Data privacy and payment security: PCI DSS 4.0.1, HIPAA and California privacy law

Three regimes, one evidence base

Payment security, health data and consumer privacy are governed by different bodies: the card brands through the PCI Security Standards Council, HHS through the HIPAA Security Rule, and California through the CCPA as amended by the CPRA. Their language differs, but the controls they test overlap heavily:

• Strong identity: MFA or phishing-resistant authentication for access to sensitive data.
• Logging and review: records of who did what, reviewed in time to matter.
• Detection and response: a working process to find intrusions and contain them.
• Evidence: proof, months later, that the controls operated.

Organizations that build one detection and logging capability to the strictest of the three standards can usually satisfy all of them from the same evidence.

PCI DSS 4.0.1: fully in force

The PCI SSC published PCI DSS v4.0.1 in June 2024 as a limited revision of v4.0, which was retired on December 31, 2024. The 51 future-dated requirements introduced in v4.0 became mandatory on March 31, 2025. Assessments today are against the full standard.

Authentication (Requirement 8)

• 8.4.2: MFA for all non-console access into the cardholder data environment (CDE), not only remote access.
• 8.5.1: MFA systems must resist replay attacks, must not be bypassable by any user without documented, time-limited management approval, and must use at least two different factor types.
• Phishing-resistant option: v4.0.1 notes that 8.4.2 does not apply to accounts authenticated only with phishing-resistant factors. FIDO2 passkeys qualify, which makes them a practical route for non-administrative CDE access.

PCI DSS Requirements 10 and 11: logging and testing

Requirements 10 and 11 are where detection capability is assessed most directly. The move from manual to automated review is the change that most often forces an architecture decision.

Requirement 12.10 adds the response side: an incident response plan that is ready to be activated immediately, tested at least annually, and that includes procedures for responding to alerts from the monitoring systems above.

HIPAA Security Rule: §164.312 and the pending update

The HIPAA Security Rule's technical safeguards in 45 CFR §164.312 have changed little since 2003. The two that matter most for detection and identity are:

• §164.312(b) Audit controls: hardware, software or procedural mechanisms that record and examine activity in systems containing ePHI.
• §164.312(d) Person or entity authentication: procedures to verify that a person or entity seeking access to ePHI is the one claimed.

Neither names MFA or a log retention period. They are paired with the administrative requirements to review information system activity regularly (§164.308(a)(1)(ii)(D)) and to identify and respond to security incidents (§164.308(a)(6)).

Two reasons to act now regardless. First, the Breach Notification Rule already requires notice to individuals without unreasonable delay and no later than 60 days after discovery, and to HHS for breaches affecting 500 or more individuals (smaller breaches are reported annually). Media notice applies when more than 500 residents of one state are affected. Discovery is dated from when the breach is known, or would have been known with reasonable diligence. Second, a 2021 amendment to HITECH requires OCR to consider whether "recognized security practices" were in place for the prior 12 months when setting penalties. Documented 24/7 monitoring and MFA are among the clearest ways to show that.

CCPA / CPRA: the reasonable security standard

The CCPA requires a business that collects personal information to implement reasonable security procedures and practices appropriate to the nature of that information (Cal. Civ. Code §1798.100(e)). Three developments now give the standard practical weight:

1. Private right of action. Consumers whose nonencrypted or nonredacted personal information is breached because of a failure to maintain reasonable security can sue under §1798.150 for statutory damages of $100 to $750 per consumer per incident (adjusted for inflation), or actual damages if greater. At scale, this drives class action exposure.
2. Cybersecurity audits. CPPA regulations effective January 1, 2026 require annual independent cybersecurity audits for businesses whose processing presents significant risk: those deriving half or more of revenue from selling or sharing personal information, or those above the CCPA revenue threshold that process personal information of 250,000 or more consumers (or sensitive information of 50,000 or more). First certifications are due April 1, 2028 for businesses with more than $100 million in revenue, 2029 for $50 to $100 million, and 2030 for the rest.
3. 30-day breach notice. Since January 1, 2026, California's breach law requires notice to affected residents within 30 calendar days of discovery, and to the Attorney General within 15 days after that when more than 500 residents are notified.

The audit regulations list the components an assessment must cover, including MFA, encryption, logging and monitoring, and incident response. In 2016 the California Attorney General named the CIS Critical Security Controls as a minimum baseline for reasonable security; that remains the most cited benchmark.

The California Delete Act and DROP

The Delete Act (SB 362) targets registered data brokers. Since January 1, 2026 Californians can submit a single deletion request through the CPPA's Delete Request and Opt-Out Platform (DROP). Since August 1, 2026 data brokers must retrieve requests at least every 45 days, delete the data, and direct their service providers to do the same. Penalties are $200 per day for failing to register and $200 per day for each unprocessed deletion request.

For organizations that are not data brokers, the lesson is architectural: personal information you do not store cannot be breached. Minimizing stored PII, tokenizing payment data and avoiding unnecessary copies shrinks PCI scope, HIPAA exposure and CCPA breach liability at once.

Technical checklist

• MFA or phishing-resistant authentication on all access to the CDE and to systems holding ePHI or sensitive personal information.
• Central collection of audit logs from identity, endpoint, network, cloud, database and payment page sources.
• Automated log review with daily coverage, including weekends and holidays.
• Alerting on failures of logging, EDR, IDS and other critical security controls.
• Log retention of at least 12 months (PCI), stored under your control, with three months searchable.
• Script integrity monitoring on payment pages (PCI 11.6.1).
• Incident response plan tested annually, with breach clocks for HIPAA (60 days), California (30 days) and card brand notification.
• Data inventory and minimization: know where PAN, ePHI and personal information are stored, and remove what is not needed.
• Evidence pack per control, ready for QSA, OCR or CPPA auditors.

Vendor evaluation matrix

Questions to put to a managed detection and response provider, mapped to the requirement each one supports.

For federal incident reporting deadlines that may apply alongside these standards, see the CIRCIA guide. For public company disclosure, see the SEC disclosure guide.