TITLE 1. ADMINISTRATION

PART 3. OFFICE OF THE ATTORNEY GENERAL

CHAPTER 56. SKIMMERS

1 TAC §§56.1 - 56.6

The Office of the Attorney General ("OAG") proposes new rules, §§56.1 - 56.6, relating to best practices for motor fuel merchants to prevent, detect, and report the installation of payment card skimmers on their motor fuel dispensers.

BACKGROUND

The OAG proposes these rules in order to implement §1 of H.B. 2945 enacted in 2019 by the 86th Regular Session of the Texas Legislature. Specifically, §1 of H.B. 2945, created a new Chapter 607 of the Texas Bus. & Com. Code related to payment card skimmers on motor fuel dispensers. Chapter 607, which took effect September 1, 2019, requires motor fuel merchants to implement procedures to prevent, detect, and report the installation of skimmers on their unattended motor fuel dispensers. The statute further directs the OAG to adopt rules to establish practices for merchants to use to comply with those provisions. In accordance with §607.052 of the Texas Bus. & Com. Code, in drafting the proposed rule, the OAG considered emerging technology, compliance costs to merchants, and any impact the policies and procedures may have on consumers.

SECTION-BY-SECTION SUMMARY

Section 56.1 incorporates definitions from Chapter 607 of Texas Bus. & Com. Code and adds definitions for other terms used in the rules. The proposed definitions are intended to add clarity and specificity to the requirements of the rules.

Section 56.2 requires motor fuel merchants to implement and maintain written policies and procedures for complying with the proposed rules and to properly train employees to ensure they understand and will comply with those policies and procedures. Subsection (a) requires any merchant that has a fuel dispenser with an unattended payment terminal to implement and maintain written policies and procedures, consistent with the mandates of Chapter 607 of the Texas Bus. & Com. Code. Consistent with best practices in the area of data security and the recommendation of experts, the proposed rule requires the policies and procedures to include a plan of action that the merchant will follow upon the discovery of a skimmer. Subsection (b) requires merchants to conduct training for its employees to ensure that they understand the policies and procedures as well as how to comply with them. The proposed rule also requires merchants to include in the training background information regarding skimmers, and the harm that such skimmers can cause to both customers and to the merchant. Understanding the harms posed by skimmers will help employees to understand the importance of complying with the merchant's policies and procedures. The proposed rule also requires training on recognizing suspicious activity and warning signs so employees can effectively prevent and detect skimmers. To ensure that employees comply with merchants' policies and procedures, the proposed rule also requires the training to cover disciplinary consequences that employees may face if they do not comply.

Section 56.3 sets out required practices for all merchants that have a fuel dispenser with an unattended payment terminal. Paragraph (1) requires merchants to implement and maintain the policies, procedures, and training detailed in proposed §56.2. Paragraph (2) requires merchants to affix to or install on each door or panel that provides access to an interior portion of the dispenser from which the payment terminal or any electronic component of the payment terminal may be accessed, a lock requiring a key unique to the merchant's place of business. One characteristic that makes fuel dispensers attractive to criminals is that they have historically been manufactured and installed to be accessible with a universal key. Criminals can therefore open many motor fuel dispensers using just a few keys. The proposed rule would require merchants to utilize locks with unique keys, while providing merchants the flexibility to use the same key on all dispensers at the same business location. A merchant that has multiple business locations, however, would need to use a different key for each location, in part to ensure that if a key is compromised at one location, it would not affect the security of dispensers at other locations.

Paragraph (3) of proposed §56.3 requires merchants to maintain a log of all persons who do work on the forecourt. In order to avoid detection, criminals sometimes impersonate technicians working on the fuel dispenser. Requiring all persons who are working on the forecourt to check in with the merchant and sign a maintenance log will allow employees to quickly recognize when unauthorized persons are accessing the fuel dispensers.

Paragraph (4) of proposed §56.3 requires merchants to use tamper-evident security labels to secure every opening that provides access to an interior portion of a dispenser from which a payment terminal or any electronic component of a payment terminal may be accessed. Using tamper-evident security labels will allow merchants, as well as consumers, to see when the pump has been opened without authorization. Unfortunately, not long after merchants started using security labels, criminals started buying and carrying their own labels so that they could remove the merchant's label, open the dispenser, and then replace the label with a similar looking label. The proposed rule, therefore, requires merchants to use numbered security labels, so that the merchant can confirm that the number on the security label on the dispenser matches the number on the label that the merchant put on the dispenser.

Paragraph (5) of proposed §56.3 requires merchants to conduct a thorough inspection of the exterior of each fuel dispenser at least once per day. During this inspection, merchants are required to conduct a visual inspection of the dispenser, looking for signs that a skimmer has been installed. Today, most skimmers are installed inside the pump and are not visible from the outside. Merchants are therefore required to look for signs that the dispenser has been opened, including scratches, pry marks, drilled holes, and other signs that the dispenser has been tampered with. In addition, as it becomes harder to get into the dispenser, and as the technology inside the dispenser gets harder to compromise, it is likely that criminals will revert to placing skimmers on the outside of the dispenser. Therefore, regardless of how diligent a merchant is and how well they protect the inside of the dispenser, it remains vital that the merchant continue to inspect the exterior of the dispenser for skimmers, shimmers, deep-insert skimmers, overlays, and other items that may have been installed on the exterior of the dispenser. It is also critical that every time the merchant does an inspection, the merchant inspects the tamper-evident security labels to confirm that the number on the label matches the merchant's log and that the label has not been cut or tampered with.

Criminals sometimes resort to extreme measures to access fuel dispensers. For example, there have been reports that criminals have drilled a hole in a dispenser door to install a skimmer and then covered the hole with a sticker or a leaflet holder. The rule therefore requires merchants to maintain a photo of its dispensers that employees can review and compare to the dispenser the employee is inspecting. The proposed rule provides merchants discretion regarding how and where to maintain the photo. Some may choose to print out the photo and post it on a bulletin board behind the counter, while others may keep a copy in their written policies and procedures, and others may maintain the photo electronically. The proposed rule gives merchants the flexibility to determine the best way to maintain the photo, so long as the photo is easily accessible to employees conducting the dispenser inspections. Moreover, to the extent that all dispensers are uniform in appearance (e.g., have the same stickers, leaflets, etc. in essentially the same position on each dispenser), the merchant only needs to maintain a photo of a single dispenser.

