I have family members who work with medical records in the healthcare field (intentional vagueness). They have to go through a training video, with test, regarding HIPPA annually. They are restricted on what they can say, to whom, how they can communicate electronically, and how physical documents should be protected (= locked up, not a reference to a fire arm). PCI may have crossed the HIPPA line.