With security, there are important laws to abide by and even more acronyms to know. When accepting online payments, Payment Card Industry Data Security (PCI DSS) comes into play to improve the security of credit card transactions and protect individuals against misuse of their personal information. Sounds like HIPAA, right?
Many people tend to think if their business adheres to one set of requirements then they are following the other. This is not necessarily true – these are two different sets of requirements created for two different purposes. Let’s review both and learn how to comply, depending on the needs of your business.
What is PCI DSS?
The Payment Card Industry Data Security Standard (PCI DSS) covers entities and their business associates that accept payment in the form of credit, debit, or other types of cards. This includes all types of businesses, not just those in healthcare. Although the PCI has gone through several versions over the years, these are the twelve specific requirements:
- Protect your system with firewalls
- Configure passwords and specific settings
- Protect stored cardholder data
- Encrypt transmission of cardholder data across open, public networks
- Use and regularly update anti-virus software
- Regularly update and patch current systems
- Restrict access to cardholder data to a business need-to-know basis
- Assign a unique ID to each person with computer access
- Restrict physical access to workplace and cardholder data
- Implement logging and log management
- Conduct vulnerability scans and penetration tests
- Complete documentation and risk assessments
These 12 components are the basics of compliance, however each business will need to complete a Self-assessment Questionnaire (SAQ) based on their business needs.
Why do you need to comply with PCI if you are already HIPAA compliant?
HIPAA deals specifically with protected health information (PHI) , which is defined as the following 18 identifiers:
- Names
- Geographic identifiers smaller than a state, excepting the last three digits of a zip code
- Dates related to the individual
- Phone numbers
- Fax numbers
- Email addresses
- Social security numbers
- Medical record numbers
- Health insurance beneficiary numbers
- Account numbers
- Certificate/license numbers
- Vehicle identifiers
- Device identifiers and serial numbers
- Web URLS
- IP address numbers
- Biometric identifiers – fingerprints, retinal, and voice prints
- Full face photographic images
- Any other unique identifying number, characteristic, or code
In general, HIPAA privacy and security rules, as well as HITECH, use broader terminology and more vague language. PCI DSS is much more specific. For example, PCI regulations use the word “firewall”, while HIPAA uses the seemingly more vague “implement technical security measures to guard against unauthorized access.” PCI is considered the higher, more specific set of standards. Therefore, entities that comply with HIPAA do not necessarily meet the PCI standards and would need a thorough assessment.
You may notice that credit card numbers and other payment forms are not specifically included in the above list for PHI, with the possible exception of the umbrella “any other number” listed as number 18. PCI regulations specifically address payment methods and how they may be stored and transmitted.
Similarities between HIPAA and PCI
Although the two sets of regulations are designed for different purposes, there remains some overlap. Businesses should not mistake this as automatic compliance and should examine each instance of overlap to confirm compliance.
By the numbers:
- HIPAA privacy rule contains 281 validation points. The security rule contains 254 validation points. Only 70 of these overlap with PCI.
- PCI DSS contains 1030 validation points. Only 316 of them overlap with HIPAA.
In the big picture, HIPAA-covered entities who also accept credit card payments under PCI DSS should treat these as two separate sets of regulations. Looking for connections and shortcuts between the two can lead to confusion and non-compliance.
FormDr. specializes in HIPAA compliant electronic forms, and also understands the more detailed information involved with PCI compliance. Questions? Contact us today.
