Lance's Corner

New Payment Card Industry Data Security Standard 4.0 Effective as of April 1, 2025

Apr 22, 2025

Per the notice below, credit card companies have implemented a new Payment Card Industry Data Security Standard effective as of April 1, 2025.  While the new standard is not a matter of law, credit card companies insist on compliance with the standard by all merchants, including dental practices, in order to process credit card transactions.

As of April 1, 2025, all merchants and third-party service providers (TPSPs) involved in processing credit or debit card payments must fully adhere to the enhanced security requirements outlined in the Payment Card Industry Data Security Standard 4.0 (PCI DSS 4.0).  Requirements marked “best practice” are no longer optional and must be fully implemented and tested.  PCI DSS 4.0 was years in the making and intended by the card brands and others to reduce card fraud by instilling more robust security and policy standards.  The April 1 date was the culmination of various grace periods and the PCI Security Council’s staged implementation of PCI DSS 4.0.  If your organization has not yet achieved compliance with PCI DSS 4.0, it is imperative to take action to avoid potential fines, penalties, and assessments.

UNDERSTANDING PCI DSS AND ITS APPLICABILITY

PCI DSS is a comprehensive set of security standards designed to ensure that all entities involved in processing, storing, or transmitting payment card information maintain a secure environment.  This standard applies universally to all merchants and TPSPs, regardless of the method used for card processing – be it e-commerce platforms, call centers, in-store payment terminals, or other channels.  Even TPSPs that can affect the security of card processing or the card processing environment are required to comply with PCI DSS.

KEY OBLIGATIONS UNDER PCI DSS 4.0

With the enforcement date of April 1, 2025, now in effect, organizations must ensure they have implemented critical requirements.  Examples include the following:

  1. Defining PCI DSS Scope: Organizations must annually (or every six months for TPSPs) define and document the scope of their PCI DSS assessment.  This involves identifying all system components, people, and processes that interact with cardholder data, and ensuring that roles and responsibilities across multiple controls are clearly documented.
  2. Payment Page Scripts: Organizations must implement controls for all payment page scripts executed in consumers’ browsers to prevent unauthorized modifications and potential data breaches.
  3. Automated Technical Solutions: Organizations must deploy automated solutions for public-facing web applications to continually detect and prevent web-based attacks.
  4. TPSP Monitoring and Response: Organizations must enhance monitoring capabilities and establish protocols for obtaining and reviewing documentation from TPSPs to ensure their compliance and promptly address any security incidents.
  5. Targeted Risk Analyses: Organizations must conduct targeted risk analyses for several controls, necessitating granular assessments to identify and mitigate specific vulnerabilities within the cardholder data environment.
  6. Enhanced Encryption Requirements: Organizations must implement robust encryption measures, especially when using whole-disk encryption, to protect cardholder data effectively.

ADDRESSING COMMON MISCONCEPTIONS

It is crucial to dispel certain misconceptions surrounding PCI DSS 4.0 compliance:

  • Outsourcing Card Functions Does Not Relieve a Merchant of PCI DSS Obligations: Even if your organization outsources card processing functions to third-party platforms and does not store card numbers, you are still obligated to complete an annual PCI Self-Assessment Questionnaire (SAQ) and document an Attestation of Compliance (AOC).  Outsourcing card functions does not exempt merchants from PCI DSS responsibilities.
  • PCI DSS Compliance Requires More than IT Department Input: PCI DSS 4.0 is not solely a technology standard confined to the IT department.  It encompasses a variety of risks associated with people, processes, and technology.  Achieving compliance often requires a collaborative approach involving multiple departments, including legal, compliance, procurement, vendor management, and IT security.

IMPACT ON THIRD-PARTY VENDORS AND SERVICE PROVIDERS

With the enforcement of PCI DSS 4.0, there is an increased emphasis on the security of third-party vendors and service providers.  Organizations must ensure that their partners are also compliant with the new standards.  This involves conducting thorough due diligence, establishing contractual agreements that mandate compliance, obtaining third-party AOCs, and regularly assessing third-party security practices.

Compliance with PCI DSS 4.0 may take significant effort – concerted, focused, and prompt action is necessary, given that the April 1, 2025, deadline has passed.  Noncompliance can result in significant financial penalties, legal ramifications, and damage to your organization’s reputation.  All entities subject to PCI DSS 4.0 should prioritize conducting a comprehensive gap analysis, updating security policies, implementing required technical controls, and training staff on new procedures to align with PCI DSS 4.0 requirements.  By understanding these risks and taking appropriate measures to mitigate them, companies can ensure a smooth transition to the new PCI 4.0 standards and maintain a strong security posture.

USDOL Issues Comprehensive Employer Guidance on Long COVID

The United States Department of Labor (USDOL) has issued a comprehensive set of resources that can be accessed below for employers on dealing with Long COVID.

Supporting Employees with Long COVID: A Guide for Employers

The “Supporting Employees with Long COVID” guide from the USDOL-funded Employer Assistance and Resource Network on Disability Inclusion (EARN) and Job Accommodation Network (JAN) addresses the basics of Long COVID, including its intersection with mental health, and common workplace supports for different symptoms.  It also explores employers’ responsibilities to provide reasonable accommodations and answers frequently asked questions about Long COVID and employment, including inquiries related to telework and leave.

Download the guide

Accommodation and Compliance: Long COVID

The Long COVID Accommodation and Compliance webpage from the USDOL-funded Job Accommodation Network (JAN) helps employers and employees understand strategies for supporting workers with Long COVID.  Topics include Long COVID in the context of disability under the Americans with Disabilities Act (ADA), specific accommodation ideas based on limitations or work-related functions, common situations and solutions, and questions to consider when identifying effective accommodations for employees with Long COVID.  Find this and other Long COVID resources from JAN, below:

Long COVID, Disability and Underserved Communities: Recommendations for Employers

The research-to-practice brief “Long COVID, Disability and Underserved Communities” synthesizes an extensive review of documents, literature and data sources, conducted by the USDOL-funded Employer Assistance and Resource Network on Disability Inclusion (EARN) on the impact of Long COVID on employment, with a focus on demographic differences.  It also outlines recommended actions organizations can take to create a supportive and inclusive workplace culture for people with Long COVID, especially those with disabilities who belong to other historically underserved groups.

Read the brief

Long COVID and Disability Accommodations in the Workplace

The policy brief “Long COVID and Disability Accommodations in the Workplace” explores Long COVID’s impact on the workforce and provides examples of policy actions different states are taking to help affected people remain at work or return when ready.  It was developed by the National Conference of State Legislatures (NCSL) as part of its involvement in USDOL’s State Exchange on Employment and Disability (SEED) initiative.

Download the policy brief

Understanding and Addressing the Workplace Challenges Related to Long COVID

The report “Understanding and Addressing the Workplace Challenges Related to Long COVID” summarizes key themes and takeaways from an ePolicyWorks national online dialogue through which members of the public were invited to share their experiences and insights regarding workplace challenges posed by Long COVID.  The dialogue took place during summer 2022 and was hosted by USDOL and its agencies in collaboration with the Centers for Disease Control and Prevention and the U.S. Surgeon General.

Download the report

Working with Long COVID

The USDOL-published “Working with Long COVID” fact sheet shares strategies for supporting workers with Long COVID, including accommodations for common symptoms and resources for further guidance and assistance with specific situations.

Download the fact sheet

COVID-19: Long-Term Symptoms

This USDOL motion graphic informs workers with Long COVID that they may be entitled to temporary or long-term supports to help them stay on the job or return to work when ready, and shares where they can find related assistance.

Watch the motion graphic

A Personal Story of Long COVID and Disability Disclosure

In the podcast “A Personal Story of Long COVID and Disability Disclosure,” Pam Bingham, senior program manager for Intuit’s Diversity, Equity and Inclusion in Tech team, shares her personal experience of navigating Long COVID symptoms at work.  The segment was produced by the USDOL-funded Partnership on Employment and Accessible Technology (PEAT) as part of its ongoing “Future of Work” podcast series.

Listen to the podcast

HHS OIG Issues Annual Report on State MFCUs

Per the notice below, the Office of the Inspector General (OIG) of the United States Department of Health and Human Services (HHS) has issued its annual report on the performance of state Medicaid Fraud Control Units (MFCUs).

Medicaid Fraud Control Units Fiscal Year 2023 Annual Report (OEI-09-24-00200) 

Medicaid Fraud Control Units (MFCUs) investigate and prosecute Medicaid provider fraud and patient abuse or neglect. OIG is the Federal agency that oversees and annually approves federal funding for MFCUs through a recertification process. This new report analyzed the statistical data on annual case outcomes—such as convictions, civil settlements and judgments, and recoveries—that the 53 MFCUs submitted for Fiscal Year 2023.  New York data is as follows:

Outcomes

  • Investigations1 - 556
  • Indicted/Charged - 9
  • Convictions - 8
  • Civil Settlements/Judgments - 28
  • Recoveries2 - $73,204,518

Resources

  • MFCU Expenditures3 - $55,964,293
  • Staff on Board4 - 257

1Investigations are defined as the total number of open investigations at the end of the fiscal year.

2Recoveries are defined as the amount of money that defendants are required to pay as a result of a settlement, judgment, or prefiling settlement in criminal and civil cases and may not reflect actual collections.  Recoveries may involve cases that include participation by other Federal and State agencies.

3MFCU and Medicaid Expenditures include both State and Federal expenditures.

4Staff on Board is defined as the total number of staff employed by the Unit at the end of the fiscal year.

Read the Full Report

View the Statistical Chart

Engage with the Interactive Map

GAO Issues Report on Medicaid Managed Care Service Denials and Appeal Outcomes

The United States Government Accountability Office (GAO) has issued a report on federal use of state data on Medicaid managed care service denials and appeal outcomes.  GAO found that federal oversight is limited because it doesn't require states to report on Medicaid managed care service denials or appeal outcomes and there has not been much progress on plans to analyze and make the data publicly available.  To read the GAO report on federal use of state data on Medicaid managed care service denials and appeal outcomes, use the first link below.  To read GAO highlights of the report on federal use of state data on Medicaid managed care service denials and appeal outcomes, use the second link below.
https://www.gao.gov/assets/d24106627.pdf  (GAO report on federal use of state data on Medicaid managed care service denials and appeal outcomes)
https://www.gao.gov/assets/d24106627_high.pdf  (GAO highlights on federal use of state data on Medicaid managed care service denials and appeal outcomes)

CMS Issues Latest Medicare Regulatory Activities Update

The Centers for Medicare and Medicaid Services (CMS) has issued its latest update on its regulatory activities in the Medicare program.  While dentistry is only minimally connected to the Medicare program, Medicare drives the majority of health care policies and insurance reimbursement policies throughout the country.  Therefore, it always pays to keep a close eye on what CMS is doing in Medicare.  To read the latest CMS update on its regulatory activities in Medicare, use the link below.
https://www.cms.gov/training-education/medicare-learning-network/newsletter/2024-03-14-mlnc