We board and groom. What about the point of sale and the deposits?

Boarding, grooming and retail sit awkwardly in a lot of clinics. Sometimes they are modules of the practice software, sometimes a separate booking system bought by whoever runs that side, and occasionally a card reader on the counter that nobody thinks of as IT at all.

What matters from our side:

• One system is better than three. If your practice software handles boarding and grooming adequately, using it saves you a second vendor, a second login for staff, a second set of customer records that disagree with the first, and a second thing to secure. It is worth checking what your existing software does before buying something separate.
• Card processing brings PCI obligations wherever it happens. That is true of the reader at the boarding counter as much as the main one. The practical answer for a clinic is the same as for any small business: use a modern reader where the card data never reaches your computers or your network, so the scope of what you have to worry about shrinks dramatically. If you are keying card numbers into a computer, or worse writing them on a deposit form, that should change.
• Deposits and no shows mean stored payment details. Boarding deposits especially. Storing card details yourself is a genuinely bad idea. Your payment processor can store them on their side and give you a token, which is the right way to do it and is usually a setting rather than a project.
• The boarding counter is often the weakest computer in the building. Oldest machine, shared login, sometimes still running something nobody has updated. It handles payments and customer data, so it should not be the afterthought it usually is.

Practical thing to check this week: walk to the boarding counter and see whether the computer is logged in as a shared user, whether the screen locks, and whether anyone has written a card number on anything. That five minute walk finds more real risk than most security assessments.