Where HIPAA Ends and PCI Begins During the Payment Process

The global healthcare industry relies on data, and its pools are endlessly increasing. It’s estimated that as much as 30% of the world’s data volume comes from healthcare alone, accounting for medical records, personally identifiable health information, and cardholder data. With this data usage always growing, there is a critical need to carefully manage and safeguard information stored and processed.

When it comes to healthcare data privacy and compliance, two main standards come into play: HIPAA for protected health information (PHI) and PCI compliance (PCI DSS) for cardholder data. The former refers to sensitive, private medical information, and the latter refers to cardholder data that may be held and processed.

Given that HIPAA and PCI protect very different types of data, it’s important to know where the two compliance standards may intersect, and how to handle information safely and smoothly during patient onboarding and payment processing. 

Why Healthcare Payments Create Confusion Around HIPAA vs. PCI

It is easy to assume that, during payment, all data is covered by HIPAA and not PCI DSS. However, HIPAA standards only cover PHI, or Protected Health Information, not the cardholder data PCI specializes in. At the same time, cardholder data is not considered PHI.

To add to the confusion, both standards follow similar security recommendations, specifically, around risk assessments and stringent data protection. Both exist to help healthcare providers to safely process patient data, to foster trust, and reduce the risk of data leakage.

A key difference, however, is that HIPAA leans more into risk-based analysis and precaution, while PCI is more technical and requires regular system scanning and testing, for example. It’s also worth noting that both are mandatory, with HIPAA in particular being federal law.

What HIPAA Actually Covers During Patient Intake and Care

HIPAA helps to ensure that PHI established at intake is confidential and easy to use within protected healthcare systems. Modern HIPAA standards help reduce risks posed by human errors, form mishandling, lack of data encryption, and paper documents left unprotected.

At intake, HIPAA ensures only a minimum amount of necessary data is used, requested, and disclosed (not how it’s collected for treatment). This covers a broad range of personal data, such as contact details and medical information.

During both intake and care, patients have a right to know what information is being taken, how it is being used, and what rights they have. This data must be protected, breaches must be reported, and risk assessments must be documented. During care, patients may also agree whether or not certain data is shared with family.

What HIPAA doesn’t protect is cardholder information. By following PCI DSS, healthcare providers can ensure all data accepted is kept to a minimum and is safeguarded to prevent leakage. 

Data protection in healthcare is critical, with breaches in the industry increasing year on year.

Where PCI Begins in the Payment Flow

PCI compliance starts as soon as a patient’s card data is taken or processed, whether in person, online, via gateway, over the telephone, or otherwise.

PCI DSS applies to the point of interaction with cardholder data, how it is transmitted, stored, and through the various points in which it travels. Therefore, healthcare providers must ensure that all systems, connections, and vendor software in use are adequately secured to prevent information from being stolen or leaked.

Healthcare providers must also remember that PCI controls apply continuously to any system processing cardholder data, no matter how long it exists for.

The Most Common Mistakes Healthcare Organizations Make During Checkout

Common mistakes even the most stringent of healthcare organizations make with data include:

• Storing card and PHI data together (which is confusing and potentially violates PCI)
• Recording sensitive information on unencrypted systems (or even by phone or on physical documents)
• Mixing workflows for HIPAA and PCI (assuming they are one and the same)
• Not using secure or PCI-validated solutions for card data
• Lacking multi-factor authentication
• Poorly training staff on how to handle different data sets and to ensure both card and PHI are safeguarded as per individual compliance
• Relying on partners and vendors to process transactions without thorough auditing

Among these, human error remains a worrying risk factor. As IBM states, phishing emails - which rely on reader susceptibility - remain a huge threat vector for all businesses.

Simple Ways to Keep HIPAA and PCI Responsibilities Clear

Managing healthcare data compliance is an ongoing, ever-changing task that requires constant vigilance and adaptation. However, there are a few simple ways healthcare bodies can ensure they meet HIPAA and PCI data hygiene standards across all payments they process:

• Continuously train and educate staff on the differences between these data sets and their compliance expectations
• Separate systems that handle and process HIPAA and PCI data completely
• Clearly define and implement access controls and user permissions for both data standards
• Conduct regular risk assessments of both HIPAA and PCI data handling, separately
• Only use PCI-validated systems and processes
• Work with payment processing vendors that have been carefully vetted and audited for their own compliance standards

It’s easy to understand why PCI and HIPAA data may be confused at the point of payment processing. However, with clear processes and regular training, even the busiest of clinics will find a way to ensure compliance under both standards. 

Given that healthcare data breaches are among the most expensive, it’s essential to take proper care of information and how it is handled.