Script monitoring for healthcare payment and intake pages
A healthcare payment page often carries PHI as well as card data, so a leaking third-party script is a PCI problem and a HIPAA problem at the same time.
Start for free
Talk to an expert
TL;DR
Healthcare and the client-side requirements
THE OBLIGATION
PCI DSS 6.4.3 and 11.6.1 have been mandatory since 31 March 2025 for any page where a cardholder enters, reviews or confirms card data.
THE SPECIFIC DIFFICULTY HERE
Patient intake and payment frequently share a page or a flow, so the data at risk is broader than card data.
WHAT THE TAG PRODUCES
A script inventory with justifications, a weekly header change record, runtime blocking, and an evidence pack for your assessor.
Short on time? A script that can read a card field can read the rest of the form too.
Requirement 6.4.3
Does healthcare need PCI DSS script monitoring?
Yes, if you operate any page where a cardholder enters, reviews or confirms card data, which includes pages that embed a payment iframe. A healthcare payment page often carries PHI as well as card data, so a leaking third-party script is a PCI problem and a HIPAA problem at the same time. Requirements 6.4.3 and 11.6.1 apply to those pages regardless of platform, and have done since 31 March 2025.
Where the exposure is
Patient intake and payment frequently share a page or a flow, so the data at risk is broader than card data
Marketing and analytics tags on patient-facing pages have produced significant regulatory exposure across the sector
Scheduling, insurance verification and payment vendors each add their own scripts
Clinical systems change slowly, so the web layer accumulates tags faster than it sheds them
What the inventory shows you
Every script on payment and intake pages, with what each one reads and where it sends it
Scripts transmitting form data to destinations outside your business-associate agreements
Tags that were added for a campaign and never removed
Header changes on pages carrying both PHI and card data
Requirement 6.4.3 is an authorisation record: every script on the payment page, where it came from, and why it is allowed to be there.
The two requirements, in this context
Frequently asked questions
Read the FAQ
Partly, and it is worth being precise about how. PCI DSS 6.4.3 and 11.6.1 are what the product is built to evidence. The same visibility shows which scripts read form fields and where they send data, which is directly useful for assessing tracking-technology exposure. It is not a HIPAA compliance programme and we would not position it as one.
No. The subject of monitoring is the script, not the visitor. We record which scripts ran, what they were, what they touched and where they sent data. We do not store user-entered values.
Yes. PCI only requires monitoring on payment pages, and nothing stops you scoping other sensitive pages. Page views on those pages count towards your plan like any other.
Commonly in scope in practice, because portals usually include stored-card management and bill payment, both of which are payment pages.
See the scripts on your own payment pages.
Free forever on 1,000 page views a month, no credit card. Unlimited domains on every plan.
Free forever plan. No credit card.