Which option best reflects PCI DSS requirements for Phreesia payments?

• A. Storing card numbers in plaintext on local devices for quick access.
• B. Providing tokenization but no encryption.
• C. Disabling tokenization to simplify processing.
• D. Encrypting card data and using tokenization with strict access controls; regular security assessments.

Answer: (D)

PCI DSS requires protecting cardholder data through strong controls, including encryption for data at rest and in transit, tokenization to minimize exposure of the actual PAN, strict access controls to limit who can view sensitive data, and ongoing security assessments to find and fix vulnerabilities. The best choice aligns with these requirements by combining encryption of card data with tokenization and robust access controls, plus regular security assessments to ensure the environment stays secure over time. This combination reduces the risk of exposure even if some systems are breached and demonstrates ongoing compliance. Storing card numbers in plaintext is not allowed, tokenization alone without encryption leaves data more vulnerable, and turning off tokenization only increases risk.