HIPAA Security Rule to PCI DSS 4.0 crosswalk

24 control objectives in HIPAA Security Rule and Breach Notification Rule are mapped here to PCI DSS. Every one has a requirement on the other side. Each row is one shared objective, with the requirement ids on both sides.

Control objective	HIPAA Security Rule	PCI DSS 4.0
Security governance and policies	`164.308(a)(1)(i)`Security management process `164.316(a)`Policies and procedures	`12.1`A comprehensive information security policy is established, published, maintained and disseminated `12.4`PCI DSS compliance is managed
Security roles and accountability	`164.308(a)(2)`Assigned security responsibility	`12.1.3`Security policy defines information security roles and responsibilities `12.4.1`Executive management responsibility for protection of cardholder data (service providers)
Risk assessment and treatment	`164.308(a)(1)(ii)(A)`Risk analysis `164.308(a)(1)(ii)(B)`Risk management	`12.3`Risks to the cardholder data environment are formally identified, evaluated and managed `12.3.1`Targeted risk analysis for requirements with flexible frequency
Asset and system inventory	`164.310(d)(2)(iii)`Accountability (record of hardware and media movements)	`12.5.1`Inventory of system components in scope for PCI DSS is maintained `12.5.2`PCI DSS scope is documented and confirmed at least every 12 months
Data classification and handling	`164.308(a)(1)(ii)(A)`Risk analysis (requires identifying where ePHI lives)	`12.5.2`PCI DSS scope is documented and confirmed (includes identifying all data flows)
Access provisioning, review and removal	`164.308(a)(3)`Workforce security (authorization, supervision, termination) `164.308(a)(4)`Information access management	`7.2`Access to system components and data is appropriately defined and assigned (incl. 7.2.4 six-month review) `7.3`Access is managed via an access control system `8.2.5`Access for terminated users is immediately revoked
Least privilege and privileged access	`164.312(a)(1)`Access control `164.308(a)(4)`Information access management	`7.2.1`An access control model is defined `7.2.2`Access assigned based on job classification and least privileges
Authentication, unique IDs and multi-factor authentication	`164.312(d)`Person or entity authentication `164.312(a)(2)(i)`Unique user identification	`8.2`User identification and related accounts are strictly managed `8.3`Strong authentication for users and administrators is established and managed `8.4`Multi-factor authentication is implemented `8.5`MFA systems are configured to prevent misuse
Encryption at rest and key management	`164.312(a)(2)(iv)`Encryption and decryption (addressable)	`3.5`Primary account number is secured wherever it is stored `3.6`Cryptographic keys used to protect stored account data are secured `3.7`Key management processes and procedures are defined and implemented
Encryption in transit	`164.312(e)(1)`Transmission security	`4.2`PAN is protected with strong cryptography during transmission `2.2.7`All non-console administrative access is encrypted
Vulnerability scanning and patching	`164.308(a)(8)`Evaluation (periodic technical evaluation)	`6.3`Security vulnerabilities are identified and addressed `11.3`External and internal vulnerabilities are regularly identified, prioritized and addressed
Penetration testing and independent assessment	`164.308(a)(8)`Evaluation	`11.4`External and internal penetration testing is regularly performed
Logging, log review and monitoring	`164.312(b)`Audit controls `164.308(a)(1)(ii)(D)`Information system activity review	`10.2`Audit logs are implemented to support detection of anomalies and suspicious activity `10.3`Audit logs are protected from destruction and unauthorized modification `10.4`Audit logs are reviewed to identify anomalies or suspicious activity `10.5`Audit log history is retained and available for analysis `10.6`Time-synchronization mechanisms support consistent time settings
Intrusion detection and integrity monitoring	`164.312(c)(1)`Integrity	`11.5`Network intrusions and unexpected file changes are detected and responded to `11.6`Unauthorized changes on payment pages are detected and responded to
Malware protection	`164.308(a)(5)(ii)(B)`Protection from malicious software	`5.2`Malicious software is prevented, or detected and addressed `5.3`Anti-malware mechanisms and processes are active, maintained and monitored `5.4`Anti-phishing mechanisms protect users against phishing attacks
Incident response and breach notification	`164.308(a)(6)`Security incident procedures `164.404`Notification to individuals (Breach Notification Rule)	`12.10`Suspected and confirmed security incidents that could impact the CDE are responded to immediately (12.10.1 IR plan, 12.10.2 annual review and test)
Third-party and vendor risk management	`164.308(b)(1)`Business associate contracts and other arrangements `164.314(a)`Business associate contracts or other arrangements	`12.8`Risk to information assets associated with third-party service provider relationships is managed `12.9`Third-party service providers support their customers' PCI DSS compliance
Business continuity and disaster recovery	`164.308(a)(7)`Contingency plan	`12.10.1`Incident response plan includes business recovery and continuity procedures
Backup and redundancy	`164.308(a)(7)(ii)(A)`Data backup plan `164.308(a)(7)(ii)(B)`Disaster recovery plan	`12.10.1`Incident response plan includes data backup processes `9.4.1.1`Offline media backups with cardholder data are stored in a secure location
Security awareness and training	`164.308(a)(5)`Security awareness and training	`12.6`Security awareness education is an ongoing activity (12.6.1 program, 12.6.2 annual review, 12.6.3 training at hire and annually)
Personnel screening, terms and sanctions	`164.308(a)(3)(ii)(B)`Workforce clearance procedure `164.308(a)(3)(ii)(C)`Termination procedures `164.308(a)(1)(ii)(C)`Sanction policy	`12.7`Personnel are screened to reduce risks from insider threats
Physical access and facility security	`164.310(a)`Facility access controls	`9.2`Physical access controls manage entry into facilities and systems containing cardholder data `9.3`Physical access for personnel and visitors is authorized and managed
Data retention, media handling and secure disposal	`164.310(d)(2)(i)`Disposal `164.310(d)(2)(ii)`Media re-use	`3.2`Storage of account data is kept to a minimum (3.2.1 retention and disposal) `9.4`Media with cardholder data is securely stored, accessed, distributed and destroyed
Ongoing control monitoring and internal audit	`164.308(a)(8)`Evaluation	`12.4.2`Reviews confirm personnel perform tasks per policy (service providers)

Open a control objective for the evidence checklist.PCI DSS 4.0 to HIPAA Security Rule →

Scope: Citations are to 45 CFR 164. 'Addressable' vs 'required' implementation specifications are not distinguished here. Several themes have no direct HIPAA citation. Mapped at requirement / sub-requirement level. Many PCI requirements only apply to the cardholder data environment (CDE) or to service providers. A mapping means the requirements address the same objective. It does not mean satisfying one satisfies the other, because scope, frequency and evidence rules differ.

More from HIPAA Security Rule

HIPAA Security Rule to SOC 2 HIPAA Security Rule to NIST CSF 2.0 HIPAA Security Rule to ISO 27001:2022 HIPAA Security Rule to NIST 800-53 r5