Healthcare Provider Risk

In most practices and mid-size health systems, the two organisations with the deepest reach into patient and payment data are not employees.

PCI DSS for Healthcare Kit — the payment side: every channel a card enters by, the SAQ decision, the PCI-HIPAA crosswalk, the service-provider and business-associate register that collects the AOC, the BAA and the annual verification together, scope reduction, and the dual clock when an incident touches PHI and cardholder data at once.

MSP & MSSP Assessment Kit — the provider with administrative reach: what they hold, every access path in, 40 controls they must evidence, 20 contract clauses against UK, DFS, HIPAA, DORA and NIS2 expectations, whether you could leave, and a 60-minute drill for the night they are breached.

Why the pair. Your billing company is a PCI service provider and a HIPAA business associate, and it is very often also managed by the same MSP that holds delegated admin over your estate. That is one compromise reaching cardholder data, PHI and the administrative plane at once — and it is assessed by nobody unless you do it. The PCI kit collects what the billing company owes you on paper; the MSP kit tests what the provider can actually evidence.

Offered at Individual Practitioner and vCISO / MSSP tiers. At Organization scope the two are better bought separately — the house discount on this pair lands within a dollar of the dearer component, which is no offer at all, and we would rather say so than dress it up.