Call center compliance statistics 2024: TCPA, HIPAA, and PCI DSS

Last updated 2026-07-09

Why do call centers face TCPA, HIPAA, and PCI DSS exposure at the same time?

Most call centers touch all three in a single shift. An agent dials a lead list (TCPA territory), asks for a card number to close a transaction (PCI DSS), and confirms a healthcare appointment or an insurance plan detail on the same call (HIPAA). Three separate federal compliance regimes fire at once, and the penalties for each stack independently.

The Telephone Consumer Protection Act, 47 U.S.C. § 227, governs autodialed calls and texts, prerecorded messages, and calls to numbers on the National Do Not Call Registry ^[1]. The Health Insurance Portability and Accountability Act covers protected health information wherever it flows, including phone conversations and recordings sitting on your servers ^[2]. The Payment Card Industry Data Security Standard is a contractual framework from the card brands (not a federal statute), but violations bring fines from acquiring banks and, after a breach, enormous liability ^[3].

Each framework has a different enforcement mechanism. TCPA is plaintiff-driven: private litigants and class action lawyers file suit. HIPAA enforcement runs through the HHS Office for Civil Rights. PCI DSS violations flow through card brand forensic audits and acquiring bank chargebacks. A call center that slips on all three in the same quarter faces plaintiff lawyers, a federal agency, and its merchant bank at the same time.

That combination is why the numbers across these three frameworks look so expensive. The stats below are real and sourced. They should tell you how much budget and process each one deserves.

What do the core TCPA compliance statistics look like in 2024?

TCPA litigation stayed high after the Supreme Court's 2021 Facebook v. Duguid decision narrowed the definition of an automatic telephone dialing system (ATDS), which briefly looked like it would gut filings ^[4]. It didn't. Plaintiffs pivoted to prerecorded voice claims and reassigned number claims, and class action filings held in the thousands per year.

Average TCPA settlement values are hard to pin down because most settle under confidentiality orders. The public cases tell the story. A few named settlements:

• UnitedHealthcare agreed to pay $2.5 million to resolve alleged TCPA violations tied to telemarketing calls [see /articles/tcpa-basics/unitedhealthcare-to-pay-2-5m-for-alleged-tcpa-violations].
• Truist Bank reached a class action settlement over TCPA claims from unwanted calls [see /articles/tcpa-basics/truist-bank-tcpa-class-action-settlement].
• Credit One Bank has faced multiple TCPA class actions with multi-million dollar outcomes [see /articles/tcpa-basics/credit-one-tcpa-settlement].
• Cash App faced TCPA class action claims tied to text messaging [see /articles/tcpa-basics/cash-app-tcpa-class-action-settlement].
• Albertsons and Safeway reached a TCPA settlement over marketing texts [see /articles/tcpa-basics/albertsons-safeway-tcpa-settlement].

Statutory damages under TCPA are $500 per violation for negligent violations and $1,500 per violation for willful or knowing ones ^[1]. In a class action covering 100,000 calls made without proper consent, the exposure at $500 per call is $50 million before trebling. That math is why TCPA cases settle.

The FCC's January 2024 one-to-one consent rule change, effective January 27, 2025, requires each consent to name a single seller rather than covering a lead generator's whole partner network ^[5]. That's the single biggest compliance shift call centers walked into for 2025. Any team still leaning on bundled consent language from a lead aggregator is now exposed in a way it wasn't before.

To check your exposure before you dial, LeadCompliant's free TCPA checkers let you validate consent workflows without hiring outside counsel for every campaign.

How much do HIPAA violations actually cost call centers and healthcare contact operations?

The HHS Office for Civil Rights has collected over $4.75 billion in HIPAA settlements and civil monetary penalties since enforcement began in 2003, per the HHS OCR enforcement highlights page ^[2]. That figure covers all covered entities and business associates, well beyond call centers, but call centers that handle protected health information (PHI) sit squarely in scope.