Many experts recommend inspections even more frequently than daily, such as three times a day or every shift change. More frequent inspections allow for faster detection of skimmers. In addition, some criminals install skimmers for less than 24 hours, in order to avoid detection. Nevertheless, in order to limit the burden on small businesses and to give merchants sufficient flexibility, the proposed rule only requires that merchants conduct such inspections at least once per day. The OAG encourages merchants to conduct inspections more frequently than once per day. The OAG cautions, however, that the quality of the inspections is more important than the quantity. The OAG believes that less frequent, but more thorough inspections are more likely to detect skimmers than inspections that are performed frequently, but less thoroughly.

Paragraph (5) of proposed §56.3 further requires merchants to maintain a log of all inspections, documenting the date and time of the inspection as well as the name of the person who conducted the inspection. Although not required by the proposed rule, the OAG recommends that inspections be conducted by different employees at least periodically. For example, if a merchant conducts more than one inspection per day, it is recommended that the inspections be conducted by at least two different employees. If a merchant only conducts inspections once a day, it is recommended that no single employee conduct inspections on consecutive days. This will help limit the likelihood that an employee will become careless in the inspection process and will help limit the risk that the person conducting the inspections is complicit with persons installing skimmers. However, because some small businesses may have a limited number of employees, the proposed rule does not require that the inspections be conducted by multiple employees.

If an inspection reveals anything suspicious, signs that a dispenser has been opened or tampered with, or evidence that a skimmer has been installed in or on a dispenser, subparagraph (5)(F) of proposed §56.3 requires the merchant to disable the dispenser and to take appropriate steps to ensure that customers do not try to use the payment terminal that may include a skimmer. The merchant must keep the dispenser disabled until it has been manually inspected by a person trained in the identification and detection of skimmers. As with the dispenser's exterior, the proposed rule requires the merchant to maintain a photo of the interior of the dispenser that the person conducting an inspection may use to help determine whether any foreign object has been installed. And as with the photo of the exterior, the proposed rule provides merchants with discretion regarding how the merchant will maintain the photo of the interior.

In order to minimize the impact of the proposed rule on small businesses in remote areas of the state, where it may be difficult or expensive to have a service technician travel to the merchant's place of business, the proposed rule gives merchants discretion regarding how to comply with the rule. The manual inspection may be conducted by a service technician or an employee, so long as the person has been trained in the detection of skimmers. Moreover, the proposed rule does not specify how, where, or by whom such training must occur. The training does not have to be a formal class. It could be sufficient to have a service technician or experienced law enforcement officer come to the merchant's place of business and train employees on how to identify and detect skimmers on the merchant's own dispensers. It may be sufficient thereafter for experienced employees to train new employees.

In addition, paragraph (7) provides that if shutting down a dispenser would cause a merchant hardship or substantially disrupt the merchant's business, the merchant need not completely shut down the dispenser, but can instead disable the payment terminal and take steps to prevent consumers from trying to use the payment terminal. The OAG has provided this flexibility to accommodate small businesses that may have only a couple of dispensers. Instead of completely disabling the dispenser, resulting in lost business and potentially negatively impacting consumers, the merchant may cover the payment card slot and direct customers to pay inside the merchant's place of business.

Paragraph (6) of proposed §56.3 requires merchants to monitor its dispensers and payment terminals for high levels of invalid payment card read errors, dispenser offline messages, or other indications of problems accepting payment cards at the pump. These could be signs that a skimmer has been installed on the dispenser. If the merchant detects suspicious activity, the proposed rule requires the merchant to disable the affected dispenser until a person trained in the detection of skimmers has conducted a manual inspection of the dispenser. Similarly, the merchant may be contacted by a card brand, a payment processor, a financial institution, a law enforcement officer, or a representative of the Center, informing the merchant that the merchant's place of business appears to be a common point of purchase for fraudulent activity. The proposed rule requires that if the merchant is notified by someone else that it may be a common point of purchase for fraudulent activity, the merchant must disable the affected dispenser until a person trained in the detection of skimmers has conducted a manual inspection of the dispenser. Just as under subparagraph (5)(F), paragraph (6) gives the merchant discretion regarding whether to have the dispenser inspected by a service technician or an employee who has been trained in the identification and detection of skimmers. Paragraph (7) also gives the merchant the ability to just disable the payment terminal and have customers pay inside if shutting down the dispenser would cause a hardship or substantially disrupt the merchant's business. Paragraph (8) requires the merchant to maintain a log of all inspections conducted pursuant to subparagraph (5)(F) or paragraph (6).

Section 56.4 sets out practices a merchant must follow if a skimmer is discovered on the merchant's motor fuel dispensers, referred to as a skimmer breach, on more than two occasions in a 24-month period. If a merchant diligently follows the practices required by proposed §56.3, it is unlikely that the merchant will experience a skimmer breach on three different occasions within a 24-month period. If a skimmer is discovered on three different occasions, it is an indication either that the merchant is not carefully following the requirements of proposed §56.3 or that the merchant's location is at an increased risk for having skimmers installed on its dispensers. In either event, it is reasonable to require the merchant to implement additional practices to prevent further skimmers from being installed on its dispensers.

