Sorry for a lengthy message, but this information may be useful those of you who support or may need to support payment processing:
Areas accepting payments for goods or services should be aware that authorization to establish a banking arrangement (including accepting payment methods such as credit cards and other third party payment acceptance methods) can only be authorized by the Vice Chancellor for Administration and Chief Financial Officer (Lauren Brisky) or the Vice Chancellor for Investments (Matthew Wright) or their designee. This specific authority is granted by the Board of Trust (see the Vanderbilt University Authorization for the Signing of Contracts and Other Documents; http://www.vanderbilt.edu/compliance/authority_signing.pdf). PayPal (and similar methods) is not an authorized payment acceptance mechanism for any Vanderbilt department, clinic, or operating area.
If an area needs to accept credit cards, a request to apply to be a merchant should be directed to either Merchant Accounts Management (university central departments contact Anna Letcher) or the Department of Finance (medical center departments contact Dana Walker.) Once a valid business need has been established, the application for a merchant account will be forwarded to Vanderbilt’s credit card processor.
There are no centrally-supported payment processing solutions at this time.
All credit card processing (including internet-based payments) must comply with the Payment Card Industry Data Security Standards (PCI DSS). Additionally, payment applications which store, transmit, or process credit card information are subject to the Payment Application Data Security Standards (PA DSS). These are industry standards and require all credit card merchants to comply with data security standards to protect cardholder account information. All inquiries regarding PCI Compliance should be directed to Anna Letcher.
Please feel free to share this information with others in your area. I am happy to try to assist with any questions regarding credit card merchant accounts or PCI DSS/PA DSS.