A client pays for a dental cleaning at the front desk. Another calls to cover a boarding deposit over the phone. A third refills flea and tick medication through your online pharmacy. In one morning, your veterinary clinic has handled card payments in three different ways, and each method comes with its own security considerations.
Most veterinary practice owners know that PCI has something to do with credit cards, but understanding exactly what it requires can be challenging. This guide explains the basics of PCI DSS, the payment security risks veterinary clinics should consider, and the steps your IT environment can take to help protect payment information.
The Quick Answer
Yes. Any veterinary clinic that accepts Visa, Mastercard, American Express or Discover must follow the Payment Card Industry Data Security Standard (PCI DSS). The requirement comes through the clinic’s merchant agreement with its payment processor.
The current version, PCI DSS v4.0.1, has been fully in effect since March 31, 2025. Many small clinics validate their compliance each year with a Self-Assessment Questionnaire (SAQ), and the right questionnaire depends on how the clinic accepts and processes payments.
What PCI DSS Is, and Why It Applies to Your Clinic
PCI DSS is a global security standard designed to protect payment card data. It is maintained by the PCI Security Standards Council, established by the major payment card brands.
PCI DSS is not a federal law in itself. Compliance is required through the contractual arrangements businesses have with their payment processors and acquiring banks. That makes it different from HIPAA, which does not apply to veterinary records, yet PCI DSS still applies to every clinic that takes cards.
That contractual requirement is easy to overlook until a problem occurs. A payment card breach can expose a veterinary clinic to investigation costs, contractual penalties, additional compliance requirements, potential liability and reputational damage. Having an incident response plan in place before that happens makes a real difference.
What changed in 2025?
PCI DSS v4.0.1 includes requirements that were initially future-dated to give organizations time to prepare. Those requirements became effective on March 31, 2025.
If your clinic last reviewed its payment security before that date, it is worth checking whether your controls and compliance documentation need updating.
The Myth That Trips Up Most Veterinary Clinics
“Our payments are integrated with our practice management software, so the vendor handles PCI.”
Integrated payment solutions, like those offered with many practice management systems (see Cornerstone vs. AVImark: What It Means for Your Veterinary IT Setup), can help reduce the scope of your PCI DSS obligations by limiting how payment information enters and moves through your systems.
However, using a third-party payment processor does not automatically make your clinic compliant. Your clinic is still responsible for completing the appropriate compliance assessment, protecting the network connected to your payment devices, controlling staff access and following secure payment-handling procedures. Knowing exactly where your vendor’s responsibilities end is a core part of managing third-party risk.
Which SAQ Fits Your Veterinary Clinic?
A Self-Assessment Questionnaire (SAQ) helps eligible merchants assess their compliance with PCI DSS requirements. The correct questionnaire depends on how your clinic accepts and processes payments, which systems handle cardholder data, and whether your environment meets the eligibility criteria for a particular SAQ.
The following SAQ types are often relevant to veterinary practices:
- SAQ P2PE: For eligible merchants using only payment terminals that are part of a validated, PCI-listed Point-to-Point Encryption (P2PE) solution.
- SAQ B-IP: For eligible merchants using only standalone, PTS-approved payment terminals with an IP connection to the processor. The terminals can’t be managed from a back-office server or connected to other systems.
- SAQ C-VT: For eligible merchants who key in one transaction at a time into a web-based virtual terminal on an internet-connected computer, such as for phone payments.
- SAQ A: For eligible e-commerce merchants that fully outsource payment processing to a PCI-validated provider. Since March 31, 2025, merchants must also confirm their website is not susceptible to script-based attacks that could affect their e-commerce systems.
- SAQ A-EP: For e-commerce merchants whose website affects the security of the payment page but doesn’t qualify for SAQ A. It contains many more requirements.
- SAQ D: For merchant environments that do not qualify for another SAQ.
These questionnaires are not interchangeable. For example, accepting payments at the front desk and using a virtual terminal for telephone payments may involve different considerations. Your payment processor or acquiring bank can confirm which questionnaire applies, and a qualified PCI professional can help clarify more complex environments.
Five Payment Risks Unique to Veterinary Practices
Veterinary clinics often handle payments while managing appointments, urgent visits, prescription refills and client inquiries. These busy workflows can create opportunities for payment information to be exposed.
1. Phone Payments Written on Sticky Notes
A receptionist takes a card number over the phone and writes it down to process later. That paper now contains sensitive payment information and could be lost, viewed by unauthorized people or discarded improperly.
What to do: Use your processor’s approved method for telephone payments. Enter card details directly into the authorized terminal or virtual terminal, and never write down or retain card information.
2. Card Numbers in Practice Management Notes or Email
Staff might enter payment details into a client record, appointment note, spreadsheet or email to make a future transaction easier. This exposes cardholder data to systems and people that do not need access to it and can greatly increase the scope of your PCI obligations.
What to do: Never use client notes, spreadsheets or email to store card numbers. Use approved payment tools and follow your processor’s procedures for handling sensitive information.
3. Payment Terminals Connected to Insecure Networks
Payment terminals need network connectivity to communicate with payment processors. If the surrounding network is poorly configured, a compromised device or unauthorized access can put payment systems at risk. A guest Wi-Fi network that shares space with card terminals is a common example.
What to do: Isolate payment systems from guest Wi-Fi and other business systems. Your IT provider should design and maintain this setup as part of your cybersecurity solutions.
4. Online Pharmacy and Store Checkout Pages
Veterinary clinics that sell medication, pet food or other products online must consider the security of their payment pages.
PCI DSS v4.0.1 includes requirements addressing payment-page scripts and detecting unauthorized changes that could let attackers steal payment information. Requirements 6.4.3 and 11.6.1 are particularly relevant to certain e-commerce payment environments.
In January 2025, the PCI Security Standards Council removed Requirements 6.4.3, 11.6.1 and 12.3.1 from SAQ A. It replaced them with a new eligibility criterion: merchants must confirm their site is not susceptible to script attacks. Merchants that can’t confirm this generally need to complete SAQ A-EP instead.
What to do: Work with your website provider and payment processor to understand how your checkout works, who manages its security and which requirements apply. A fully outsourced payment page and an embedded checkout can have different compliance implications.
5. Shared Logins on Payment Portals
When several employees share one payment portal login, it becomes impossible to tell who processed a refund, changed an account setting or accessed sensitive information. Shared credentials also increase the impact of a compromised account, and they’re one of the signs your access may be out of control.
What to do: Use individual accounts, assign permissions according to job responsibilities and enable multi-factor authentication wherever it’s supported.
A Practical PCI Checklist for Small Veterinary Clinics
You do not need to understand every technical requirement to start improving your payment security. Begin with these practical steps:
- Confirm which SAQ and validation process apply to your payment environment.
- Use payment terminals and solutions approved by your processor.
- Isolate payment devices from guest Wi-Fi and other networks.
- Process telephone payments through an approved terminal or virtual terminal.
- Never store card numbers in practice management notes, spreadsheets or email.
- Give staff individual accounts and enable multi-factor authentication.
- Keep firewalls, routers, workstations and software updated.
- Keep an inventory of payment devices and check them for signs of tampering or replacement.
- Review your payment security and PCI scope at least annually, ideally as part of a regular IT risk assessment, and after significant changes to your systems or payment arrangements.
- Train front-desk staff to recognize unsafe payment-handling practices and report suspicious activity.
These steps build a stronger security environment, but completing the checklist alone does not establish PCI DSS compliance. Your clinic must still meet the requirements that apply to its payment setup.
How Tier3MD Helps Veterinary Clinics Secure Payments
Tier3MD’s Veterinary IT Management service supports animal hospitals and clinics across Georgia and the Southeast, including practices in Atlanta, Marietta, Alpharetta and Johns Creek. For payment security, that includes:
- 24/7 network monitoring and management: Keeping the network your card terminals and practice software rely on stable and watched around the clock.
- Ransomware protection and a Security Operations Center (SOC): Detecting and stopping threats before they reach payment systems or patient records.
- External vulnerability scanning and penetration testing: Finding weak spots in your network before attackers do.
- Dark web monitoring: Alerting you when staff login details appear for sale, a common route into payment portals and email.
- Security risk assessments: Reviewing your systems for weaknesses and prioritizing the fixes that matter most.
With the right IT support, your team can understand its responsibilities, close potential weaknesses and keep everyday payment transactions secure.
Frequently Asked Questions
Is PCI compliance required by law for veterinary clinics?
PCI DSS is a contractual security standard rather than a federal law. Veterinary clinics that accept major payment cards are required to comply through their merchant agreements. Specific validation obligations depend on the clinic’s payment arrangements.
Does an integrated payment system make our clinic PCI compliant?
No. Integrated payment solutions can reduce the scope of your compliance obligations, but they do not automatically make your clinic compliant. You must still meet the requirements that apply to your environment, including assessment, access control and network security.
How often does a veterinary clinic need to complete a PCI SAQ?
Most eligible small merchants complete their SAQ annually, though exact validation requirements depend on the payment brand, acquiring bank and merchant agreement. You should also reassess your payment environment after significant changes, such as switching processors or adding a new payment method.
Can we accept card payments over the phone?
Yes. Staff should enter card details directly into the authorized payment system approved by your processor and never write down or store card information.
Our clinic sells medication online. Does that change our PCI requirements?
It can. Online payments introduce additional considerations, particularly when your website hosts or embeds payment functionality. A fully outsourced checkout may simplify some responsibilities, but your clinic should confirm which requirements apply to its specific setup.
Make Every Payment a Safe One
Your clients trust you with their pets and their payment information. Protecting that information takes more than choosing a payment processor. It means understanding your compliance responsibilities, securing connected systems and helping staff follow safe payment-handling practices.
Tier3MD helps veterinary clinics build and maintain IT environments that support secure, reliable day-to-day operations.
Need help reviewing your veterinary clinic’s IT security? Schedule a veterinary IT and payment security review with Tier3MD. Call 855-698-4373 or email Info@Tier3MD.com.
