Don’t Store Client Payment Information

One of my more popular workshops is “Managing Errors and Omissions in a 24-7 World.” In this program, I highlight emerging technology solutions and the advantages and benefits, as well as the pitfalls, these solutions bring to managing errors and omissions within your agency organization.

One item I talk about is agency staff storing customer electronic payment information within the agency management system. This information could include credit and/or debit card numbers, card expiration date, and the CVC code (the 3 or 4 digit number on the back of the card). It also includes bank routing numbers and bank account numbers used to process ACH transactions.

Before you think “we do not do that” and delete this email, please don’t assume that your staff does not capture this information. Very often, agency owners have no idea what happens at the desktop.

I have been in multiple agencies over the last six months where I observed staff on the phone with clients making electronic payments on their behalf on the insurance company website. In many cases, they were writing down the credit card information on a yellow pad and then entering it into the insurance company payment processing page.

Some CSRs have told me that they capture this information as part of the client notes so they do not have to keep asking for the payment information.

While many agencies understand that they should not be capturing credit card information, it is a more common practice to scan and store checks received in payment for insurance premiums as part of the client file. These scanned checks are then attached to an activity note to verify the payment was received.

Your agency should not capture any client electronic payment information within your systems.

Period.

Forty-seven states, the District of Columbia, Guam, Puerto Rico, and the Virgin Islands have all enacted legislation that requires private entities to notify individuals of security breaches of information involving personally identifiable information (PII).

While there are slight variations within each state, most statutes identify personal information that requires notification if breached as:

“An individual’s first name or first initial and last name in conjunction with any one or more of the following data elements, 1) Social Security number; 2) driver’s license number; 3) or account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual’s financial account.”

Electronic payment information falls under this definition regardless of whether it is credit card/debit card information or bank account information. The bank routing number and bank account number contained on a check will be considered as part of the definition of “personal information” and be subject to the state data breach notification requirement.

The liability your agency is incurring as a result of this practice is substantial.

But Isn’t It Required…?

A common reason the agency is storing this payment information is that the “carriers require us to keep that information.”

Another common reason I’ve heard to keep copies of client checks is for EFT payment setups on carrier websites. The carriers say they don’t want customer banking information sent to them, so agencies are keeping a copy of the check in an activity in case there are questions down the road or the EFT doesn’t get set up properly by the carrier.

If this is your procedure, it appears the insurance companies have successfully transferred the additional liability because of a data breach from themselves to you their agencies.

My recommendations:

• Make sure your staff understands that they should not be capturing in any form — in the management system or written down on yellow pads — any type of electronic payment information.
• Do not scan checks and attach them to the client file. There is no need for any agency to keep this payment information.
• Verify with every insurance company their actual requirements regarding retention of electronic payment information (including checks). Make sure to ask for this verification in writing from an officer of the insurance company.
• Push back hard against any insurance company that says you are required to keep electronic payment information.

Storing client electronic information is simply bad business practice. Your organization cannot and should not take on the additional liability exposure if this personal information is breached.

How does your organization verify that staff does not store client electronic information?