’re storing the data via hardcopy, you’ll need to review and follow PCI DSS Requirement 9. In order for the electronic storage of cardholder data to be PCI compliant, appropriate encryption must be applied to the PAN (primary account number). In this situation, the numbers in the electronic file should be encrypted (either at the column level, file level or disk level).Additionally, all other PCI controls would apply to the environment in which the cardholder data is transmitted and stored. This includes, but is not limited to, appropriate access control, network security parameters, physical security parameters and periodic security testing, such as penetration testing and vulnerability scanning. Alternatively, tokenization can be implemented for recurring and/or delayed transactions to help reduce or eliminate the need for electronically stored cardholder data while still maintaining current business processes. The simple question was are you PCI compliant abs are we protected. With receiving the answer that company did not have to provide information to us the consumer, we considered this to be suspicious and therefor ask all our Cristy card out credit card information be remove and payment sent via money order. We continue to monitor activity to our account for misuse and complaint was basically to make other aware of company's stance on PCI complaince and hopefully the CFPB catches up with them if there is a gap in process. Meanwhile all transactions will be cash or money order from us going  forward.The best thing they can do for the business is to not store any cardholder data or personally identifiable information (PII) at all. 
Regards,
[redacted]