������Ƶ

Policy Contact: Accounts Receivable

1. Purpose

   This policy provides guidance for University departments currently accepting credit card payments for goods or services for deposit to University accounts in compliance with the Payment Card Industry (“PCI”) Data Security Standards (“DSS”).

2. Definitions
    
   1. Card Holder Data (“CHD”): refers to a cardholder’s card number, expiration date, PIN, and the 3 or 4 digit CAV2/CVC2/CVV2/CID number on the back of the credit card.
       
3. Policy
    
   1. University employees are required to comply with all applicable laws, rules, regulations and policies pertaining to the acceptance of credit card payments for goods or services at the University, including those standards set by the PCI.
       
   2. All University employees involved in the collection, processing, storage, or transmission of CHD are required to participate in PCI Awareness Training as provided by the University prior to their handling of CHD.
      1. Student employees at the University who handle the processing of more than one (1) credit card transaction at a time (i.e. bulk transactions) must have a background check conducted and participate in PCI Awareness Training as provided by the University prior to their handling of CHD.
          
   3. All departments at the University who process CHD must document specific departmental procedures for the collection and processing of CHD. These procedures must include, not exclusively, the following:
      1. Steps to process CHD received in person, by mail, by telephone, and/or via electronic communications in adherence with this policy;
      2. A ‘start of day’ process including instructions that all credit card terminals should be checked to ensure the tamper resistant seal on the bottom of the terminal is intact, documented as being so; and
      3. An ‘end of day’ process including an instruction that credit card terminals shall be batched out each day.
          
   4. The physical location of all credit card terminals at the University must be approved by the University’s PCI Compliance Officer, successor, or designee.
       
   5. No agreement or contract associated with the collection, storage, processing, or transmission of CHD shall be entered into without the review and approval of the University’s PCI Compliance Officer, successor, or designee. This includes the handling of credit card processing through third parties.
       
   6. Access to credit card information at the University shall be limited to departmental employees on a “need-to-know” basis. Unauthorized personnel, including custodial staff, shall not be permitted access to CHD.
       
   7. Collection of CHD
      1. Collection of CHD using an electronic fax machine is discouraged, but permitted at the University.
         1. The fax machine must be accessible to departmental staff only.
         2. Departments accepting CHD via fax cannot use the option that converts faxes to electronic documents.
      2. Collection of CHD over the telephone or through mail is discouraged, but permitted at the University if all other procedures are followed as set forth in this policy.
      3. Collection of CHD through electronic mail (e-mail) is not permitted at the University.
         1. In the event that CHD is delivered via e-mail, individuals must immediately notify the University’s PCI Compliance Officer, or designee, with the circumstances of the email: date, time, from address, to address, and subject line - In the body, include the last 4 digits of the CC number involved– format (ie. XXXXXXXXXXXX1234). The email containing the CHD must not be forwarded during this notification process.
         2. Following notification to the University’s PCI Compliance Officer, individuals must delete the e-mail message by highlighting the e-mail message in Outlook and using ‘shift+delete’ with confirmation, or by deleting the e-mail message and then immediately emptying their ‘deleted items’ folder.
         3. The credit card payment must not be processed from the e-mail. Instead, the individual must contact the donor/customer directly via telephone or e-mail (do not reply to the original e-mail, but create a new e-mail message) and indicate that the University cannot accept CHD via e-mail and request the information is provided over the telephone.
             
   8. Storage of CHD
      1. Electronic storage of credit card information is not permitted at the University under any circumstances.
      2. Temporary physical storage of CHD is permitted at the University, provided that any document containing CHD is stored in a locked cabinet/file for a maximum of two (2) business days. If it is necessary to store documents with CHD for more than two (2) business days, individuals must receive approval from the University’s PCI Compliance Officer, successor, or designee.
      3. Permanent physical storage of CHD is not permitted. CHD on documents or forms must be destroyed using a cross-cut or micro shredder. Destroying the information with a strip shredder is not sufficient.
          
   9. The transportation of CHD from one place to another for any reason shall be limited to employees who have regular access to the CHD. The transportation must occur in a secure, locked device.
       
   10. All in-person, telephone, mail, and fax credit card payments at the University shall use Elavon Merchant Services devices, or any other device as approved by the University.
        
   11. All online/e-commerce credit card payments at the University shall be processed using Elavon Merchant Services and Authorize.Net applications, or any other service as approved by the University.

4. Responsible Administrator

   The Vice President for Finance and Budget, or designee, is responsible for the annual and ad hoc review of this policy and its procedures. The University President is responsible for approval of this policy.

Approved by President on 09/29/2015.

Sources: