PCI DSS Compliance for Healthcare Companies: A Practical Guide for SMBs
Healthcare companies that accept credit or debit card payments must meet PCI DSS requirements, regardless of size. Compliance involves 12 core requirements across network security, data protection, and access control. Non-compliance risks fines of $5,000-$100,000 per month and card processing suspension.
Healthcare organizations face a dual compliance burden: HIPAA governs protected health information (PHI), while PCI DSS governs payment card data. These two frameworks overlap in some areas - such as access controls and encryption - but they are maintained by separate bodies and enforced through separate audit processes. Failing to address both exposes an SMB to compounding regulatory risk.
For a medical practice, dental office, outpatient clinic, or healthcare SaaS company with 20-500 employees, PCI DSS compliance is not optional. Any entity that stores, processes, or transmits cardholder data falls within scope. The level of audit rigor depends on your annual transaction volume, but baseline controls apply to every merchant tier, including the smallest practices.
This page explains what PCI DSS compliance means for healthcare companies specifically, how it intersects with HIPAA, what it costs, and how to find a qualified vendor through the Value Aligners marketplace to close gaps without overspending.
What Is PCI DSS Compliance and Why Does It Apply to Healthcare Companies?
PCI DSS - the Payment Card Industry Data Security Standard - is a set of security controls developed by the PCI Security Standards Council (PCI SSC), a body founded by Visa, Mastercard, American Express, Discover, and JCB. The current version, PCI DSS v4.0, was finalized in March 2022 and became the sole active standard in March 2024 after v3.2.1 was retired.
Any organization that accepts, processes, stores, or transmits credit or debit card data must comply. For healthcare companies, this typically means patient billing portals, front-desk point-of-sale terminals, telehealth platforms that collect co-pays, and third-party billing software. The standard does not distinguish between healthcare and retail - scope is determined by card data flow, not industry vertical.
PCI DSS v4.0 contains 12 core requirements organized into six goals:
1. Build and maintain a secure network and systems 2. Protect cardholder data 3. Maintain a vulnerability management program 4. Implement strong access control measures 5. Regularly monitor and test networks 6. Maintain an information security policy
For healthcare SMBs, requirements 3 (cardholder data storage), 8 (user identification and authentication), and 12 (security policy) are frequently where gaps appear during a gap assessment. Practices that rely on older electronic health record (EHR) systems with embedded billing modules often discover that card data is being stored in plaintext or in logs - a direct violation of Requirement 3.
PCI DSS compliance is validated through Self-Assessment Questionnaires (SAQs) for lower-volume merchants or a Report on Compliance (ROC) conducted by a Qualified Security Assessor (QSA) for higher-volume entities. Most healthcare SMBs qualify for SAQ-B, SAQ-B-IP, or SAQ-C depending on how they accept payments. However, if your practice uses a web-based billing portal where card data touches your servers, SAQ-D - the most comprehensive - may apply.
The intersection with HIPAA is practical rather than legal. Both frameworks require encryption in transit, access logging, and least-privilege access controls. Aligning your HIPAA security rule documentation with PCI DSS controls reduces duplicated effort and satisfies both auditors more efficiently. A qualified vendor experienced in both frameworks can map controls across the two standards and identify shared evidence requirements.
How Much Does PCI DSS Compliance Cost for a Healthcare SMB?
PCI DSS compliance costs vary significantly based on your merchant level, current security posture, payment environment complexity, and whether you use a QSA or complete an SAQ independently. The following cost ranges are based on publicly available pricing from compliance service providers and PCI SSC guidance documents.
For most healthcare SMBs processing fewer than one million Visa transactions annually (Merchant Level 4), total annual compliance costs typically range from $1,000 to $15,000. This includes SAQ completion, vulnerability scanning (required quarterly for SAQ-B-IP, C, and D merchants), and any remediation work. Level 4 merchants are the most common category for small practices and clinics.
For Level 3 merchants (one million to six million transactions annually), costs increase to $15,000-$40,000 per year, driven by mandatory quarterly network scans conducted by an Approved Scanning Vendor (ASV), penetration testing requirements, and more rigorous internal audit documentation.
For Level 1 merchants (over six million transactions annually), a full QSA-conducted ROC is required, with costs ranging from $30,000 to $200,000 depending on environment complexity. Most healthcare SMBs in the 20-500 employee range will not reach this tier unless they operate a large patient portal or billing clearinghouse.
