PCI DSS in Healthcare: Who Needs It, What’s In Scope, and a Practical Readiness Checklist

by Jonathan Elmer 

Quick Answer

• You likely need PCI DSS if your organization (or a business unit) accepts, stores, processes, or transmits payment card data—or if systems you manage can impact that environment.
• Scope is determined by real data flows and access paths, not assumptions about segmentation or vendors.
• Healthcare scope often expands through call centers/phone payments, shared identity systems, remote admin tools, and third-party access.
• The fastest path to readiness is an evidence-first approach: inventory, data flow diagrams, access controls, logging, vulnerability management, and third-party governance.
• You can often reduce scope responsibly by minimizing card data touchpoints, using hosted payment pages, and validating segmentation.

What PCI DSS is (in practical terms)

PCI DSS is a security standard designed to protect payment card data. In practice, it becomes a program: you identify where card data lives (or could leak), define what systems are in scope, apply controls, and maintain evidence that those controls are operating consistently.

Who needs PCI DSS in healthcare?

• Providers and health systems that accept credit card payments (in clinics, call centers, online portals, or patient financial services).
• Payers or administrative organizations that process payments tied to member services.
• Healthcare vendors/SaaS companies that handle card data as part of patient payments, subscription billing, or integrated payment flows.
• Any organization that outsources payment processing but still has systems that can impact the security of the payment environment (e.g., identity, endpoint management, remote access tools).

The scoping basics: CDE and ‘connected-to’ systems

• Cardholder Data Environment (CDE): the people, processes, and technologies that store, process, or transmit card data.
• Connected-to / security-impacting systems: systems that can affect the security of the CDE even if they don’t handle card data directly (e.g., identity, admin access, monitoring).
• Scope is a *mapping exercise*: data flows + access paths + dependencies.

A simple 6-question PCI scope check

Use this as a starting point for internal alignment across Compliance, IT/Security, and Finance/Payments:

1. Do we accept, store, process, or transmit payment card data anywhere?
2. Is card data ever handled on systems we own or manage (workstations, servers, kiosks, terminals, call center tools)?
3. Can card data enter via phone payments, web forms, email, chat, or scanned documents?
4. Is the payment environment truly segmented with enforced and tested controls, such as ACLs (not just a diagram)?
5. Do third parties have admin access into systems that touch payments or could impact the payment environment?
6. Can shared services (identity, endpoint management, logging, backups) impact the security of payment systems?

Common ‘scope expansion’ traps in healthcare

• Call center recordings or screen capture that inadvertently include card data.
• Card data showing up in tickets, email, chat transcripts, or shared drives.
• Assuming a payment vendor removes all PCI scope without validating the actual workflow.
• Remote support tools and vendor admin access creating hidden pathways into payment-related systems.
• Shared identity and device management platforms that can impact payment endpoints.

Practical readiness checklist (evidence-first)

Below is a pragmatic checklist you can adapt for your readiness workstream.

How to reduce PCI scope responsibly

• Minimize card data touchpoints (avoid email/forms that collect card data).
• Use hosted/redirect payment pages so card data doesn’t traverse your environment.
• Implement segmentation around any remaining payment systems and validate it.
• Standardize admin access (MFA, least privilege, monitored remote support).
• Document everything: scope reductions require evidence, not intent.

FAQ

If payments are outsourced, are we automatically out of scope?

Not necessarily. Outsourcing can reduce scope, but systems you manage may still impact the security of payment workflows (identity, devices, remote access, logging).

What’s the fastest way to get PCI ready?

Start with scope mapping and evidence collection. Most delays come from unclear data flows, incomplete inventories, and undocumented access paths.

Why does scope keep expanding?

Because healthcare environments often share services across departments and use third parties for support. Remote admin access and shared identity can widen scope quickly.

What should we give assessors first?

A clear data flow diagram for all payment channels, an in-scope system inventory, segmentation evidence, and access control documentation.

Can we reduce scope mid-project?

Yes, but it must be intentional and validated. Scope reduction typically requires workflow changes (hosted payments) and segmentation validation.

How should Compliance and Security split responsibilities?

Compliance owns governance and evidence management; Security/IT owns control implementation and operational proof. The handoff must be explicit.

About the Author

Jonathan Elmer 

Jonathan Elmer is a seasoned cybersecurity professional and IT risk management consultant with over a decade of experience. Adept at delivering impactful information security solutions aligned with business objectives, with a proven track record in leading regulatory and compliance focused initiatives and spearheading the implementation of technical security programs. Notable roles include Chief Information Security Officer, Technical Services Lead, Medical Device Security Architect and Sr. Manager of IT Risk Management Consulting at Meditology Services, demonstrating leadership and expertise in project delivery, strategic direction, and client engagement.