Paragraph (1) of proposed §56.4 requires merchants, within 30 days of a third skimmer breach, to implement a program to electronically monitor their dispensers. In particular, the merchant must install on each dispenser an electronic monitoring device that will detect when the dispenser is opened without authorization, immediately disabling the dispenser and either sounding an audible alarm or sending a notification to the merchant. If the device sounds an audible alarm, the alarm must continue to emit an audible alert at least every 30 seconds until the merchant deactivates the alarm. If the device sends a notification, the notification must be sent to the merchant's owner, an executive of the merchant, or to a supervisor that the owner or executive has designated. This requirement ensures that notification goes to someone with sufficient authority to implement an appropriate response. However, this requirement does not exclude the possibility that notification could also be sent to a cashier or other employee. The proposed rule also requires that the electronic monitoring device create a log of every event that occurs on the dispenser. For example, the device must log every time that it is armed or disarmed and every time that it is triggered. The merchant must monitor the log for suspicious behavior, like the alarm being disarmed at inappropriate times. After the device has been triggered and the dispenser disabled, the dispenser must remain inoperable until it has been inspected by a person properly trained in the identification and detection of skimmers. The rule gives the merchant discretion to have the inspection conducted by a service technician or an employee, so long as the inspector is trained in the identification and detection of skimmers.

Pursuant to proposed §56.4, merchants who have experienced three skimmer breaches in a 24-month period are required to install electronic monitoring devices only on dispensers that are not EMV compliant. Instead of installing electronic monitoring devices on its dispensers, a merchant may decide to upgrade the payment terminals on its dispensers to be EMV compliant. Independent of this rule, most U.S. payment networks (e.g., Visa, Mastercard, American Express, Discover Card) have set a deadline of October 1, 2020, for all motor fuel dispensers to be EMV compliant. Merchants who do not have EMV compliant dispensers by October 1, 2020, will likely be liable for card fraud that is committed at the dispensers. Although the cost to upgrade may be significant, the cost of card fraud for which the merchant will become responsible if they fail to upgrade is probably more significant. Merchants, therefore, have a strong incentive to upgrade their dispensers to be EMV compliant independent of this rule.

A merchant who installs an electronic monitoring device or upgrades to EMV compliant dispensers is not required to use tamper-evident security labels pursuant to paragraph (4) of proposed §56.3.

For merchants to whom the rule applies, paragraph (2) of proposed §56.4 requires the merchant to have the interior of each dispenser inspected by a person trained in the identification and detection of skimmers at least once a month. Paragraph (3) requires the merchant to maintain a log of all inspections required by proposed §56.4 and to retain such logs for a minimum of 12 months.

The OAG considered imposing the obligations in §56.4 on all merchants with an unattended payment terminal on a motor fuel dispenser. Such practices are strongly encouraged by many experts and law enforcement personnel. Because of the costs such practices might impose on small businesses and micro-businesses, however, the OAG has decided to impose these obligations only on merchants who have been subject to more than two skimmer breaches.

Section 56.5 sets out measures merchants must follow if they experience a skimmer breach on more than four occasions in a 24-month period. If a skimmer is discovered on the merchant's dispensers on five different occasions in a 24-month period, it is likely an indication that the merchant is not following one or more of the requirements of proposed §§56.3 and 56.4 or that the merchant's location is at a very high risk for having skimmers installed on its dispensers. Whatever the reason, it is reasonable to require such merchants to implement additional practices to prevent further skimmers from being installed on its dispensers.

Paragraph (1) of proposed §56.5 requires merchants, within 30 days of a fifth skimmer breach, to install and maintain high resolution video cameras. The cameras must be positioned in such a way that they will capture both images of license plates of vehicles entering and exiting the dispenser area, and images of persons pumping gas at the dispenser. The proposed rule requires all such images to be captured at a minimum resolution of 60 pixels per foot. Requiring a minimum resolution of 60 pixels per foot is likely to ensure that the images are of sufficient clarity to provide beneficial evidence in related law enforcement investigations. In order to ensure that this video footage is available for any relevant law enforcement matter, the rule requires merchants to retain the video footage for 31 days. In addition to providing valuable evidence, the mere presence of the video cameras will provide a strong deterrence against the installation of skimmers.

Paragraph (2) of proposed §56.5 requires merchants, within 30 days of discovering a skimmer on the fifth different occasion, to install and maintain proper lighting on the forecourt. In particular, the rule requires merchants to install lighting around the dispensers and under any canopy such that the minimum horizontal illuminance at grade level is 10 footcandles. Although this is a very modest level of required lighting, it should serve the purposes of the rule, which include providing enough light for video surveillance cameras and to provide enough light so that persons accessing fuel dispensers can be clearly seen by others, including other vehicles passing by. For marketing and promotional reasons, many, if not most, merchants already maintain lighting that meets the minimum required by the proposed rule.

Section 56.6 sets out practices that a merchant who discovers a skimmer on one of its dispensers must take. The proposed rule prohibits the merchant from touching the skimmer in order to avoid compromising or contaminating any physical evidence that a criminal may have left. The merchant is required to immediately disable both sides of the fuel dispenser, notify law enforcement, and take steps to protect the dispenser from tampering until law enforcement arrives. The merchant is also required to notify the Department within 24 hours. The proposed rule also requires the merchant to run a receipt for the last dispenser transaction on the compromised dispenser, and to preserve all video surveillance and logs related to the compromised dispenser. The proposed rule also requires the merchant to cooperate with law enforcement, the Department, and the Center in the investigation of the skimmer, including allowing access to the dispenser so that the skimmer may be removed. Recognizing that disabling the dispenser for an extended period could adversely affect the merchant, especially merchants that qualify as small businesses and micro-businesses, the proposed rule provides the merchant discretion to remove the skimmer itself if neither law enforcement nor the Department has contacted the merchant within 24 hours of the merchant's notification to the Department. If the merchant removes the skimmer, the rule requires that the merchant take certain steps to maintain the integrity of the evidence. This includes wearing gloves to remove the skimmer, bagging the skimmer, and securing the skimmer for later pick-up by law enforcement.

FISCAL NOTE ON STATE AND LOCAL GOVERNMENTS

Jennifer Jackson, Chief of the Consumer Protection Division of the OAG, has determined that for the first five-year period the proposed rules are in effect, there are no reasonably foreseeable implications relating to cost or revenues of state or local governments, under Texas Gov't Code §2001.024(a)(4), as a result of enforcing or administering these new rules, as proposed.

