Summary

Level 1: Over 6 million transactions/year — requires an annual on-site audit by a Qualified Security Assessor (QSA) Now that you know your scope and SAQ type, assess where you stand today versus where PCI DSS requires you to be. PCI DSS isn’t a one-time project. Compliance requires continuous effort.

PCI DSS Step by Step for HealthTech: A Practical Compliance Guide

HealthTech companies occupy a uniquely complex compliance landscape. You’re already navigating HIPAA requirements for protected health information, and now you need to layer PCI DSS on top whenever your platform processes, stores, or transmits payment card data. The good news? These frameworks share common principles, and a structured approach makes both manageable.

This guide walks you through PCI DSS compliance step by step, tailored specifically to the realities of healthcare technology businesses.

Why HealthTech Companies Need PCI DSS Compliance

If your platform collects copays, subscription fees, insurance deductibles, or any other form of card payment, PCI DSS applies to you. Full stop.

The Payment Card Industry Data Security Standard (PCI DSS) is enforced by card brands like Visa, Mastercard, and American Express. Non-compliance can result in:

Fines ranging from $5,000 to $100,000 per month
Loss of the ability to process card payments
Reputational damage that erodes patient and customer trust
Increased liability in the event of a data breach

For HealthTech companies, a payment data breach can compound into a HIPAA incident if cardholder data overlaps with patient records — making the stakes even higher.

Understanding Your PCI DSS Scope

Before you do anything else, you need to understand your scope. This is the single most important step in the entire process.

What Is Cardholder Data Environment (CDE)?

Your Cardholder Data Environment includes every system, network, and person that stores, processes, or transmits cardholder data — or that could impact the security of that data.

How to Reduce Your Scope

The smartest move for most HealthTech companies is to minimize scope through tokenization and outsourcing:

Use a PCI-compliant payment processor (Stripe, Braintree, Square) that handles card data directly
Implement tokenization so your systems never see raw card numbers
Use hosted payment pages or iframes so card entry happens outside your environment
Segment your network so payment systems are isolated from clinical systems

Reducing scope reduces cost, complexity, and risk simultaneously.

Step 1: Determine Your Merchant Level

PCI DSS compliance requirements vary based on your transaction volume:

Level 1: Over 6 million transactions/year — requires an annual on-site audit by a Qualified Security Assessor (QSA)
Level 2: 1–6 million transactions/year — annual Self-Assessment Questionnaire (SAQ) plus quarterly network scans
Level 3: 20,000–1 million e-commerce transactions/year — SAQ plus quarterly scans
Level 4: Fewer than 20,000 e-commerce transactions/year — SAQ recommended, quarterly scans may apply

Most early-stage HealthTech companies fall into Level 3 or Level 4, which significantly simplifies the compliance process.

Step 2: Choose the Right Self-Assessment Questionnaire

If you’re not Level 1, you’ll complete an SAQ rather than a full audit. The right SAQ depends on how you handle payments:

SAQ A: You use fully outsourced payment processing with no electronic storage of card data — the simplest option and the goal for most HealthTech platforms
SAQ A-EP: You have an e-commerce website that redirects to a third-party processor but your site could affect transaction security
SAQ D: You store cardholder data or have a more complex payment environment — the most demanding SAQ with all 300+ requirements

Choosing the right SAQ is critical. Many companies inadvertently complete the wrong one, creating compliance gaps.

Step 3: Conduct a Gap Analysis

Now that you know your scope and SAQ type, assess where you stand today versus where PCI DSS requires you to be.

Key Areas to Evaluate

Network Security

Are firewalls configured to restrict inbound and outbound traffic to your CDE?
Is network segmentation in place between your payment environment and clinical systems?

Access Controls

Is access to cardholder data restricted to those with a legitimate business need?
Are unique user IDs assigned to every person with system access?
Is multi-factor authentication (MFA) enforced for all remote access?

Data Protection

Is cardholder data encrypted in transit using TLS 1.2 or higher?
Are you storing any data you don’t need (primary account numbers, CVVs, PINs)?

Vulnerability Management

Are systems patched regularly against known vulnerabilities?
Do you run quarterly internal and external vulnerability scans?

Monitoring and Logging

Do you have audit logs capturing access to cardholder data?
Are logs reviewed regularly and retained for at least 12 months?

Document every gap. This becomes your remediation roadmap.

Step 4: Remediate Identified Gaps

Work through your gap analysis systematically. Prioritize based on risk level and compliance deadline.