HIPAA civil monetary penalties run in tiers. The lowest tier, for violations the entity didn't know about and couldn't have known about with reasonable diligence, starts at $100 per violation and runs up to $50,000 per violation category per year. The highest tier, for willful neglect not corrected, runs $50,000 per violation up to $1.9 million per violation category per year ^[2]. The annual caps get adjusted for inflation; the $1.9 million figure reflects recent adjustments in HHS guidance.

Call centers are business associates under HIPAA when they handle PHI on behalf of a covered entity. A call center that schedules appointments, handles insurance verification, or processes claims information needs a signed Business Associate Agreement (BAA) with each covered entity client and has to apply HIPAA's Security Rule to its own systems.

Recording is a specific risk. Call recordings that capture a caller's diagnosis, medication, or insurance details are PHI. Store those recordings without access controls, encryption at rest, or audit logging and you have a Security Rule gap. In 2023 and 2024, HHS OCR entered multiple resolution agreements with entities that failed to encrypt PHI on portable devices and servers, with penalties ranging from $100,000 to over $1 million per case ^[7].

Healthcare call centers should watch the Omnibus Rule's extension of liability to business associates: OCR can fine you directly, on top of your client suing you for breach of contract. That's a real change from the pre-2013 framework many older compliance programs were built around.

What does PCI DSS non-compliance cost a call center compared to staying compliant?

The Ponemon Institute's "Cost of Non-Compliance" research, cited regularly by the PCI Security Standards Council, put the average cost of non-compliance at roughly $14.8 million against an average cost of compliance around $5.5 million. That's a ratio of about 2.7x, which rounds to the "three times" figure you see in PCI discussions ^[3].

Those Ponemon figures are enterprise-level averages and include disruption costs, lost productivity, penalties, and breach remediation. For smaller call centers, the absolute numbers drop but the ratio holds or gets worse, because small operations rarely have the insurance and legal muscle to absorb a breach.

PCI DSS version 4.0 became the mandatory standard on March 31, 2024, replacing version 3.2.1 ^[3]. Version 4.0 adds 64 new requirements over the previous version, many focused on authentication, encryption of cardholder data in transit, and expanded logging. Call centers that take card payments over the phone (agent-assisted or IVR) are in scope regardless of whether they use a third-party payment processor, because the calls themselves can capture card data.

PCI DSS fines flow from card brands to acquiring banks, which pass them to merchants. They range from $5,000 to $100,000 per month for ongoing non-compliance, scaled to the merchant's transaction volume and how long the problem persists ^[3]. Those fines can pile up for months before a merchant even notices the assessments.

The cleanest way to shrink PCI DSS scope in a call center is pause-and-resume recording. The recording system pauses automatically when an agent prompts for card data, then resumes after. That pulls cardholder data out of the recording environment and cuts your PCI scope substantially. It's not a full de-scope (other requirements still apply), but it shrinks the surface area auditors examine.

How do TCPA, HIPAA, and PCI DSS penalty ranges compare side by side?

A comparison table helps here because the three frameworks build penalties in completely different ways.

Framework	Penalty Type	Low End	High End	Who Enforces
TCPA	Per-violation statutory damages	$500/violation	$1,500/violation (willful)	Private plaintiffs, FCC, state AGs
HIPAA	Civil monetary penalties (per category/year)	$100/violation	$1.9M/category/year	HHS Office for Civil Rights
PCI DSS	Monthly non-compliance fines (card brand via acquirer)	$5,000/month	$100,000/month	Card brands (Visa, Mastercard, etc.)
PCI DSS	Post-breach liability (fraud reimbursement)	Varies	Tens of millions	Card brands

The TCPA math multiplies in a way the others don't. A single marketing campaign that fires 500,000 texts without proper consent generates $250 million in potential statutory exposure before any trebling for willfulness. No other consumer protection statute creates per-unit liability at that scale, which is why TCPA settlements dominate the list of largest consumer protection payouts.

HIPAA penalties look smaller per violation, but the annual caps run per violation category, and one breach can span several categories (failure to encrypt, no BAA, no risk assessment). OCR has shown it will layer findings.