PUBLIC BENEFIT/COST NOTE

Ms. Jackson has determined, under Texas Gov't Code §2001.024(a)(5), that for the first five-year period the new rules are in effect, the public benefit of the rule will be a significant reduction in the number of skimmers installed on fuel dispensers in the State of Texas. Skimmers on motor fuel dispensers have become a massive problem in Texas over the last few years. Skimmers are commonly discovered by many different entities, including state regulators, local law enforcement agencies across the state, service technicians, and merchants themselves. Unfortunately, before H.B. 2945, there was no clear duty for merchants or service technicians to report skimmers they found. There was also no centralized location where skimmers were reported. As a result, there is no good data on the entire scope of the problem. What data there is, however, suggests that Texas is a hotbed for criminal enterprises committing card fraud by installing skimmers on motor fuel dispensers.

For example, a representative of Wex, Inc., a provider of payment processing and information management services based in the State of Maine, traveled to Texas to testify in support of H.B. 2945. In his testimony, the witness from Wex, Inc., testified that of the company's total nationwide fraud losses attributable to skimmers, 35 to 42 percent occurred in Texas. Testimony from detectives with the Houston Police Department and the Tyler Police Department was also presented at the hearing. Both detectives testified that Houston is a major hub for organized crime gangs involved in installing skimmers on fuel dispensers, and that those crime gangs have spread to other parts of Texas. The head of the Financial Crimes Unit of the Tyler Police Department testified that in the last two and one-half years, the Tyler Police Department has made over 45 felony arrests related to credit card skimming at gas stations. Similarly, the detective from the Houston Police Department testified that the motor fuel skimming problem involves hundreds of millions of dollars and that the Houston Police Department has thousands of suspects.

The scope of Texas' skimming problem is also evidenced by the number of skimmers found by the Texas Department of Agriculture ("TDA") on an annual basis. From 2017 through August 2019, TDA generally only inspected fuel dispensers for skimmers after it received a complaint alleging that there may be a skimmer in a fuel dispenser, and even then, TDA could only inspect the interior of a dispenser with the consent of the merchant. Nevertheless, in 2017 TDA found more than 40 skimmers in fuel dispensers in Texas, on 31 different occasions. On five other occasions, TDA did not find a skimmer at the time it inspected the dispenser but was informed that a skimmer had been removed before they arrived. In 2018, TDA found more than 60 skimmers on 39 different occasions. On another 16 occasions, TDA was informed that at least one skimmer was removed before TDA's inspection. From January 1, 2019, through August 20, 2019, TDA found more than 110 skimmers on 64 different occasions. Fourteen additional times TDA was told that a skimmer was removed before the inspection.

Another good indication of the scope of the problem comes from a nationwide initiative the U.S. Secret Service carried out in November 2018. Over the Thanksgiving holiday, the Secret Service and its partners conducted inspections of over 400 gas stations in 16 states. During those searches, nearly 200 skimmers were recovered from inside fuel dispensers. With more than 14,000 gas stations in the State of Texas, the ratio of one skimmer for every two gas stations suggests there could be nearly 7,000 skimmers in fuel dispensers in Texas at any one time.

Although the number of skimmers found or reported to law enforcement officials is significant, most skimmers are likely discovered directly by merchants or by the service technicians the merchants retain to maintain their dispensers. For example, one large petroleum service company estimates that its technicians on average find at least one skimmer per day. Some merchants and service technicians notify local law enforcement when a skimmer is located. Others, however, do not notify any law enforcement agency, but simply remove and discard the skimmer. Therefore, there is no way to know the full scope of the problem.

Depending on how long a skimmer is installed on a fuel dispenser, each skimmer can result in the victimization of hundreds or thousands of consumers. Each victim will have to spend time and effort to reverse fraudulent charges they incur and clear the negative impact that such charges can have on their credit report. Such efforts can sometimes take months. And the fraudulent charges themselves can cause severe harm, especially for consumers paying by debit card. Criminals often withdraw thousands of dollars from the victim's bank account before being detected. Even though the consumer's financial institution typically restores the consumer's money, this process can take weeks and the financial impact on consumers living paycheck to paycheck can be catastrophic.

Although skimmers cause significant harm to individual consumers, the entities that take the biggest financial loss from skimmers are generally the affected financial institutions. The Texas Bankers Association ("TBA") and the Independent Bankers Association of Texas ("IBAT") estimate that banks in Texas could be losing in excess of $100 million per year in card fraud. This does not include losses to credit unions who are also being hit hard by motor fuel skimmers. While not all card fraud is attributable to skimmers, and most financial institutions do not have a way to specifically allocate losses attributable to skimming, banks responding to a survey conducted by TBA and IBAT estimated anywhere from less than 10% of their card fraud losses to well over 50% of such losses were attributable to skimming on fuel dispensers.

Although the OAG recognizes that the proposed rules will not eliminate skimmers on fuel dispensers, the OAG does expect that compliance with the rules will significantly decrease both the number of skimmers installed on fuel dispensers and the amount of time a skimmer may remain installed on a fuel dispenser, thereby minimizing the number of victims who experience financial harm as a result of such skimmers.

Although the proposed rules strive to minimize the impact they will have on the motor fuel merchant community, Ms. Jackson has determined that for each year of the first five-year period the new rules are in effect, there will be a probable economic cost to merchants who are required to comply with the rule.

The most significant economic impact the rule will have on merchants will come from the requirement in paragraph (2) of proposed §56.3 that all merchants install locks on their dispensers with a key unique to that location. Because the rule requires that locks be changed immediately, all expenses related to this requirement should come in the first year the rule is in effect.

Experts have recommended unique locks on fuel dispensers for several years. As a result, it is likely that approximately 35% of merchants have already installed locks with a unique key. Therefore, approximately 65% of merchants will be required to change their locks or to add new locks that meet the specification. Merchants have wide discretion regarding how to comply with this proposed rule. For example, almost any locksmith can change or add a lock on a fuel dispenser. Similarly, merchants can call their service technician to install compliant locks. Finally, merchants can purchase locks online and either install the locks themselves or have a service technician install the locks. Locks purchased online are typically designed so that the merchant can install the locks without any assistance.

Fuel dispenser locks can be found online for as little as $7.25 per lock. Most fuel dispenser locks, however, appear to be priced between $25 - $35 per lock. Many models of fuel dispensers contain four doors (two on each side of the dispenser) providing access to an interior portion of the dispenser from which the payment terminal or its electronic components may be accessed. Therefore, if a merchant buys the locks online and installs the locks itself, the merchant can comply with this proposed rule for as little as $33 per fuel dispenser. Using the more common average price per lock of $30, the cost for a merchant to comply with the rule could be $130 per fuel dispenser. These costs include the cost of shipping the lock to the merchant's place of business and the cost of unique keys. This cost would be the same for any merchant in the state, whether the merchant is a small business, a micro-business, or a merchant in a rural community.

If a merchant is unable to change the locks itself, the merchant can have the locks changed by a locksmith or service technician. Depending on the type of lock chosen and the number of dispensers the merchant has, the OAG estimates that a merchant can have a locksmith or service technician change a merchant's dispenser locks for somewhere between $90 to $200 per fuel dispenser. For merchants in some remote rural communities, the cost to have a locksmith or service technician travel to the merchant's place of business could significantly increase these costs. However, as noted above, most of the fuel dispenser locks are designed to be installed easily, so merchants in remote rural communities should be able to install the locks themselves or should be able to find someone in the local community that could install the locks for a reasonable price.

Paragraph (4) of proposed §56.3 will also likely impose tangible costs on all merchants. This provision requires merchants to use tamper-evident security labels on its dispensers. Tamper-evident security labels can be purchased online, including from the merchant's own trade association, the Association for Convenience and Fuel Retailing (NACS), formerly known as the National Association of Convenience Stores. Labels purchased from NACS cost fourteen cents per label. Many fuel brands also offer compliant tamper-evident security labels at a similar price point. Generic, unbranded labels can also be purchased online for as little as 1 cent per label. The proposed rule requires the same doors that require unique locks to also be secured with a tamper-evident security label. For most dispensers, this means that four labels are required for each dispenser. In most cases, the doors on the dispenser only need to be opened to service the dispenser, to inspect the dispenser for skimmers, and to change the receipt paper on the dispenser. Most merchants probably only open some doors on each dispenser once every two weeks, at most. If a merchant opened every door on its dispensers once every two weeks, the merchant would incur costs of approximately $15 per year, per dispenser. Even if merchants were diligent and conducted inspections of the interior of its pumps at least once per week, the merchant would incur costs of less than $30 per year, per dispenser. Even if a merchant conducted daily inspections or changed its security labels every day, the merchant would incur costs of approximately $200 per year, per dispenser. These costs would be the same for any merchant, whether or not the merchant is a small business.

The obligation to protect dispensers using tamper-evident security labels only applies to dispensers that are not EMV compliant. Therefore, the cost that such requirement will impose on merchants in years two through five of the proposed rule depends on how many merchants meet the October 1, 2020, deadline set by the card brands to be EMV compliant. If 100% of merchants meet the deadline, the proposed rule would not have any economic impact after the first year. The OAG hopes that all merchants meet the EMV compliance deadline and strongly encourages all merchants to meet the deadline. It is likely, however, that not all merchants will meet the deadline. Therefore, the obligation to protect dispensers using tamper-evident security labels will likely continue to have an economic impact on some merchants for at least the first couple of years after the rule takes effect.

Paragraph (1) of proposed §56.4, which requires electronic monitoring devices in some circumstances, could also impose a cost on some merchants. As noted above, the OAG considered requiring all merchants to install electronic monitoring devices on their dispensers. However, in order to minimize the costs imposed on small businesses, the application of proposed §56.4 is limited to only those merchants who have experienced more than two skimmer breaches in a 24-month period. The expectation is that most merchants, if they comply with the requirements of proposed §56.3, will not experience multiple skimmer breaches in a 24-month period. The costs imposed by the requirements of proposed §56.4, therefore, will only be borne by those merchants that are known to pose a high risk of having skimmers installed on the merchants' dispensers. That elevated risk justifies the costs of the electronic monitoring device.

In order to avoid creating a preference for any one company and in order to provide merchants multiple options and discretion, the OAG has drafted the proposed rule in a manner that ensures that merchants are able to select from any of several companies that sell electronic monitoring devices that meet the criteria set out in proposed §56.4. Based on its review of the products currently available on the market, most merchants should be able to install compliant electronic monitoring devices on their dispensers for approximately $800 to $1100 per dispenser. Depending on several factors, it is possible that merchants could comply with the rule for as little as $500 per dispenser. But it is also possible that some merchants, especially if they have less than four dispensers, could pay more per dispenser.

Paragraph (1) of proposed §56.4 only requires merchants to install an electronic monitoring device on a dispenser that is not EMV compliant. Therefore, rather than spending money to install an electronic monitoring device, merchants could instead decide to invest in upgrading their dispensers to be EMV compliant. While in most cases it will cost merchants more to upgrade their dispensers to be EMV compliant, merchants are already under a separate obligation - or at least severe pressure - independent from this rule to be EMV compliant by October 1, 2020.

Proposed §56.5 may also impose costs on a small group of merchants. Proposed §56.5 only applies to merchants who have experienced a skimmer breach on five different occasions during a 24-month period. This will likely apply to very few merchants because it is unlikely that a merchant complying with §§56.3 and 56.4 would suffer five skimmer breaches in a 24-month period. For a merchant who must comply with the rule, the merchant is likely to incur costs to install or upgrade its security surveillance. The merchant may also have to install or upgrade its forecourt lighting. The cost to upgrade a merchant's video surveillance and lighting is very difficult to estimate because there are many different factors that may affect the price, including the number of dispensers, the layout of the forecourt, and the availability and/or location of electrical connections. Nevertheless, the OAG believes that most merchants could install a new video surveillance system that meets the requirements of paragraph (1) of proposed §56.5 for approximately $3,500 to $4,500 per dispenser. The OAG calculated this estimate based on a proposed security camera configuration that includes two cameras per dispenser (one on each side of the dispenser) specially designed to capture the license plate, and one to two overhead dome cameras per dispenser to capture video of persons dispensing gas. Most merchants likely already have forecourt lighting that meets the minimum requirements of paragraph (2) of proposed §56.5. But even for merchants that have no lighting at all, the OAG estimates that merchants could install compliant lighting for $600 to $1000 per dispenser as long as electricity is readily accessible. The OAG calculated this estimate based on a proposed lighting configuration that included two to three light fixtures per dispenser, which should be sufficient to achieve a minimum horizontal illuminance of 10 footcandles.

