PCI DSS and HIPAA together: patient payments and health data, protected as one: video

Card data and health data, side by side

Healthcare providers, billing companies and patient-payment services handle payment card data and protected health information side by side. PCI DSS governs the cardholder data environment and is validated every year, by a Qualified Security Assessor or through the self-assessment questionnaire the acquirer accepts, depending on the level the card brands and the acquirer set. HIPAA's Security Rule sets the safeguards for electronic protected health information; HIPAA is a US law, and no government body certifies compliance with it.

Neither framework is a certification, which makes documented, demonstrable controls all the more important. This short film walks through how one set of controls serves both.

Healthcare providers, billing companies and patient-payment services are the organisations that most often handle both data types side by side.

Neither outcome is a certificate: PCI DSS compliance is validated at least annually by a QSA or a self-assessment questionnaire, and HHS does not recognise any private certification of HIPAA compliance. The business associate agreement sets out how protected health information is handled.

One set of controls, each data type scoped deliberately

Access, logging, encryption, vulnerability and incident controls are built once to meet both frameworks. Card data and health data are segmented so each requirement applies only where it must, which keeps the scope, and the effort, as small as possible. The HIPAA risk analysis, policies, training and business associate agreements are prepared alongside the PCI DSS evidence, ready for clients and assessors.

The PCI DSS assessment and the HIPAA risk reviews can then be planned together. Because the controls are written once, the organisation also has room to grow: ISO/IEC 27001 or SOC 2 can be added later on the same controls when clients ask for a certificate or an attestation report, without rebuilding what is already in place.

Sterling runs the programme with one consultant in Effivity in one all-inclusive proposal. The QSA or the acquirer's process validates PCI DSS, and HIPAA compliance is judged by the regulator and customers' auditors; Sterling prepares the controls and the evidence.