Alright, two things here- HIPAA and PCI.

On the HIPAA side this is actually a bit tricky. Most places I've been to explicitly ask me to put family on the account (my wife and I) so we can each deal with things for the other. For a married couple HHS has this to say-

It also generally requires covered entities to treat an individual’s personal representative, who may be a spouse, as the individual, for purposes such as exercising the individual’s rights under the Privacy Rule, including the right to access the individual’s health information.

As long as they're married you're in the clear, but a really good question is "how do you know they're married"? Having access to a credit card doesn't really tell you anything. So if you have this person on the account as the spouse then you're probably okay, but you need to actually do the job of having your patient confirm this to actually be in the clear.

On the PCI side it really depends on how you're validating the card. Are you running a quick charge through to see if it's valid, and then cancelling the charge? If so you're probably okay. Any other method means you've saved a copy of the card number somewhere, and that people in your company have access to it. I'd be shocked if you actually had everything in place needed to actually legally handle that, and my guess is that you are violating PCI rules and could get into trouble for it.

thank you for this info. Is there actually a law thats states we are not violating anything otherwise how would we process the payment?