The rules will also impose additional indirect costs on merchants who must comply with the rules. For example, the proposed rules require all merchants to implement written policies and procedures and to conduct training on those policies. Such requirements are not anticipated to impose significant costs on merchants. Most, if not all, merchants already have written policies and procedures covering various aspects of their businesses. The proposed rules do not prescribe specific content or length of the policies and procedures a merchant must adopt, making it relatively easy and inexpensive for merchants to adopt policies and procedures related to complying with the proposed rules. Similarly, virtually all merchants regularly train new employees on the operations of the business, so adding material specific to skimmers and compliance with the proposed rules should not significantly add to the cost of training new employees. It is also likely that merchants already have a method for communicating updated policies and procedures to employees and training them on such policies and procedures. The rules do not prescribe specific practices for notifying employees of updated policies related to skimmers and providing updated training. Merchants can use their current practices for informing employees of new policies or procedures to provide employees new information about skimmers and the merchants' policies to prevent, detect, and report the installation of skimmers on their fuel dispensers.

The proposed rules also require merchants to conduct daily inspections of the exterior of all fuel dispensers. The OAG estimates that someone who is familiar with a dispenser can conduct a thorough inspection of the exterior of the fuel dispenser in one to two minutes. Even when adding the few minutes needed for preparation, recordkeeping, and going to and from the dispensers, the OAG thinks that for most merchants such costs can likely be absorbed by current personnel.

The proposed rules also require merchants to conduct inspections of the interior of dispensers in several circumstances. For example, when daily inspections reveal signs of unauthorized access or tampering, when merchants detect suspicious payment card reader errors or are notified that they may be a common point of purchase for fraud, or when an electronic monitoring device is triggered, merchants must conduct an inspection that includes inspecting the interior of the dispenser. Merchants who are subject to proposed §56.4 must also conduct monthly inspections of the interior of the dispenser. All of these inspections must be conducted by a person who has been specifically trained in the identification and detection of skimmers. The OAG anticipates that most merchants will rely on employees to conduct these inspections. Persons trained to inspect the interior of fuel dispensers can generally conduct such an inspection in five to ten minutes, although some types of pumps may take longer. And the type of training required to conduct such inspections can likely be accomplished in one to two hours. Therefore, it is unlikely that the required inspections will impose a significant cost on merchants.

It should also be noted that H.B. 2945 and the proposed rules only apply to merchants with unattended payment terminals on fuel dispensers. Merchants, including those that qualify as small businesses and micro-businesses, could avoid the rules and any associated costs imposed by the rules by disabling all payment terminals located on their fuel dispensers and by requiring consumers to pay inside. Similarly, merchants could limit costs by reducing the number of dispensers with a payment terminal.

IMPACT ON LOCAL EMPLOYMENT OR ECONOMY

There is no reasonably forecasted effect on local economies for the first five years that the proposed rules are in effect. Therefore, no local employment impact statement is required under Texas Gov't Code §2001.022.

ECONOMIC IMPACT STATEMENT AND REGULATORY FLEXIBILITY ANALYSIS FOR SMALL BUSINESSES, MICRO-BUSINESSES, AND RURAL COMMUNITIES

Ms. Jackson has also determined that for each year of the first five years the proposed rules are in effect, there will be no reasonably forecasted adverse economic effect on rural communities as a result of implementing these rules.

Ms. Jackson has determined, however, that for each year of the first five years the proposed rules are in effect, there will be a forecasted adverse economic effect on small and micro-businesses. Based on the Texas Comptroller's calculation of the number of small businesses in each North American Industry Classification System, there are 4,715 small businesses in the categories of gasoline stations to whom the proposed rules likely apply. Accordingly, approximately 95% of the merchants to whom the proposed rules apply are small businesses, and many are likely micro-businesses. The economic impact on small businesses and micro-businesses will be the same as the impact on all merchants as outlined above. In particular, in the first year, merchants who qualify as small businesses may incur the cost of changing the locks or adding locks on their fuel dispensers. In the first year, such merchants will also incur the costs necessary to apply tamper-evident security labels on their fuel dispensers. Those merchants who do not upgrade their dispensers to be EMV compliant will continue to incur the costs related to tamper-evident security labels in subsequent years. Some merchants who qualify as small businesses may also suffer three skimmer breaches within a 24-month period. Those merchants may also incur the cost to install electronic monitoring devices on their dispensers, unless they choose to upgrade their dispensers to be EMV compliant. Some merchants who qualify as small businesses may suffer five skimmer breaches within a 24-month period, in which case they would likely incur the costs of installing appropriate video surveillance equipment and proper lighting. Merchants who qualify as small businesses would also incur the indirect costs described above, such as costs to revise the merchant's policies and procedures, costs to train employees, and costs to conduct the required dispenser inspections.

In drafting the rules, the OAG has sought to minimize the impact on small businesses. To accomplish that, the OAG conducted a regulatory flexibility analysis, which is presented throughout the rule proposal notice and which has resulted in proposed rules that employ a three-tiered approach to compliance. Each tier represents an alternative method to achieve the purpose of the rules. The three tiers of compliance are based on risk factors, and lower-tier compliance is less expensive than higher-tier compliance. As a result, a small business with lower risk would be required to implement only the low-cost first-tier measures, and most small businesses would avoid the more costly measures of the second and third tiers by implementing the first-tier measures. An example of the flexibility analysis the OAG applied appears in the following discussion concerning the proposed requirements that a merchant install certain devices and conduct frequent inspections: Many experts recommend electronic monitoring devices and video surveillance as the two most effective measures that can be taken to prevent and detect skimmers on fuel dispensers. The OAG considered making one or the other of such measures mandatory for all merchants. In order to reduce the impact on small businesses, however, the OAG decided not to make them mandatory for all merchants, but rather only require them if less costly alternatives prove ineffective. Similarly, many experts argue that adoption of EMV will dramatically lower the incidences of skimmer breaches. The OAG, therefore, considered mandating adoption of EMV on fuel dispensers no later than October 1, 2020. This would have coincided with the deadline set by the card brands but would have made upgrading mandatory, rather than a merchant's business decision regarding liability shift. Because upgrading to EMV may be cost prohibitive for some small businesses, the OAG decided not to mandate compliance with EMV. Moreover, because upgrading to EMV can be costly for small businesses and because EMV provides similar protection from skimmers, the OAG has drafted the rule such that if a merchant upgrades to EMV, the merchant is not required to install an electronic monitoring device, one of the more costly measures required by the proposed rule. Nor would the merchant be required to use tamper-evident security tape, further limiting the burden on the merchant. The OAG also considered requiring that all inspections of the interior of the dispenser be conducted by licensed service technicians. However, the OAG decided that such a requirement may unduly burden small businesses and provided discretion for merchants to use employees that have been specifically trained in the identification and detection of skimmers. The OAG also considered requiring inspections of the exterior of all fuel dispensers three times per day as recommended by many experts. However, because of the burden such a requirement could pose to small businesses, the proposed rule only requires inspections once a day. The OAG also considered whether there were suitable alternatives to the requirements imposed by the proposed rule, especially alternatives for locks with unique keys. After considering alternatives, however, the proposed rules reflect the minimum practices necessary to accomplish the mandates of the statute while also protecting the economic welfare of the state.

The proposed rules present alternative ways for small businesses to comply with the rules by allowing for a range of actions and materials at different price points that the merchant may take or use to comply with the requirements for procuring and installing unique locks, for maintaining logs, for training employees, and for securing fuel dispensers that have been breached. Also, if a small business ends up in a higher risk category and is then required to implement more expensive, second-tier measures, including the installation of certain equipment, the rules allow for use of different types of equipment that vary in price.

GOVERNMENT GROWTH IMPACT STATEMENT

In compliance with Texas Gov't Code §2001.0221, the OAG has prepared a government growth impact statement. For the first five years that the rules will be in effect:

(1) The proposed rules will not create or eliminate a government program;

(2) The proposed rules will not require the creation of new employee positions or the elimination of existing employee positions;

(3) The proposed rules will not require an increase or decrease in future legislative appropriations to the OAG;

(4) The proposed rules will not lead to an increase or decrease in the fees paid to the OAG, but could lead to an increase in penalties paid to the OAG if merchants do not comply;

(5) The proposed rules will create new regulations;

(6) The proposed rules will not expand, limit, or repeal an existing regulation;

(7) The proposed rules will increase the number of individuals subject to the proposed rules' applicability; and

(8) The proposed rules will likely positively affect this state's economy by reducing crime and fraudulent charges.

TAKINGS IMPACT ASSESSMENT

No private real property interests are affected by this proposal, and the proposal does not restrict or limit an owner's right to his or her property that would otherwise exist in the absence of government action. Therefore, the proposed rules do not constitute a taking under Texas Gov't Code §2007.043.

NO MAJOR ENVIRONMENTAL RULE

The proposed new rules do not constitute major environmental rules because the proposal does not have the specific intent to protect the environment or reduce risks to human health from environmental exposure and does not have the potential to adversely affect the economy, productivity, competition, jobs, the environment, or the public health and safety of the state. A draft impact analysis, therefore, is not required under Texas Gov't Code §2001.0225.

REQUEST FOR PUBLIC COMMENT

Written comments on the proposed rules may be submitted in writing to Brad Schuelke, Sr. Assistant Attorney General, Office of the Attorney General, Consumer Protection Division, P.O. Box 12548, Austin, Texas 78711-2548, or via email at SkimmerRuleComments@oag.texas.gov. To be considered, a written comment must be received on or before 5:00 p.m. on the 31st day after the date the proposal is published in the Texas Register.

STATUTORY AUTHORITY

The rules are proposed pursuant to Texas Bus. & Com. Code §607.052, which requires the OAG to adopt rules that establish reasonable policies and procedures that identify best practices for merchants to use to comply with Texas Bus. & Com. Code §607.051.

STATUTORY SECTIONS AFFECTED

The statutory provisions affected by the proposed rules are found at Texas Bus. & Com. Code Chapter 607.

§56.1.Definitions.

In addition to the definitions set out in Texas Business and Commerce Code, Chapter 607, the following words and terms shall have the following meanings, unless the context clearly indicates otherwise:

(1) "Electronic Monitoring Device" means an alarm system that is installed on a motor fuel dispenser to monitor panels and doors to prevent unauthorized entry.

(2) "EMV compliant" means that each payment terminal on the motor fuel dispenser utilizes secure EMV technology that meets the security, interoperability, and functionality specifications issued by EMVCo, LLC, and processes EMV transactions end-to-end in compliance with EMVCo, LLC and payment brand standards.

(3) "Forecourt" means the outside area of a merchant's place of business where the merchant's motor fuel dispensers are present.

(4) "Insert skimmer" means a type of skimmer that is hidden in the card acceptance slot of a payment terminal.

(5) "Overlay" means a type of skimmer designed to be placed over the top of the card acceptance slot and/or the PIN pad of a payment terminal.

(6) "Place of business" means the location at which a merchant sells motor fuel to retail customers. For purposes of this rule, each separate physical address at which a merchant sells motor fuel to retail customers is a separate place of business.

(7) "Shimmer" means a type of skimmer that targets chip-based payment cards.

(8) "Skimmer breach" means the installation of a skimmer on the interior or exterior of a motor fuel dispenser with an unattended payment terminal. An incident is not considered a skimmer breach if, at the time the skimmer was installed, the dispenser and payment terminal were disabled and neither the dispenser nor the payment terminal were operational at any point in time while the skimmer was installed on the dispenser.