Key cost line items to budget for include:
- Gap assessment: $2,000-$8,000 (one-time or annual) - Quarterly ASV scans: $200-$1,500 per quarter depending on IP count - Penetration testing: $4,000-$20,000 annually - SAQ preparation and submission: $500-$3,000 with consultant support - Remediation technology (firewalls, encryption tools, log management): $1,000-$10,000 depending on existing infrastructure - Staff training: $500-$2,000 annually
The most cost-efficient approach for a healthcare SMB is to scope down your cardholder data environment (CDE) as aggressively as possible. Using a fully outsourced payment processor with point-to-point encryption (P2PE) can reduce your SAQ type from D to B or B-IP, cutting compliance costs by 60-80 percent. A qualified advisor can model scope reduction scenarios before you begin remediation.
Non-compliance penalties are assessed by acquiring banks and card brands, not directly by PCI SSC. Fines range from $5,000 to $100,000 per month for non-compliant merchants, and a breach resulting from non-compliance can trigger additional fines plus liability for fraudulent charges and forensic investigation costs, which average $36,000 per incident for small businesses according to Verizon's 2023 Data Breach Investigations Report.
Which PCI DSS Controls Overlap With HIPAA, and How Should Healthcare Companies Handle Both?
Healthcare companies often ask whether achieving HIPAA compliance provides any credit toward PCI DSS - or vice versa. The answer is that the two frameworks share significant technical control overlap but are legally and operationally distinct. Satisfying one does not satisfy the other, but a well-structured dual-compliance program can share evidence, documentation, and tooling across both.
The table below summarizes the primary control overlaps:
Access Control: HIPAA Security Rule §164.312(a)(1) requires unique user identification and automatic logoff. PCI DSS Requirement 8 requires unique IDs, multi-factor authentication for all non-console administrative access, and session timeout controls. A single IAM policy and MFA deployment satisfies both.
Encryption in Transit: HIPAA requires encryption of ePHI transmitted over open networks. PCI DSS Requirement 4 requires strong cryptography (TLS 1.2 or higher) for cardholder data in transit. If your billing system transmits both data types, a single TLS configuration serves both requirements.
Audit Logging: HIPAA §164.312(b) requires activity logs for ePHI access. PCI DSS Requirements 10.2 and 10.3 require audit logs for cardholder data environment access, with 12-month retention (three months immediately available). A SIEM or log management platform configured for both log streams satisfies both frameworks with one tool.
Risk Assessment: HIPAA requires an annual risk analysis. PCI DSS Requirement 12.3 requires an annual targeted risk analysis. A single risk assessment methodology with dual-framework mapping satisfies both if documented correctly.
Vulnerability Management: HIPAA does not prescribe specific scan frequencies, but PCI DSS Requirement 11 requires internal vulnerability scans after any significant change and quarterly external scans by an ASV. Healthcare SMBs should run PCI-mandated scans and use the results to feed their HIPAA risk analysis simultaneously.
Where the frameworks diverge most significantly is in their scope definitions. HIPAA covers all ePHI regardless of how it is stored or transmitted. PCI DSS covers only cardholder data within the defined CDE. A medical record that contains both a diagnosis code and a credit card number falls under HIPAA for the clinical data and PCI DSS for the card data - and must be handled accordingly in your data flow diagrams and policies.
For healthcare SMBs, the practical recommendation is to conduct a unified gap assessment that maps controls to both frameworks simultaneously. This reduces duplicated effort, surfaces shared evidence requirements, and produces a single remediation roadmap. Vendors experienced in dual-framework healthcare compliance are available through the Value Aligners marketplace at https://www.valuealigners.com/marketplace.
Top Vendors Compared
| Vendor | Specialty | SMB Fit | Pricing | Cert Support |
|---|---|---|---|---|
| Coalfire | PCI QSA, HIPAA, healthcare compliance | Mid-market to enterprise; scalable SAQ packages available | Project-based; SAQ packages from ~$3,500 | QSA-led ROC, SAQ, ASV scanning |
| Sysnet Global Solutions | PCI compliance for SMB merchants | Strong fit for Level 3-4 merchants; portal-based SAQ workflow | Subscription model; starts ~$150/year for basic SAQ tiers | SAQ automation, ASV scanning, breach protection |
| SecurityMetrics | PCI DSS and HIPAA for healthcare organizations | Explicitly serves small and mid-size healthcare entities | Bundled packages; PCI + HIPAA audits from ~$4,000 | QSA, SAQ, ASV, penetration testing, HIPAA assessment |
| Schellman | QSA services, HITRUST, SOC 2 for regulated industries | Better fit for 100+ employee organizations with complex environments | Custom; typically $15,000+ for full QSA engagement | ROC, SAQ validation, HIPAA, HITRUST CSF |
| Tevora | PCI, HIPAA, and risk advisory for healthcare SMBs | Strong fit for practices and clinics; dual-framework assessments | Gap assessments from ~$2,500; full programs custom-quoted | SAQ, QSA, penetration testing, policy development |
Key Statistics
- Healthcare was the most breached industry for the 13th consecutive year in IBM's 2023 Cost of a Data Breach Report, with an average breach cost of $10.93 million per incident.
