Credit Card Processing

Basis for Policy

It is the policy of the University of Nebraska Medical Center (UNMC) to establish good internal controls over the handling of bank card transactions to adequately safeguard and properly record UNMC assets and to protect the employees who handle those assets. Further, it is the policy of UNMC to comply with all state regulations and the Payment Card Industry Data Security Standards (PCI/DSS).

Definitions

Bank card is defined as credit cards, debit cards, ATM cards and any other card or device, other than cash or checks, issued by a bank or credit union that is normally presented by a person seeking to make payment. The process of paying is considered as the transaction.

Payment Card Industry Data Security Standards (PCI/DSS) are guidance for organizations to assist in providing data security on payment card transactions.

Authority Over Bank Card Transactions

It is the policy of the University of Nebraska Medical Center that all bank card transactions on the UNMC campus will be under the control of the Controller. Web-based bank card transactions must utilize the standard UNMC application provided by Information Technology Services.

Bank Card Reporting

Bank card collections received by departments for UNMC will be submitted along with cash/check collections and a Cash Remittance Report to the Finance Cashier.

Internal Controls

Departments will maintain written detailed internal procedures describing the proper handling of bank card transactions. These internal procedures must address the following, at a minimum;
- The bank card swipe terminal must be located in a position that prohibits direct physical interaction from unauthorized individuals.
- Periodically inspect terminal surfaces to detect tampering (for example, addition of card skimmers to devices), or substitution (for example, by checking the serial number or other device characteristics to verify it has not been swapped with a fraudulent device).
- Personnel involved with bank card transactions must document knowledge of their awareness to attempted tampering or replacement of devices by completing the UNMC PCI 3.0 Point of Sale training material, which will be retained by the Finance Cashier.
Under no circumstances should bank card information be stored on any computer system. This includes, but is not limited to: emails, documents, spreadsheets and databases.
UNMC outsources e-commerce bank card processing. UNMC ITS Application Services has a module which is utilized to bridge the web application which accepts a bank card payment and the card processing company.
- All bank card transactions processed by UNMC Staff, on behalf of the customer, must go through the bank card terminals provided by the Finance Cashier. Under no circumstances, shall a UNMC Staff member enter a bank card number into a UNMC Web Application on behalf of the cardholder.

Auditing Cash Funds

All bank card transactions will be reviewed periodically and confirmed annually to assist in maintaining proper accountability and internal control. In addition, written departmental bank card procedures will be reviewed for conformity with UNMC policies, State Treasurer regulations, and Payment Card Industry Data Security Standards.

Technical Controls

All bank card transactions will be processed in conformance with the Payment Card Industry Data Security Standards. A secure network environment is established for processing of bank card transactions. A vulnerability management program is in place to ensure that the technical controls are functioning properly. Technical controls are in place to ensure that identity and access management is limited to those with a need to access the data in order to perform their job duties. Appropriate audit logging is enabled in order to track and monitor access. In the case of an information security event is found (such as an unauthorized wireless access point), the organization will follow the Incident Response Security Procedure. All members of UNMC complete annual information security compliance training.

For more detailed information, see the Bank Card Handling Procedures or contact the Controller.

This page maintained by dkp.