By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
Health Works CollectiveHealth Works CollectiveHealth Works Collective
  • Health
    • Mental Health
    Health
    Healthcare organizations are operating on slimmer profit margins than ever. One report in August showed that they are even lower than the beginning of the…
    Show More
    Top News
    UV damage to eyes
    Warning Signs of Long-Term UV Damage to Your Eyes
    December 9, 2021
    degree for healthcare job
    The Ultimate Healthcare Recruiting and Staffing Guidebook
    March 21, 2022
    medicare part d benefits
    Everything that You Need to Know About Medicare Part D
    August 15, 2022
    Latest News
    Beyond Nutrition: Everyday Foods That Support Whole-Body Health
    June 15, 2025
    The Wide-Ranging Benefits of Magnesium Supplements
    June 11, 2025
    The Best Home Remedies for Migraines
    June 5, 2025
    The Hidden Impact Of Stress On Your Body’s Alignment And Balance
    May 22, 2025
  • Policy and Law
    • Global Healthcare
    • Medical Ethics
    Policy and Law
    Get the latest updates about Insurance policies and Laws in the Healthcare industry for different geographical locations.
    Show More
    Top News
    Conservatives: The Utah Health Exchange is Not a Model
    July 23, 2011
    Medical Malpractice Reform Losing Physician Support
    November 7, 2011
    Hospitals Aim to Apply Direct Payments of Care Delivery to Increase Resources
    August 28, 2012
    Latest News
    Top HIPAA-Compliant Messaging Apps for Healthcare Teams
    June 25, 2025
    When Healthcare Ends, the Legal Process Begins: What Families Should Know About Probate and Medical Estates
    June 20, 2025
    Preventing Contamination In Healthcare Facilities Starts With Hygiene
    June 15, 2025
    Strengthening Healthcare Systems Through Clinical and Administrative Career Development
    June 13, 2025
  • Medical Innovations
  • News
  • Wellness
  • Tech
Search
© 2023 HealthWorks Collective. All Rights Reserved.
Reading: PCI Compliance with Service Providers
Share
Notification Show More
Font ResizerAa
Health Works CollectiveHealth Works Collective
Font ResizerAa
Search
Follow US
  • About
  • Contact
  • Privacy
© 2023 HealthWorks Collective. All Rights Reserved.
Health Works Collective > Uncategorized > PCI Compliance with Service Providers
Uncategorized

PCI Compliance with Service Providers

onlinetech
Last updated: March 14, 2012 10:01 am
onlinetech
Share
4 Min Read
SHARE

The PCI sub-requirements and testing procedures 12.8-12.84 concern the relationship between merchants and their service providers, including PCI compliant hosting providers.

The PCI sub-requirements and testing procedures 12.8-12.84 concern the relationship between merchants and their service providers, including PCI compliant hosting providers.

The sub-requirements fall under the main requirement #12: Maintain an Information Security Policy – meaning a merchant must maintain a policy that addresses information security for all personnel, including internal employees, contractors and consultants. The sub-requirements 12.8-12.84 include language that specifically refers to service providers.

According to my earlier blog post and Verizon’s 2011 PCI Compliance Report (PDF), this is one of the most difficult PCI DSS requirements for most organizations to achieve, with only 39 percent of merchants at full achievement.

More Read

HIPAA Compliant Data Centers White Paper
The Impact of HITECH & HIPAA on Data Centers
Infographic:Race to the ICD-10 Finish Line
SMBs moving to Colocation and Cloud Computing
Adult Sleepwalking: How It Impacts Your Life And What To Do About It
55% of Providers Planning to Buy Business Intelligence Tools Over 3 Years
12.8If cardholder data is shared with service providers [backup tape storage or managed service providers, or those that use the data for fraud modeling purposes], you must maintain and implement policies and procedures to manage server providers.
How do you test it?You can test it by observing, reviewing policies and procedures, and reviewing supporting documentation for the rest of the requirements:
12.8.1Maintain a list of service providers. 
How do you test it?Pretty self-explanatory; keep a current and comprehensive list of vendors and verify it is updated whenever you sign with a new provider or end a contract. It’s also good practice to keep tabs on your service providers’ audit types and dates for your own verification of ongoing compliance.
12.8.2Maintain a written agreement that includes an acknowledgement that the service providers are responsible for the security of cardholder data the service providers possess.
How do you test it?Check in your contract for specific language around the roles and responsibilities of your service providers when it comes to securing cardholder data. For example, if there’s a known data breach of your server, what’s the timeframe and process in which the service provider should notify you? And how long should data be retained after your contract expires, and how should it be deleted? And, more importantly, who has ownership or rights to your data?
12.8.3Ensure there is an established process for engaging service providers including proper due diligence prior to engagement.
How do you test it?Create document with policies and procedures around how you qualify a vendor’s ability to provide a secure PCI compliant data center and services. Ensure you do your due diligence to save yourself a headache later – check their PCI audit report for the full scope of their compliance and compare it to what you still need to cover.
12.8.4Maintain a program to monitor service providers’ PCI DSS compliance status at least annually.
How do you test it?Establish a way internally to verify your service provider’s ongoing PCI compliance status each year, whether you assign a point of contact to exemplify their due diligence in analyzing their audit reports or you keep in touch with your service provider’s security officer to verify dates of compliance.

Recommended links:
PCI Glossary of Terms
Levels of PCI Compliance
Who Needs to be PCI Compliant?

References:
Contracting for PCI DSS Compliance from The SANS Institute (PDF)
PCI DSS Requirements and Security Assessment Procedures, Version 2.0 (PDF)

TAGGED:pci compliancesecurity
Share This Article
Facebook Copy Link Print
Share

Stay Connected

1.5kFollowersLike
4.5kFollowersFollow
2.8kFollowersPin
136kSubscribersSubscribe

Latest News

women dental care
What Is a Smile Makeover and How Much Does It Cost?
Dental health
June 30, 2025
HIPAA-Compliant Messaging Apps
Top HIPAA-Compliant Messaging Apps for Healthcare Teams
Global Healthcare Policy & Law Technology
June 25, 2025
recovering from injury
Rebuilding After Injury: Path to Physical and Emotional Recovery
News
June 22, 2025
scientist using microscope
When Healthcare Ends, the Legal Process Begins: What Families Should Know About Probate and Medical Estates
Global Healthcare
June 18, 2025

You Might also Like

changes brought on by blockchain in healthcare
Uncategorized

What is the Future of Blockchain Technology in the Healthcare Sector?

May 11, 2022
water sports
Health careMental HealthUncategorized

Positive Effects of Water Sports On Your Body And Mind

May 1, 2021

Getting a Job in Healthcare IT

September 12, 2011

Controlling vs. collaborative IT leadership and what it means to your healthcare organization

August 21, 2015
Subscribe
Subscribe to our newsletter to get our newest articles instantly!
Follow US
© 2008-2025 HealthWorks Collective. All Rights Reserved.
  • About
  • Contact
  • Privacy
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?