PCI DSS by industry
PCI DSS for healthcare: hospitals, clinics, pharmacies and insurers taking card payments
What changes when card payments meet patient data: why hospitals, clinics, pharmacies and insurers must validate, how card data drifts into clinical and claims systems, where assessors sample, and how PCI DSS sits beside HIPAA.
Key points
- A hospital, clinic, pharmacy or insurer that takes cards at a cashier, a billing desk, a portal or for premiums is a merchant, and its acquirer decides how it validates.
- The hardest healthcare scope problem is card data drifting into clinical and administrative systems: patient accounts, claims notes, call recordings, scanned forms and e-mail.
- Billing outsourcers, portal vendors and payment providers handling card data for you are service providers whose AOCs you must hold and review yearly.
- HIPAA and PCI DSS protect different data under different authorities. One access model, one logging set-up and one evidence calendar can serve both, but neither result stands in for the other.
Why PCI DSS applies to hospitals, clinics, pharmacies and insurers
Most healthcare organisations take cards every day: deposits at admission, self-pay settlements at the cashier, pharmacy sales, portal balance payments, payment plans agreed by phone with the billing office and premiums collected monthly by card. Each channel makes the organisation a merchant under the card brands' rules.
The demand arrives through the merchant agreement: the card brands set your merchant level from annual transaction volume, and your acquirer confirms whether it expects a QSA's Report on Compliance or a self-assessment questionnaire. Health systems and insurers that outsource billing or collections must also monitor those providers under requirement 12, so billing firms are asked for their Attestation of Compliance. The standard and its validation are explained on the PCI DSS hub.
PCI DSS scope in a healthcare organisation
The cardholder data environment typically holds the terminals at admissions, outpatient and pharmacy counters and their network segments, the workstations used for phone payments, the portal's payment page and its scripts, and any system keeping card numbers for recurring premiums or payment plans, plus anything with unrestricted connectivity to them.
Three mistakes recur. A flat hospital network puts terminals on the same segments as clinical workstations, imaging devices and guest Wi-Fi, dragging the whole estate into scope. Card numbers get written into systems built for health data: free-text fields in patient accounts or claims, scanned billing forms and collections spreadsheets. And spoken card details from phone payments land in call recordings and agents' notes. Requirement 3 forbids keeping sensitive authentication data, such as the card verification code, after authorisation, so a recording that holds it is a finding, not a filing question.
The quickest reductions are usually validated point-to-point encryption at the counters, a hosted payment page from a compliant provider for the portal, and tokenisation for stored card details. See PCI DSS scoping and segmentation: shrinking the CDE and Which SAQ applies to you: eligibility explained.
Where the PCI DSS requirements bite for healthcare
| Requirement area | What it means in a hospital, clinic, pharmacy or insurer | Evidence the assessor samples |
|---|---|---|
| 3 Protect Stored Account Data | Card numbers kept only where recurring premiums or payment plans need them, never in patient records, claims notes or recordings | A data discovery scan of patient accounting and document systems, the retention rule with purge records, tokenisation or masking evidence |
| 4 Protect Cardholder Data in Transmission | Billing and member services staff never take card numbers by e-mail, chat or text, however urgent the request | The written rule, training records for billing staff, how card numbers received by e-mail are handled and deleted |
| 9 Restrict Physical Access to Cardholder Data | Terminals at busy, often unattended admissions desks and pharmacy counters protected from tampering and substitution | A device inventory by location, periodic inspection records, front-desk training on suspicious behaviour |
| 6 and 11 Payment page security | The patient or member portal's payment page and the scripts it loads, often from a portal vendor | A script inventory with authorisation and integrity checks, tamper detection alerts, quarterly ASV scans where they apply |
| 12 Third-party service providers | Billing outsourcers, collection agencies, portal vendors and payment providers that handle or can affect card data | A provider register, current AOCs, a responsibility matrix for each, annual monitoring records |
Every requirement is set out in PCI DSS requirements explained, requirement by requirement.
PCI DSS alongside HIPAA and health data protection
For US health plans, providers and their business associates, HIPAA governs protected health information and is enforced by the HHS Office for Civil Rights. PCI DSS governs card data and is enforced contractually by the acquirer and the card brands. A patient bill paid by card carries both.
They share machinery: unique user IDs, multi-factor authentication, access reviews, central logging, encryption, incident response and vendor oversight, built once with one evidence calendar. They still end in separate results: a HIPAA risk analysis does not answer the assessor's questions, and an AOC tells a regulator nothing about PHI. Outside the United States, the local data protection law takes HIPAA's place for patient data. See HIPAA for healthcare providers and clinics, HIPAA for health plans and third-party administrators and PCI DSS vs ISO/IEC 27001 and SOC 2.
What a healthcare PCI DSS engagement looks like
Duration depends on the payment channels and sites, how flat the network is, how much card data has leaked into patient and claims systems, and how quickly outsourcers produce their AOCs. The revenue-cycle head, IT and security, admissions, pharmacy and billing supervisors, the portal owner and the outsourcing contract owner must be involved. With Design™ your team owns the work under Sterling's guidance; with Drive™ Sterling carries more of it so front-line teams keep serving patients.
How Sterling works with healthcare providers and insurers
Take card data out of the clinical estate, then prove the rest is controlled.
Our expert and experienced consultants trace every patient and member payment channel, find card data where it should not be, shrink the scope with your IT team, align controls with your HIPAA or local privacy programme and keep evidence in Effivity, included with the engagement at no additional cost. Sterling does not validate compliance; the QSA assesses and attests. We ensure successful validation for our clients.
Book a free discovery callPCI DSS for healthcare: questions buyers ask
Does PCI DSS apply to hospitals?
Yes, if the hospital accepts payment cards for any service, deposit or pharmacy sale. It is then a merchant, and its acquirer decides whether it validates with a self-assessment questionnaire or a QSA's Report on Compliance.
Is it a PCI DSS problem if our billing office call recordings capture card details?
Yes. Card verification codes are sensitive authentication data and must not be kept after authorisation, so recordings holding them are a finding. The usual fix keeps card entry out of the agent's hearing and the recording, which also shrinks scope.
Does HIPAA compliance cover PCI DSS for a healthcare provider?
No. HIPAA protects health information and PCI DSS protects card data, under different authorities. Many controls can be shared, but the acquirer still expects its SAQ or ROC with an AOC.
We outsource patient billing and collections. Who is responsible for PCI DSS?
Both of you. The outsourcer is a service provider and validates its own compliance; you remain responsible for managing it, holding its current AOC and agreeing in writing which requirements each party meets. See How to verify a PCI DSS AOC and check a provider's compliance.
PCI DSS by industry
Every guide in the PCI DSS series is written for one question and links back to the hub for the whole picture.
- PCI DSS for banking and financial services
- PCI DSS for BPO and contact centres
- PCI DSS for e-commerce and retail
- Effivity for PCI DSS
- PCI DSS for fintech and payment facilitators
- PCI DSS gap analysis
- PCI DSS for healthcare providers and insurers
- PCI DSS for hospitality and travel
- PCI DSS implementation plan
- PCI DSS in India
- PCI DSS for software and hosting providers
Keep exploring
Explore more about PCI DSS
Watch a video on how to implement PCI DSS here.
Watch a video on PCI DSS requirements here.
PCI DSS resources
Services for PCI DSS
Talk to a consultant
Plan PCI DSS compliance around your patient and member payment channels.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice