At the very least, it could be a serious violation of 2 PCI regulations and you are probably subject to PCI regulations because you allow patients and other customers to pay with credit cards.Please see items #3 and #10 in the following for the regulation areas that most offenders end up breaking.