Common Remediation Tasks for HealthTech Companies

Implement tokenization if you haven’t already — this is often the highest-ROI action
Enable MFA across all administrative accounts and remote access points
Patch management process: Establish a documented schedule for applying security patches within 30 days of release
Encrypt data in transit: Audit all API connections and web traffic to confirm TLS 1.2+ everywhere
Purge unnecessary data: Run a data discovery scan and delete any stored card data you don’t need
Segment your network: Work with your infrastructure team to isolate payment systems using VLANs or separate cloud environments
Update your incident response plan: Ensure it covers payment card breach scenarios alongside HIPAA breach procedures

Step 5: Implement Ongoing Monitoring and Testing

PCI DSS isn’t a one-time project. Compliance requires continuous effort.

Quarterly Requirements

Run internal and external vulnerability scans using an Approved Scanning Vendor (ASV)
Review firewall rule sets
Test security controls

Annual Requirements

Complete your SAQ or undergo a QSA audit
Conduct penetration testing (required for most merchants)
Review and update your policies and procedures
Train all staff with access to payment systems

Continuous Requirements

Monitor logs daily (or use a SIEM tool to automate alerting)
Apply patches on schedule
Review user access rights when roles change

Step 6: Document Everything

Documentation is the backbone of any PCI DSS compliance program. Auditors and assessors need to see evidence that your controls exist and are operating effectively.

Essential documents include:

Information Security Policy: Your overarching security governance document
Network diagrams: Showing your CDE and how it’s segmented
Data flow diagrams: Mapping where cardholder data enters, moves, and exits your systems
Incident response plan: Covering payment card breach scenarios
Vendor management policy: Documenting how you assess and monitor third-party service providers
Access control procedures: Defining how user access is provisioned, reviewed, and revoked
Change management procedures: Controlling modifications to systems in your CDE

Step 7: Manage Your Third-Party Vendors

HealthTech platforms often rely on dozens of vendors — EHR integrations, billing platforms, telehealth tools, cloud providers. Any vendor that touches your CDE must be PCI DSS compliant.

What to Do

Maintain a list of all service providers with access to your CDE
Obtain and review each vendor’s Attestation of Compliance (AoC) annually
Include PCI DSS requirements in your vendor contracts
Define clearly which party is responsible for each PCI DSS control

Aligning PCI DSS with HIPAA in HealthTech

The good news for HealthTech companies is that PCI DSS and HIPAA share significant common ground:

Control Area	PCI DSS	HIPAA
Access Controls	Required	Required
Encryption	Required	Addressable (effectively required)
Audit Logging	Required	Required
Incident Response	Required	Required
Risk Assessment	Required	Required

Build a unified compliance framework where a single set of controls satisfies both standards wherever possible. This reduces duplication of effort and makes your compliance program more sustainable.

Frequently Asked Questions

Does PCI DSS apply if we use Stripe or another third-party processor? Yes, PCI DSS still applies, but your scope is dramatically reduced. If you use a hosted payment page and never touch raw card data, you’ll likely only need to complete SAQ A — the simplest form. You still need to document this and submit your SAQ annually.

Can HIPAA and PCI DSS compliance be managed together? Absolutely, and it’s the recommended approach. Many technical controls — MFA, encryption, logging, access controls — satisfy requirements under both frameworks. A unified compliance program is more efficient and more cost-effective than treating them separately.

What happens if we have a payment card breach? You must notify your acquiring bank immediately. The card brands will investigate, and you may face fines, forensic audit costs, and card replacement fees. If patient data was also exposed, HIPAA breach notification requirements kick in simultaneously. This is why having a combined incident response plan is essential.

How long does PCI DSS compliance take to achieve? For a HealthTech company using a third-party processor with limited scope, initial compliance can take 4–8 weeks. If you have a complex environment or significant gaps, plan for 3–6 months. Ongoing compliance is a continuous program, not a destination.

Do we need to hire a QSA? Not necessarily. Most HealthTech companies at Level 3 or Level 4 can self-assess using the appropriate SAQ. A QSA becomes mandatory only at Level 1 or if your acquiring bank requires it. However, engaging a QSA consultant to review your SAQ before submission is often worthwhile.

Start Your PCI DSS Journey with Ready-to-Use Templates

Building compliance documentation from scratch is time-consuming, error-prone, and expensive. Every policy, procedure, and form in this guide needs to be documented — and that documentation needs to be accurate, audit-ready, and aligned with PCI DSS v4.0.

Our PCI DSS compliance template bundle for HealthTech companies includes:

Pre-written Information Security Policy
Network and data flow diagram templates
Incident response plan (covering both PCI DSS and HIPAA scenarios)
Vendor management policy and assessment checklist
Access control procedures
SAQ completion guidance
Gap analysis worksheet

Stop spending weeks writing documents from scratch. Download our HealthTech PCI DSS template bundle today and have audit-ready documentation in hours, not months.

[Browse Compliance Templates →]