ISO/IEC 27001, PCI DSS and HIPAA together: card data and health data under one control set: video

Two sensitive data types, three frameworks

Healthcare BPOs and service providers that take patient payments handle two kinds of sensitive data: payment card data and protected health information. That brings three frameworks into play. ISO/IEC 27001 provides the information security management system and the certificate, PCI DSS governs the cardholder data environment and is validated each year, and the HIPAA Security Rule sets the safeguards for electronic protected health information.

Each has its own outcome and its own judge, and HIPAA has no certificate at all: it is a US law, demonstrated through documented compliance. This short film walks through how one programme brings the three together without blurring those differences.

Keeping the two data types apart by design is what stops each framework's scope from spreading across the whole environment.

Keeping card data out of systems through hosted payment pages, tokenisation or validated point-to-point encryption reduces the PCI DSS scope before any control is built.

Scoping card data and health data deliberately

Card data and health data are scoped and segmented deliberately, so each framework applies where it should and no further. Each safeguard is then written once and mapped to ISO/IEC 27001 Annex A, the PCI DSS requirements and the HIPAA administrative, physical and technical safeguards. Whether PCI DSS validation needs a Qualified Security Assessor's Report on Compliance or a self-assessment questionnaire depends on the level the card brands and the acquirer set, and that is confirmed before the plan is fixed.

The same evidence then serves the certification body, the PCI DSS assessment and the HIPAA documentation. Surveillance audits, PCI DSS assessments and HIPAA risk reviews are planned together on one calendar. No single audit can cover all three, because the outcomes come from different parties under different rules, but one evidence base can serve them all.

A single Sterling engagement team runs the programme in Effivity under one all-inclusive proposal, preparing the organisation for each outcome without certifying, assessing or attesting any of them.