- Only 43.4% of organizations were fully compliant with PCI DSS at the time of their interim assessment in 2022, down from a high of 52.5% in 2020.
- Small and medium-sized businesses account for 46% of all payment card breaches investigated by Verizon, despite processing a fraction of total transaction volume.
- The median cost of a PCI DSS-related breach for a small business is estimated at $36,000, excluding regulatory fines and card replacement liability.
- PCI DSS v4.0 introduces 64 new requirements compared to v3.2.1, with 13 of those taking effect as mandatory requirements on March 31, 2025 for all merchants.
Frequently Asked Questions
Does a small medical practice that only takes a few card payments per month still need to be PCI DSS compliant?
Yes. PCI DSS applies to any entity that accepts payment cards, regardless of transaction volume. A practice processing five transactions per month is still a merchant under card brand rules. However, very low-volume merchants typically qualify for SAQ-B, which is the simplest self-assessment questionnaire, especially if they use a standalone, dial-up payment terminal with no electronic card data storage.
What is the difference between PCI DSS and HIPAA, and do healthcare companies need both?
HIPAA governs the privacy and security of protected health information (PHI) and is enforced by the HHS Office for Civil Rights. PCI DSS governs the security of payment card data and is enforced through card brand rules and acquiring banks. A healthcare company that accepts payment cards must comply with both. They are separate frameworks with overlapping technical controls but distinct audit processes and penalties.
What is a Self-Assessment Questionnaire (SAQ), and which one applies to my healthcare practice?
An SAQ is a self-validation tool published by the PCI SSC that merchants use to document their compliance. The applicable SAQ type depends on how your practice accepts payments. SAQ-B applies if you use only standalone dial-up terminals. SAQ-B-IP applies to IP-connected standalone terminals. SAQ-C applies if you use a payment application connected to the internet. SAQ-D applies if card data touches your servers directly. A QSA or compliance advisor can confirm the correct SAQ type for your environment.
What are the penalties for PCI DSS non-compliance in a healthcare setting?
Penalties are assessed by acquiring banks on behalf of card brands, not directly by the PCI SSC. Monthly fines range from $5,000 to $100,000 depending on the severity and duration of non-compliance. A confirmed data breach resulting from non-compliance can trigger additional fines, mandatory forensic investigations, card replacement liability, and in some cases termination of card processing privileges. HIPAA penalties for overlapping failures can add $100 to $50,000 per violation, with an annual cap of $1.9 million per violation category.
Can using a third-party payment processor eliminate PCI DSS scope for a healthcare company?
Using a fully outsourced payment processor with certified point-to-point encryption (P2PE) can significantly reduce your PCI DSS scope but does not eliminate it entirely. You remain responsible for the physical security of payment terminals, access controls to any portal used to view transaction data, and maintaining a valid SAQ or ROC. Scope reduction via P2PE can reduce your SAQ from type D to type B, substantially lowering compliance costs and complexity.
How often does a healthcare company need to renew its PCI DSS compliance?
PCI DSS compliance must be validated annually. In addition, quarterly external vulnerability scans by an Approved Scanning Vendor (ASV) are required for SAQ-B-IP, C, and D merchants. Internal vulnerability scans are required quarterly and after any significant network change. Penetration testing is required at least annually and after significant infrastructure or application changes under PCI DSS v4.0 Requirement 11.4.
What is the fastest way for a healthcare SMB to identify its PCI DSS compliance gaps?
The fastest approach is a targeted gap assessment conducted by a QSA or experienced compliance advisor. A gap assessment maps your current payment environment against the applicable SAQ requirements and produces a prioritized remediation list. For a small healthcare practice, a gap assessment typically takes two to five business days and costs between $2,000 and $8,000 depending on environment complexity. Value Aligners can connect you with vetted providers at https://www.valuealigners.com/marketplace.