Do merchants need to include their service providers in the scope of their review?

If you outsource your card processing to a service provider then you should check that they are PCI compliant. Web hosted customers should also ensure the web hosts infrastructure is PCI compliant. This can usually be done by asking your provider via email.