# W/ Healthcare Payments — The Patient Balance

**Room:** ROOM-06 · **Portfolio stage:** Later  
**Audience:** Healthcare payments, revenue cycle, patient experience, security, privacy, clinical operations, and provider management

> Shared systems do not make PCI DSS and healthcare obligations interchangeable.

## Consequential question

How can one patient-payment journey preserve separate account-data, privacy, clinical, support, and provider-responsibility views?

## Fictional scenario

A fictional patient pays through a portal, calls support after a failure, and receives a refund while shared identity and contact-center systems support the workflow.

**Pressure:** Teams want one crosswalk to answer every question, but the authorities, data, owners, and evidence differ.

## Five working artifacts

- [ ] Multi-authority journey map
- [ ] Account-data and security-influence graph
- [ ] Identity and support-plane map
- [ ] Provider seam record
- [ ] Authority-specific claim ledger

# Four practice moves

## 1. Trace

**Prompt:** Narrate normal, failure, support, refund, and administrative paths.

**Output:** Complete patient-payment story

## 2. Separate

**Prompt:** Keep PCI DSS, privacy, clinical, contractual, and operational questions in their own authority lanes.

**Output:** Authority overlay

## 3. Connect

**Prompt:** Show shared identities, devices, services, providers, and support capabilities without claiming equivalence.

**Output:** Relationship graph

## 4. Bound

**Prompt:** State what each evidence set supports and which reviewer can conclude what.

**Output:** Claim boundary

## Bounded decision output

A dual-boundary case that connects shared facts while preserving distinct authorities.

## Pilot format

Healthcare security and privacy reviewers independently mark authority overreach in the same fictional case, then reconcile the boundaries.

## Stop rule

Stop if patient data enters the room or the exercise implies HIPAA conclusions, framework equivalence, healthcare advice, or an assessment result.

## Reviewed reading route

- WACK-CONTENT-0120
- WACK-CONTENT-0116
- WACK-CONTENT-0122
- WACK-CONTENT-0130
- WACK-CONTENT-0158

## Program boundary

W/ Practice Rooms is practitioner-developed commissioning material. It is not PCI SSC guidance, not an assessment, not a compliance result, not an accredited curriculum, not professional certification, and not legal, financial, healthcare, public-sector, employment, or product-validation advice. Every room uses fictional facts and requires its named pilot before expansion.