PCI DSS fines are the most predictable and the most negotiable, because they move through your commercial relationship with your acquiring bank. Post-breach forensic audit costs and fraud reimbursement, though, can dwarf the monthly fines.

For a call center of 50 to 200 agents, the realistic catastrophic TCPA scenario is a class action in the $5 to $20 million range. Under HIPAA, it's a resolution agreement in the $500,000 to $2 million range. Under PCI DSS, it's breach liability that swings hard with the volume of card data exposed.

What changed in 2024 that call centers need to know about for 2025?

Three things changed in 2024 that carry real compliance weight into 2025.

First, the FCC's one-to-one consent rule. The FCC adopted the rules in December 2023, effective January 27, 2025, requiring TCPA consent for telemarketing calls and texts to be captured one-to-one: one consent, one named seller ^[5]. The days of a consumer checking a box on a lead gen form and consenting to contact from "partners" (sometimes 25 companies deep) are over. The FCC's order says consent must be "logically and topically associated" with the website where it's collected. This is the biggest TCPA change since the 2012 rulemaking.

Second, PCI DSS v4.0 became mandatory March 31, 2024. The new requirements that hit call centers hardest include stronger multi-factor authentication for all access to the cardholder data environment, tighter e-commerce and phishing protections, and new customized implementation options that give larger organizations flexibility at the cost of heavier documentation ^[3].

Third, HHS OCR published proposed HIPAA Security Rule amendments in late 2024, proposing to erase the distinction between "required" and "addressable" implementation specifications and make every Security Rule spec mandatory. As of mid-2025 the rulemaking is still in process, but call centers with healthcare clients should watch it, because it would tighten encryption, audit, and access requirements ^[7].

To track this as it moves, the TCPA news section at LeadCompliant covers FCC orders and major case outcomes as they land.

What percentage of call centers are actually compliant with these frameworks?

Nobody has good data on this. The closest we get comes from a few sources that measure adjacent things.

For PCI DSS, Verizon's Payment Security Report has long tracked compliance among organizations that go through Qualified Security Assessor (QSA) audits. Verizon's 2022 Payment Security Report found that only 43.4% of organizations maintained full PCI DSS compliance throughout the year, down from 27.9% in 2019 (the 2019 number reads counterintuitively lower, and it reflects methodology differences in how "sustained compliance" got measured across report years) ^[8]. Fewer than half of audited organizations stay fully compliant all year.

For HIPAA, there's no equivalent compliance-rate survey. HHS OCR investigates complaints and runs audits, and its audit program has flagged deficiencies in the large majority of audited entities, but the sample sizes are small (the 2016 to 2017 audit program covered roughly 167 covered entities and 41 business associates). Risk analysis failures showed up in a large majority of them.

For TCPA, compliance is harder to measure because the standard hinges on how consent was documented, what dialing technology was used, and whether numbers got scrubbed against the National DNC Registry. The FTC's DNC registry holds over 249 million registered numbers as of 2024 ^[10]. Any campaign that skips that scrub before dialing is already non-compliant, whatever the consent situation.

The honest read: most small and mid-size call centers have gaps in at least one framework, and plenty have gaps in all three. The gaps that get exploited are rarely exotic technical failures. They're procedural. Consent records not retained. DNC scrub not documented. Card data captured in recordings. BAAs never signed with every vendor that touches PHI.

What are the real-world TCPA class action settlement amounts teams should benchmark against?

Settlement amounts swing hard by class size, defendant size, and the quality of the consent documentation (or the lack of it). Based on publicly reported settlements, here's a realistic range.

Small settlements (individual or small class): $50,000 to $500,000. These usually involve a single plaintiff or a small putative class where the defendant had a reasonable consent argument and the class couldn't be certified.

Mid-range class action settlements: $1 million to $10 million. The Kaiser TCPA settlement and similar healthcare-adjacent cases land here [see /articles/tcpa-basics/kaiser-tcpa-settlement-claim-deadline]. These typically involve defendants with some consent documentation problems, but not a total absence of consent practices.

Large class action settlements: $10 million to $75 million. Financial services firms, telecom companies, and big retailers with high call and text volumes and poor consent practices land in this tier. The Joseph Snyder Credit One TCPA case [see /articles/tcpa-basics/joseph-snyder-credit-one-tcpa] shows what prolonged litigation in this space looks like.

The 47 U.S.C. § 227(b)(3) language is direct: "a person or entity may, if otherwise permitted by the laws or rules of court of a State, bring in an appropriate court of that State an action based on a violation of this subsection or the regulations prescribed under this subsection to recover" $500 per violation, trebled to $1,500 for willful violations ^[1]. Courts read each individual call or text as a separate violation.

The risk isn't spread evenly. Teams using third-party lead lists without verifying the consent chain face far more exposure than teams with strong first-party consent records. If you can't produce a timestamped consent record showing the specific person, the exact disclosure language they saw, and the IP address or signature that confirmed it, you're arguing an unsupported position in discovery.

How does call recording intersect with all three compliance frameworks at once?

Call recording is where TCPA, HIPAA, and PCI DSS collide most practically for a contact center.

On the TCPA side, recording a call without consent in a two-party consent state (California, Florida, Illinois, and others) isn't a TCPA violation by itself, but it creates state wiretapping liability. The TCPA connection is indirect: recordings get used in litigation as evidence of whether the right TCPA disclosures were actually made.

On the HIPAA side, call recordings that capture PHI are PHI. A recording of a patient asking about a prescription refill, a diagnosis code, or insurance benefits is protected health information sitting on your servers. Your recording storage infrastructure has to meet the HIPAA Security Rule: encryption at rest, access controls, audit logs, minimum necessary access ^[7]. If you run on a cloud contact center platform, your agreement with that vendor needs a BAA.

On the PCI DSS side, any recording that captures a spoken card number, expiration date, or CVV is in scope. CVV data specifically can never be stored after authorization, even for a moment, under PCI DSS Requirement 3 ^[3]. A recording that captures a caller reading out a CVV can amount to prohibited storage of sensitive authentication data, which is a serious PCI violation whether or not a breach ever happens.

Pause-and-resume recording solves the PCI problem cleanly. For HIPAA, the fix is vendor BAAs and proper security controls on the recording storage environment. For the state wiretapping angle, the standard move is a disclosure played at the start of every inbound and outbound call. None of these three fixes conflict, and you can put them all into a single technical configuration.

If you're building out text and call programs, understanding text message marketing consent requirements matters as much as the recording controls.

What does a practical compliance checklist look like across all three frameworks?

No single federal framework covers TCPA, HIPAA, and PCI DSS in one place, which is exactly why call centers fall through the cracks. Each one carries its own documentation requirements, and the documentation is where enforcement agencies and plaintiff lawyers look first.

For TCPA, the minimum documentation set is:

• Written or electronic consent records with timestamps, IP addresses, and the exact disclosure text the consumer saw
• Call disposition records showing DNC scrub dates and results
• ATDS documentation showing what dialing technology was used and how it was configured
• An internal DNC list with the date each number was added and the reason
• Consent revocation logs (you must honor opt-outs within a reasonable time, and the FCC has pointed to 10 business days as the outer limit for DNC requests)

For HIPAA, if you handle any PHI:

• Signed BAAs with every covered entity client and every downstream vendor that touches PHI
• A completed and documented risk analysis (the most commonly cited deficiency in OCR audits)
• Access control policies and documented user access reviews
• Audit logs on systems that store or transmit PHI
• Workforce training records with dates and content
• An incident response and breach notification procedure

For PCI DSS:

• A current Self-Assessment Questionnaire (SAQ) or QSA Report on Compliance for your merchant level
• Network diagrams showing cardholder data flows
• Evidence of quarterly vulnerability scans by an Approved Scanning Vendor (ASV)
• Pause-and-resume or similar controls for call recordings
• Tokenization or point-to-point encryption documentation

This documentation isn't box-checking. In a TCPA lawsuit, consent records are the first thing produced in discovery. In an OCR investigation, the risk analysis is the first thing requested. In a PCI forensic audit, the network diagram and data flow documentation anchor the whole thing. Teams without these documents ready face adverse inferences and longer, pricier proceedings.

For a one-time build of this foundation, compliance kits that bundle the required document templates and consent audit tools can cut setup time sharply against building from scratch. LeadCompliant's compliance kit covers the TCPA and consent side of this structure.

What are the biggest compliance mistakes call centers make in practice?

Read the public record of TCPA settlements, HIPAA resolution agreements, and PCI DSS breach case studies and a few failure patterns repeat across organizations of every size.

The biggest TCPA mistake is buying lead lists without verifying consent provenance. The consent a lead aggregator attaches to a phone number may be months old, may have come from a form that never named your company, or may have been manufactured. Since January 2025, bundled consent doesn't satisfy TCPA at all. If you're calling numbers from a purchased list and you can't trace the consent record back to a disclosure that named your company specifically, you're holding statutory liability.

The biggest HIPAA mistake for call centers is treating BAAs as a one-time setup task. Business associate relationships change. You add a cloud storage vendor, switch recording platforms, integrate a new CRM. Each one needs a BAA if the vendor will touch PHI, and most organizations have no process for spotting new vendor relationships that trigger BAA obligations.

The biggest PCI DSS mistake is scope creep: assuming your payment processor handles PCI compliance for you. Your processor handles its own scope. If card data touches your call center infrastructure at all, even briefly, you have your own scope. The most common finding in PCI audits is a call center that thought it was out of scope because it used a third-party processor, while its IVR or recording system was actually capturing card data.

A second PCI mistake is ignoring the v4.0 timeline. Organizations that filed SAQs under v3.2.1 after March 2024 were non-compliant with the mandatory v4.0 standard. The transition wasn't optional, and the card brands are enforcing it through acquirers.

For teams working out how to stop robocall-related TCPA exposure, the controls overlap heavily with general TCPA compliance hygiene.

What compliance trends should call centers prepare for in 2025 and beyond?

The direction across all three frameworks points toward stricter consent requirements, more granular data controls, and faster enforcement.

On TCPA, the FCC's one-to-one consent rule is already live as of January 27, 2025. The next expected shift is more rulemaking on AI-generated voice calls. The FCC ruled in February 2024 that AI-generated voices in robocalls fall under TCPA's prerecorded voice requirements, which means prior express written consent for any AI voice telemarketing call ^[5]. As AI voice tech gets cheaper and easier to reach, enforcement attention here will grow.

On HIPAA, the proposed Security Rule updates from late 2024 would drop the "addressable" versus "required" distinction, making encryption and multi-factor authentication mandatory rather than optional implementation specifications. If finalized as proposed, many call centers serving healthcare clients would have to upgrade their technical safeguards, especially around remote agent access to PHI-containing systems (a real headache for work-from-home contact center agents).

On PCI DSS, several of the 64 new requirements in v4.0 are "future-dated," meaning they weren't mandatory on March 31, 2024, but became mandatory on March 31, 2025. Those cover stricter targeted risk analysis documentation, stronger anti-phishing controls, and script integrity requirements for e-commerce. Call centers with web-based payment capture in their stack need to know about the March 2025 deadline for these controls ^[3].

State activity keeps building on every front. State attorneys general are now active TCPA enforcers, especially in Florida (FTSA), Oklahoma, and Washington. State health privacy laws in California and Washington stretch some HIPAA-like protections to non-HIPAA-covered entities, which can pull in call centers handling consumer health data outside the traditional covered entity relationship. Tracking TCPA news on an ongoing basis is the only realistic way to stay current across all of it.

Frequently asked questions

How many TCPA lawsuits are filed each year?

Precise annual TCPA filing counts vary by source because many cases file in state court or settle before federal docketing. TCPA cases consistently rank among the most common federal consumer protection class actions: roughly 4,000 to 5,000 federal cases annually in recent years, based on PACER data reviewed by litigation analytics firms. State court filings add to that total. Volume stayed elevated despite the 2021 Facebook v. Duguid decision narrowing the ATDS definition.

What is the average TCPA settlement amount for a class action?

There's no reliable industry-wide average because most settlements are confidential. Publicly reported class action settlements range from under $1 million for small classes to over $75 million for large financial services cases. Mid-market settlements in the $3 million to $15 million range are common for healthcare, financial services, and retail defendants. The statutory exposure math, $500 to $1,500 per call or text, drives settlement values more than any other factor.

Does HIPAA apply to call centers that aren't in healthcare?

HIPAA applies to covered entities (health plans, healthcare clearinghouses, most healthcare providers) and their business associates. A call center that handles PHI on behalf of a covered entity client is a business associate, so HIPAA applies. A call center with no healthcare clients and no PHI is outside HIPAA's scope. The boundary is whether PHI flows through the call center, not whether the call center itself is a healthcare company.

What is PCI DSS and does it apply to phone-based payments?

PCI DSS is the Payment Card Industry Data Security Standard, a set of security requirements created by Visa, Mastercard, American Express, Discover, and JCB. It applies to any organization that stores, processes, or transmits cardholder data, including card numbers taken over the phone by a live agent or via IVR. Phone-based payment environments are in scope for PCI DSS and must meet the standard's requirements, including controls on call recordings that may capture card data.

What changed in TCPA rules for 2024 and 2025?

The FCC adopted a one-to-one consent rule in late 2023, effective January 27, 2025, requiring TCPA consent to name a single seller rather than a network of lead gen partners. The FCC also ruled in February 2024 that AI-generated voices in robocalls fall under TCPA's prerecorded voice requirements, meaning prior express written consent is required for AI voice telemarketing. Both changes significantly affect lead generation and outbound calling operations.

How much can a company be fined for a HIPAA violation?

HIPAA civil monetary penalties range from $100 per violation (for violations the entity didn't know about) to $1.9 million per violation category per year (for willful neglect not corrected). Those caps apply per category, so a breach involving multiple HIPAA failures can trigger multiple separate penalty streams. HHS OCR has collected over $4.75 billion in total HIPAA penalties since enforcement began in 2003, per OCR's published enforcement highlights.

What are the PCI DSS version 4.0 changes that affect call centers?

PCI DSS v4.0 became mandatory March 31, 2024. Key call-center-relevant changes include stronger multi-factor authentication for cardholder data environment access, new customized implementation options requiring heavier documentation, and future-dated requirements (mandatory by March 31, 2025) covering targeted risk analysis documentation and enhanced anti-phishing controls. Organizations still running under v3.2.1 after March 2024 were non-compliant with the mandatory new standard.

Can a call center be sued under TCPA for texts as well as calls?

Yes. The TCPA applies to text messages sent using an automatic telephone dialing system or prerecorded voice. Text message TCPA class actions have grown substantially, often involving marketing SMS campaigns where recipients claim they never gave prior express written consent. The statutory damages of $500 to $1,500 per text apply to each individual message, making large SMS campaigns with consent deficiencies among the highest-exposure TCPA scenarios.

What is the National Do Not Call Registry and how big is it?

The National Do Not Call Registry is maintained by the FTC and lets consumers register their phone numbers to opt out of most commercial telemarketing calls. As of 2024, the registry holds over 249 million registered phone numbers. Telemarketers must scrub their call lists against the registry before dialing and can be fined up to $51,744 per violation for calling a registered number without an applicable exemption like an existing business relationship.

What is the FCC's one-to-one consent rule and when does it take effect?

The FCC adopted the one-to-one consent rule in December 2023; it took effect January 27, 2025. The rule requires TCPA consent for telemarketing to come from a single named seller per consent record, ending the practice of collecting consent to contact a list of unnamed "partner" companies on one lead generation form. The FCC's order also requires that consent be logically and topically related to the content of the website where it was collected.

How do I know if my call center needs a HIPAA Business Associate Agreement?

You need a BAA with a client if you receive, create, maintain, or transmit protected health information on that client's behalf. PHI includes names combined with health information, insurance IDs, diagnosis codes, and similar identifiers. If your agents handle healthcare appointment scheduling, insurance verification, prescription support, or medical billing for a covered entity client, you're a business associate. BAAs must be signed before PHI flows, not after a problem arises.

What compliance documentation do regulators and plaintiffs ask for first in a TCPA or HIPAA investigation?

In TCPA litigation, plaintiffs' counsel typically request consent records (timestamps, IP addresses, disclosure language), call logs, and DNC scrub records in early discovery. In HHS OCR HIPAA investigations, the agency typically requests the entity's risk analysis documentation first, then BAA inventory and security policy records. Both processes reward organizations with pre-built documentation: production is faster, adverse inferences are avoided, and the investigation scope tends to stay narrower.

Are there state laws that are stricter than federal TCPA or HIPAA rules?

Yes, several states have enacted stricter telemarketing and health privacy rules. Florida's Telephone Solicitation Act (FTSA) provides a private right of action for automated calls and texts without consent and doesn't require the caller to be a covered entity under TCPA. California's CMIA and Washington's My Health My Data Act extend health privacy protections beyond HIPAA to cover non-HIPAA entities handling consumer health data. State-level exposure can exceed federal exposure in some scenarios.

How should a small call center (under 50 agents) prioritize compliance spending across TCPA, HIPAA, and PCI DSS?

Prioritize by actual risk exposure. If you do outbound sales calling, TCPA consent documentation is your highest-probability liability: a single class action can exceed your annual revenue. If you handle healthcare client calls, HIPAA BAAs and a basic risk analysis come next and are relatively cheap to put in place. PCI DSS matters if you take card payments; scope reduction through pause-and-resume recording is usually the highest-ROI control. Don't build everything at once. Fix the highest-probability exposure first.

Sources

1. U.S. Code, 47 U.S.C. § 227, Telephone Consumer Protection Act: TCPA statutory damages are $500 per violation and up to $1,500 for willful or knowing violations; governs autodialed calls, prerecorded messages, and DNC Registry compliance
2. HHS Office for Civil Rights, HIPAA Enforcement Highlights: HHS OCR has collected over $4.75 billion in HIPAA settlements and civil monetary penalties since enforcement began in 2003; penalty tiers range from $100 to $1.9 million per violation category per year
3. PCI Security Standards Council, PCI DSS v4.0 Resource Hub: PCI DSS version 4.0 became the mandatory standard March 31, 2024; monthly non-compliance fines range from $5,000 to $100,000; Ponemon research cited by PCI SSC found non-compliance costs approximately 2.7x compliance costs
4. Supreme Court of the United States, Facebook, Inc. v. Duguid, 592 U.S. 395 (2021): The Supreme Court narrowed the ATDS definition under TCPA in 2021, requiring random or sequential number generation; plaintiffs shifted to prerecorded voice and reassigned number claims, and class action volume remained elevated
5. HHS OCR, HIPAA Security Rule Guidance: HIPAA Security Rule requires covered entities and business associates to implement encryption, access controls, audit logging, and conduct risk analysis; OCR proposed rulemaking in 2024 would eliminate addressable vs. required distinction
6. Verizon, 2022 Payment Security Report: Only 43.4% of organizations maintained full PCI DSS compliance throughout the year per Verizon's 2022 Payment Security Report, based on QSA audit data
7. FTC, Telemarketing Sales Rule, 16 CFR Part 310: The Telemarketing Sales Rule requires DNC list scrubbing, call time restrictions, and disclosure requirements for outbound telemarketing calls; FTC enforces alongside TCPA
8. HHS OCR, HIPAA Business Associate Guidance: Business associates are directly subject to HIPAA enforcement under the Omnibus Rule; BAAs must be in place before PHI is shared with any vendor or subcontractor