Privacy and payment rules: HIPAA, GDPR and PCI DSS

ISC Chapter 8 · Area II · Blueprint II.A

Area II begins with the rulebooks. Before you can judge whether a control protects data well enough, you need to know what the law or the industry demands. Priya takes on three clients at once: Riverside Family Clinic, which handles patient records under HIPAA; Brightwater, which now ships to customers in Germany and France and so meets the GDPR; and Brightwater again, because every card it accepts brings the PCI Data Security Standard. You will learn who each set of rules covers, what it protects, the principles and requirements at its heart, and the numbers the exam likes: 60 days, 72 hours, 500 people, 12 requirements.

In this chapter

HIPAA: who is covered and what is protected
HIPAA: permitted uses, disclosures and breaches
GDPR: scope and key concepts
GDPR: principles, lawful bases, rights and breaches
PCI DSS: protecting payment card data
Comparing HIPAA, GDPR and PCI DSS

This chapter has 6 lessons, 51 practice MCQs with explanations and 20 simulations, plus flashcards and a recall sheet.

What this chapter covers

HIPAA covered entities and permitted uses
GDPR scope, six principles and key concepts
PCI DSS requirements

Chapter 7: Data integration and business process models · Chapter 9: NIST frameworks