Integrated programme
PCI DSS, SOC 2 and HIPAA together: what US healthcare and payments clients ask for: video
A film on the three frameworks US healthcare and payments clients ask service providers for most, and how one control set prepares for all of them.
Key takeaways
- None of the three is an ISO certification.
- SOC 2 is attested by a licensed CPA firm; PCI DSS is validated by a QSA or self-assessment.
- HIPAA compliance is documented and demonstrated, with no certificate.
- One control set maps card data requirements, Trust Services Criteria and HIPAA safeguards.
- Plan the PCI DSS assessment, SOC 2 period and HIPAA risk review together.
The three US clients ask for most
Service providers to US healthcare and payments clients are typically asked for three things: a SOC 2 report, PCI DSS compliance and HIPAA safeguards. None of them is an ISO certification. The SOC 2 report is an attestation issued only by a licensed US CPA firm; PCI DSS compliance is validated by a Qualified Security Assessor or through the self-assessment route the acquirer accepts; and HIPAA compliance is documented and demonstrated, because the law has no certificate.
This short film walks through how one control set prepares a provider for the QSA and the CPA firm while building the HIPAA documentation clients expect.
The combination fits providers to US healthcare and payments clients, who typically ask for exactly these three.
None of the three produces a certificate: PCI DSS is validated by a QSA or self-assessment, SOC 2 is a CPA firm's attestation report, and HIPAA obligations follow the protected health information through business associate agreements.
One evidence base for the QSA, the CPA firm and HIPAA
The programme maps card data requirements, the SOC 2 Trust Services Criteria and the HIPAA safeguards to one control set, with the cardholder data environment and health data scoped deliberately. Whether PCI DSS needs a Report on Compliance or a self-assessment questionnaire is confirmed from the provider's level before the plan is fixed, and the SOC 2 report type is chosen to match client requests and deadlines.
One evidence base then serves the QSA, the CPA firm and the HIPAA documentation, and the PCI DSS assessment, the SOC 2 report period and the HIPAA risk review sit on one calendar. The outcome is a set of documents ready for US healthcare and payments procurement, without three separate projects competing for the same engineers.
Sterling prepares the controls, evidence and SOC 2 system description with one engagement team in a shared Effivity workspace, for one agreed fee. It never issues the SOC 2 report and does not validate PCI DSS itself.
PCI DSS at a glance
- Purpose
- Protection of payment card account data wherever it is stored, processed or transmitted, through twelve requirements validated every year
- Relevant to
- Merchants, service providers, BPOs, payment facilitators, hosting and software providers: anyone who handles cardholder data or can affect its security
- Version
- PCI DSS v4.0.1 (June 2024); v4.0 was retired on 31 December 2024 and the formerly future-dated requirements have been mandatory since 31 March 2025
- Validation
- Assessed by a PCI SSC-qualified QSA (Report on Compliance and Attestation of Compliance), or by self-assessment questionnaire where your acquirer and the card brands allow it; quarterly ASV scans where they apply
- Sterling's role
- Scoping, gap analysis, remediation with your team, Effivity, training, internal assessment and QSA readiness, then Sustain™ through every annual cycle
- Cost and timing
- Total investment for PCI DSS compliance depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 9 months
PCI DSS: questions people ask
Is PCI DSS a certification?
No. There is no PCI DSS certificate and no certification body. Compliance is validated at least annually, by a Qualified Security Assessor who produces a Report on Compliance and signs an Attestation of Compliance, or by a self-assessment questionnaire with its own AOC where your acquirer and the card brands allow it.
Do we need a QSA, or can we self-assess?
That depends on your merchant or service-provider level, which the card brands define by annual transaction volume, and on what your acquirer or customers require. The largest merchants and most service providers are assessed by a QSA; many smaller merchants and some service providers may self-assess. Some brands also accept a Report on Compliance completed by a trained Internal Security Assessor on your staff, where the acquirer permits it.
Which self-assessment questionnaire applies to us?
The PCI Security Standards Council publishes SAQs for different payment environments: SAQ A and SAQ A-EP for e-commerce and mail or telephone order merchants that outsource card data functions to differing degrees; SAQ B and SAQ B-IP for imprint and standalone terminal environments; SAQ C and SAQ C-VT for payment application and virtual terminal environments; SAQ P2PE for validated point-to-point encryption; SAQ SPoC for approved software-based PIN entry; SAQ D for merchants who fit none of the others; and SAQ D for service providers, the only SAQ open to them. Eligibility criteria are strict; your acquirer has the final word.
Are the PCI DSS v4.0 future-dated requirements now mandatory?
Yes. They were best practice until 31 March 2025 and have been required in every assessment since, under PCI DSS v4.0.1, the only active version since v4.0 was retired on 31 December 2024.
How can we reduce our PCI DSS scope?
By keeping card data out of your systems: hosted payment pages or redirects, tokenisation, validated point-to-point encryption, agent-assisted payment tools in the contact centre, and outsourcing to providers with a current AOC; what remains is isolated with tested segmentation. Reducing scope does not remove PCI DSS: an e-commerce merchant eligible for SAQ A still has requirements to meet, including quarterly ASV scans of the systems hosting its payment page or redirect.
Keep exploring
Related to this video
The complete guide
Everything on PCI DSS
Start with the PCI DSS page · SOC 2 · HIPAA, or go straight to the guide you need.
On the PCI DSS page
Guides
- The PCI DSS annual cycle
- PCI DSS assessor questions
- PCI DSS in Australia
- PCI DSS checklist
- Choosing a QSA
- PCI DSS common mistakes
- PCI DSS compensating controls and the customised approach
- PCI DSS compliance cost
- Do you need PCI DSS
- PCI DSS documentation
- Effivity for PCI DSS
- PCI DSS gap analysis
- PCI DSS implementation plan
- PCI DSS in India
- PCI DSS internal audit and the ISA
- PCI DSS in the Netherlands and Europe
- PCI DSS payment page scripts
- PCI DSS vs ISO/IEC 27001 and SOC 2
- PCI DSS v4.0.1 requirements explained
- PCI DSS scoping and segmentation
- PCI DSS in Singapore and South East Asia
- PCI DSS for small merchants and start-ups
- The PCI DSS assessment
- PCI DSS in the Philippines
- PCI DSS in the UK
- PCI DSS timeline
- PCI DSS training
- PCI DSS in the UAE and GCC
- PCI DSS v4.0.1
- PCI DSS validation step by step
- How to verify a PCI DSS AOC and check a provider's compliance
- Which SAQ applies to you
By industry
More videos: Integrated programmes
- SOC 1 and SOC 2 together: two reports, one control environmentIntegrated programme · 3 min 5 s
- ISO 9001, ISO 14001 and ISO 45001 together: one QHSE systemIntegrated programme · 3 min 14 s
- ISO 9001 and ISO 45001 together: quality and safety in one systemIntegrated programme · 3 min 14 s
- ISO 9001 and ISO/IEC 27001 together: quality and information security in one systemIntegrated programme · 3 min 14 s
- ISO 9001 and HACCP together: quality management with a food safety plan built inIntegrated programme · 3 min 14 s
- HACCP and GMP together: the prerequisites and the plan, built as oneIntegrated programme · 3 min 14 s
- ISO/IEC 27001 and PCI DSS together: one control set, two outcomesIntegrated programme · 3 min 24 s
- ISO/IEC 27001 and SOC 2 together: one control set for every marketIntegrated programme · 3 min 24 s
- ISO/IEC 27001, PCI DSS and SOC 2 together: one control set, three outcomesIntegrated programme · 3 min 24 s
Talk to a consultant
Plan your PCI DSS compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice