HIPAA, PCI-DSS, and Sector-Specific Regulations

General privacy laws like GDPR set a baseline for all sectors, but certain industries handle data so sensitive that governments impose additional, sector-specific requirements. Healthcare data involves life-or-death decisions. Financial data enables fraud and identity theft. Payment card data fuels global cybercrime. Sector-specific regulations impose minimum standards that are independently audited, with penalties designed to ensure compliance is not simply treated as a cost of doing business.

The Health Insurance Portability and Accountability Act (HIPAA) is a US federal law that governs the protection of Protected Health Information (PHI). PHI includes any information that identifies a patient and relates to their health condition, treatment, or payment. HIPAA applies to covered entities (healthcare providers, health plans, healthcare clearinghouses) and their business associates (vendors with PHI access, such as cloud providers, billing companies, and EHR systems). Business associates must sign a Business Associate Agreement (BAA).

The HIPAA Security Rule specifically addresses electronic PHI (ePHI) and requires covered entities to implement administrative, physical, and technical safeguards. Administrative safeguards include security officer designation, workforce training, and contingency plans. Physical safeguards cover facility access controls and device disposal. Technical safeguards require access controls, audit controls, transmission encryption, and integrity verification. Unlike PCI-DSS, HIPAA uses the term 'addressable' for some requirements — meaning organizations must implement them or document why an alternative is equivalent.

The HIPAA Breach Notification Rule requires covered entities to notify affected individuals within 60 days of discovering a breach of unsecured PHI. The HHS Secretary must also be notified; if the breach affects 500 or more individuals in a state, the notification must occur within 60 days and must include prominent media notice. Breaches affecting fewer than 500 people are reported annually. Unsecured PHI is data that has not been encrypted or destroyed according to HHS guidelines — encrypted PHI that is breached does not trigger notification requirements.

HIPAA penalties are tiered based on culpability. Tier 1: $100–$50,000 per violation, up to $25,000 per category per year (no knowledge). Tier 2: $1,000–$50,000 per violation (reasonable cause). Tier 3: $10,000–$50,000 (willful neglect, corrected). Tier 4: $50,000 per violation (willful neglect, not corrected). Criminal penalties under HIPAA can reach $250,000 and 10 years imprisonment for intentional violations. The 2018 Anthem breach resulted in a $115M settlement and the 2021 Kronos breach led to multiple OCR investigations.

PCI-DSS (Payment Card Industry Data Security Standard) is not a law — it is a contractual standard created by the major card brands (Visa, Mastercard, Amex, Discover, JCB) through the PCI Security Standards Council. Any organization that stores, processes, or transmits cardholder data must comply. Current version is PCI-DSS v4.0 (released 2022). Non-compliance can result in fines from card brands ($5,000–$100,000/month), increased transaction fees, and ultimately loss of the ability to accept card payments — which is existential for most merchants.

PCI-DSS is organized into 12 requirements across six goal areas. Build and maintain a secure network: firewalls, no default passwords. Protect cardholder data: encrypt transmission, restrict storage. Maintain a vulnerability management program: antivirus, secure development. Implement strong access control: least privilege, unique IDs, physical access. Monitor and test networks: logging, intrusion detection, penetration testing. Maintain an information security policy: written policies, security awareness. Mastering these six areas covers all 12 requirements.

PCI-DSS compliance requirements scale with transaction volume. Level 1: 6M+ card transactions/year — requires annual on-site assessment by a Qualified Security Assessor (QSA) and quarterly network scans by an Approved Scanning Vendor (ASV). Level 2: 1-6M transactions — annual Self-Assessment Questionnaire (SAQ). Level 3: 20,000–1M e-commerce transactions — annual SAQ. Level 4: under 20,000 e-commerce transactions — annual SAQ, recommended quarterly scan. Larger merchants face more rigorous assessment requirements.

Beyond HIPAA and PCI-DSS, several other sector-specific laws appear on the Security+ exam. GLBA (Gramm-Leach-Bliley Act): financial institutions must protect consumer financial information and implement a written information security program. FERPA: educational institutions must protect student education records. COPPA: websites must obtain parental consent before collecting data from children under 13. SOX (Sarbanes-Oxley): public companies must maintain accurate financial records with internal controls; IT systems supporting financial reporting fall under SOX scope.

Compliance is demonstrated through documentation (policies, procedures, risk assessments), technical evidence (scan reports, penetration test results, access logs), and interviews (auditors verify that staff understand and follow documented procedures). QSA assessments (PCI) and HIPAA audits (OCR) both require organized evidence collection. Many organizations use GRC (Governance, Risk, and Compliance) platforms to centralize control evidence, map controls to multiple frameworks, and generate audit-ready reports on demand.

Organizations often operate under multiple regulatory frameworks simultaneously. A hospital payment system may face HIPAA, PCI-DSS, and GLBA requirements at the same time. Smart compliance programs look for control overlap — for example, encryption controls that satisfy HIPAA Technical Safeguards, PCI-DSS Requirement 4, and ISO 27001 Annex A simultaneously. Control mapping across frameworks reduces duplication of effort and lets organizations demonstrate compliance efficiently during multiple audits using the same evidence artifacts.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: HIPAA protects PHI through administrative, physical, and technical safeguards with 60-day breach notification, PCI-DSS is a contractual standard with 12 requirements and compliance levels based on transaction volume, and other sector-specific regulations (GLBA, FERPA, COPPA, SOX) each address specific data types with sector-specific obligations. Next up we explore privacy-by-design principles and data retention policies.