Treasury Services & Bursar's Office

IHOP 04.04.13 Cash Handling and Reporting (www.utmb.edu)

Protecting the Security of Credit Card Information

• Student Tuition and Fees
• Patient Service Payments
• Cash Processing for all UTMB Campuses and Clinic Locations
• Payroll Benefits/Leave of Absence (LOA) Payments
• UTMB Badge and Key Payments
• Scrub Payments

In light of the frequent reports in the news of security breaches involving credit card information, this is an opportune time to review department/clinic responsibilities for protecting the security of its patients/customers.

Treasury Services would like to remind all departments/clinics (credit card merchants) that accept payments via credit cards, of your security responsibilities. Credit card information must not be stored anywhere, including servers, laptops, external disks, or any other electronic manner unless specifically authorized by Treasury Services. Each UTMB department is responsible for any losses due to poor internal controls. Your general obligations and responsibilities include:

1. The Merchant or any agent of the Merchant shall not retain or store magnetic strip data subsequent to the authorization of the sales transaction.
   
2. The Merchant shall not disclose a Cardholder's account information or any other personal information to third parties other than to the Merchant's agent for the sole purpose of assisting such Merchant in completing the transaction or as specifically required by law. Suspicious requests for account information should be reported immediately to Merchant's designated account manager at Bank or to Bank's client services agreement.

Treasury Services is responsible for the coordination of all E-commerce and credit card acceptance throughout UTMB. If your department/clinic is accepting credit cards, you must be registered with Treasury Services. Departments/clinics are required to report any security breaches or suspected breaches to Treasury.

Please make sure that all employees involved in the administration or system support of credit cards are following these policies. Also, please feel free to contact Treasury Services at (409) 772-6619 or email Finance-Treasury@utmb.edu with any questions.

Additional References:

• PCI Security Standards
• Mastercard
• Visa
• American Express
• Payment Card Industry (PCI) Data Security Standard and Payment Application Data Security Standard

A standard created by MasterCard, Visa, American Express, and Discover to enhance global payment account data security. PCI DSS compliance is mandatory for all UTMB merchants.

PCI Security Standards

PCI Homepage - https://www.pcisecuritystandards.org/index.shtml

• Provide UTMB Tax Exempt Forms
• Provide UTMB Sam's Club Membership Cards (for work-related purchases)
• Issue ClinCards
  • ClinCard Application Form
• Process Departmental Deposits, Checks, and Payment Pick-Up
• Patient Belongings

All departmental/clinical staff members working for UTMB who handle cash are required to successfully complete the Treasury cash handling training. Training is required within 30 days of being hired by UTMB into a cash handling role. When training has been successfully completed, a certificate will be presented to participant. Training is required biannually.

Treasury's cash handling training is available as an online course through UTMB Learn:

https://learn.utmb.edu/

The department of Treasury has the following responsibilities with regards to the acceptance of credit cards (Visa, MasterCard, Discover, and American Express) on UTMB campus:

• Answering any questions concerning accepting credit cards by various departments/clinics and schools at UTMB
• Issuing and maintaining all equipment necessary to accept credit cards at UTMB
• Serves as the first point of contact for any credit card inquiry for UTMB

Becoming a Credit Card Accepting Merchant

• In order to accept credit card payments in return for goods/services, departments/clinics must review and complete the Credit Card Terminal Installation Evaluation/Setup Sheet
• Departments/clinics who wish to accept credit cards through their UTMB website must first contact Treasury Services. If appropriate, the department/clinic would then complete the Web Commerce Application

These documents are to be returned to:

Treasury Services
Rte. 0999
Fax: (409) 747-7241
Finance-Treasury@utmb.edu

It will take approximately three weeks for Merchant numbers to be requested/set up and to obtain the equipment as needed. Training sessions for you and your staff with Treasury will then be scheduled if desired.

Equipment & Supplies

If you experience problems with equipment, please contact Treasury Services. The problem will be assessed and a replacement terminal will be issued, if necessary. Malfunctioning equipment must be returned to Treasury. Signage (Visa/MC, Discover, AMEX logo stickers are also available.

Supplies such as thermal receipt paper and replacement ink ribbon cartridges should be requested through the Deposit Office. Please call (409) 772-2503.

Credit Card Transaction Processing

Please note that the credit card terminals must be settled daily, at the close of business. This ensures your department/clinic is assessed the least amount of fees from each credit card company.

Additionally, Visa and MasterCard rules require that you retain legible copies of all sales drafts for up to 18 months in order to satisfy any disputes/chargebacks. After the 18 month period is up, you should shred the sales drafts in order to protect card holder information.