Your optical counter takes cards all day for frames, lenses and contact lenses. That reader answers to a rulebook outside HIPAA, and PCI compliance for optometrists is easy to assume someone else handles.
An eye-care practice with an optical shop is two businesses on one network: a HIPAA covered entity and a card merchant. If nobody owns the second job, one card reader can pull your front-desk PCs, email and even your EHR into PCI scope.
What’s actually happening in 2026
An optometry practice that takes payment cards at its optical counter is a card merchant, and the Payment Card Industry Data Security Standard (PCI DSS) is written for every business that stores, processes or transmits card data. It sits alongside HIPAA, not under it: the PCI Security Standards Council sets the standard, and the card brands and your acquirer, the bank that processes your card payments, decide how you must prove compliance.
The current version, PCI DSS v4.0.1, dates from June 2024, and 51 requirements that had been best practice became mandatory on March 31, 2025, according to the Council. One covers card terminals: you already needed a terminal list, periodic tampering inspections and staff training, and now a written targeted risk analysis must set how often you inspect. The standard warns that criminals pose as repair technicians or mail a “new” terminal and ask for the real one back.
Online, Recorded Future’s Annual Payment Fraud Intelligence Report: 2025 counted more than 10,500 e-skimmer infections active in 2025, likely compromising over 23 million online transactions, with no apparent drop after the 2025 requirements took effect. If your website embeds a processor’s payment form for contact-lens reorders or bill pay, the Council’s FAQ 1588 (February 2025) says SAQ A merchants must confirm that page isn’t susceptible to script attacks.
Why this is a HIPAA problem, not just a card-brand problem
HIPAA doesn’t require PCI compliance, and PCI DSS doesn’t mention HIPAA. They’re separate rulebooks that land on the same front desk.
They overlap anyway. Under HIPAA, information about payment for health care, including items sold under a prescription, is health information (45 CFR 160.103), so the record of a patient’s prescription-glasses purchase can be PHI and cardholder data at once.
The checkout PC may also be logged into your EHR and email. HIPAA requires an accurate and thorough risk analysis for electronic PHI (45 CFR 164.308(a)(1)(ii)(A)), and a tampered terminal or infected checkout PC on a shared network belongs in it. Under PCI DSS, separating the payment network isn’t required, but without it, “the entire network is in scope.”
What to actually do about it
Find out what you’ve signed up for, then shrink it.
- Ask your acquirer which SAQ applies: the card brands and acquirers decide how you validate, and the Council encourages confirming eligibility with them first.
- Keep a terminal inventory and inspect on a schedule: record each reader’s make, model, location and serial number, photograph it so a swapped casing or added part stands out, and train staff to verify anyone who arrives to “service” it.
- Keep card numbers out of chart notes and email: any system storing card data is in PCI scope, stored card numbers must be unreadable and emailed ones encrypted, and security codes can’t be kept after authorization.
- Separate payment devices from the clinical network: proper isolation can keep EHR workstations out of PCI scope and limits what a compromised terminal can reach.
- Check what scripts run on any online checkout: e-skimmers hide in page scripts, so monitor the payment page or get your provider’s script protections confirmed in writing.
Where ACS fits in
ACS’s free 30-minute cybersecurity assessment isn’t a PCI audit. It reviews where your card readers sit on the network, whether card numbers end up in email or chart notes, and what your checkout page loads. If nobody owns network separation month to month, that’s what managed IT services for medical practices covers; see managed IT pricing.