(9) "Tamper-evident security label" means a label or tape that, once applied to a surface, cannot be removed without self-destructing or otherwise leaving a clear indication (e.g., VOID marking) that the label or tape has been removed.

§56.2.Policies, Procedures, and Training.

(a) A merchant that has an unattended payment terminal on a motor fuel dispenser at the merchant's place of business shall implement and maintain written policies and procedures for complying with these rules. The written policies and procedures shall include documented and detailed procedures that the merchant will follow to prevent the installation of skimmers on the merchant's payment terminals and steps that the merchant will take if the merchant is notified or otherwise becomes aware that a skimmer is installed or is likely to have been installed on one of the merchant's payment terminals.

(b) A merchant that has an unattended payment terminal on a motor fuel dispenser at the merchant's place of business shall conduct training for its employees to ensure that all employees understand the merchant's procedures for complying with these rules, their responsibilities in executing those procedures, and how to meet those responsibilities. The training shall:

(1) Include background information on skimmers, including information about the harm skimmers can cause to customers and to the business, information about the different types of skimmers and how to identify them, and information about the types of suspicious activity or warning signs that may suggest someone is attempting to install or has installed a skimmer, including:

(A) Vehicles parked at a motor fuel dispenser for a long time or returning to the same dispenser frequently;

(B) Large vehicles blocking the view of dispensers;

(C) Attempts by one customer to distract store personnel while a partner remains at the dispenser;

(D) Technicians purporting to perform unscheduled work on dispensers; and

(E) High levels of invalid card read errors or other problems with dispensers accepting cards;

(2) Include details on the merchant's procedures to prevent the installation of skimmers;

(3) Include details on the merchant's procedures for when a skimmer is detected, whether such skimmer is detected by the merchant or reported to the merchant by a third party;

(4) Include details on the disciplinary consequences employees may face for failing to comply with the merchant's policies and procedures related to these rules; and

(5) Be provided to new employees as part of the merchant's regular training program for new employees. If the merchant does not have a regular training program for new employees, the training shall be provided no later than seven days after the employee's first day of employment. Merchants shall thereafter provide employees ongoing training sufficient to ensure that employees are aware of any new procedures adopted by the merchant and aware of any new types of skimmers or warning signs for which employees must watch.

§56.3.Minimum Practices for Prevention of Skimmers.

A merchant that has an unattended payment terminal on a motor fuel dispenser at the merchant's place of business shall implement the following practices to prevent the installation of a skimmer on the dispenser:

(1) The merchant shall implement and maintain written policies and procedures and shall conduct training as detailed in §56.2 of this chapter.

(2) For each motor fuel dispenser with an unattended payment terminal, the merchant shall affix to or install onto the exterior of each door that provides access to an interior portion of the motor fuel dispenser from which the payment terminal or any electronic component connected to the payment terminal may be accessed, a locking device that requires an access key unique to that place of business.

(3) The merchant shall maintain a forecourt maintenance log that documents all work performed on the forecourt within the calendar year. The merchant shall require every person working on or accessing a dispenser to perform maintenance to sign in and present appropriate identification before any work is done on a dispenser or a payment terminal on a dispenser. The merchant shall retain the forecourt maintenance log for a minimum of 12 months after the end of the calendar year for which the log was maintained. The maintenance log shall include at a minimum:

(A) the name of the person working on or accessing the dispenser;

(B) the name of the company with which the person is employed;

(C) the person's service technician's license number, if applicable;

(D) the time at which the person began maintenance on the dispenser;

(E) the time at which the person finished maintenance on the dispenser; and

(F) an identification of the dispenser or other equipment where work was performed.

(4) The merchant shall use tamper-evident security labels to restrict unauthorized access to any unattended payment terminal on a motor fuel dispenser that is not EMV compliant and that is not protected by an electronic monitoring device. The merchant's use of tamper-evident security labels shall meet the following requirements:

(A) A tamper-evident security label must be placed over each panel opening that provides access to an interior portion of the dispenser from which the payment terminal or any electronic component connected to the payment terminal may be accessed;

(B) Each tamper-evident security label shall contain a serial number. Each tamper-evident security label used within a 12-month period must have a different serial number; and

(C) The merchant shall keep an annual log documenting the serial number of each currently installed label. Each time a label is changed, the merchant shall document the new serial number and reason for the change. The serial label log may be maintained electronically (e.g., through the use of a mobile application or software program). The merchant shall retain such logs for a minimum of 12 months after the end of the calendar year for which the log was maintained and shall regularly review the logs to ensure that they do not reveal a pattern of suspicious conduct.

(5) The merchant shall, at least daily, conduct a thorough inspection of the exterior of each motor fuel dispenser with an unattended payment terminal. In conducting such inspections, the merchant shall:

(A) Inspect the exterior of each motor fuel dispenser for signs that the dispenser has been opened or tampered with, including, for example, by confirming all locks are secured, and that there are no signs of scratches, pry marks, drilled holes, or other indications that a door has been compromised;

(B) Inspect the exterior of each motor fuel dispenser for signs of skimmers, shimmers, insert skimmers, overlays, hidden cameras, wireless antennas, new stickers or decals that might be hiding a hole, or other foreign objects;

(C) Inspect each serialized, tamper-evident label to ensure that the serial number matches the serial number log and that the label has not been cut or tampered with;

(D) Maintain current photos of the motor fuel dispensers, and make the dispenser photos easily accessible to employees inspecting dispensers so that they can use the photos to identify unauthorized stickers, decals, leaflet holders, and other materials that may have been added to hide holes or other alterations made to a dispenser;

(E) Maintain an annual log of each inspection conducted and retain such log for a minimum of 12 months after the end of the calendar year for which the log was maintained. Such logs shall include:

(i) the date and time of the inspection;

(ii) the name of person who did the inspection; and

(iii) an identification of the dispensers inspected; and

(F) If an inspection reveals any sign that a motor fuel dispenser has been opened or tampered with or that a skimmer has been installed, disable the dispenser and take appropriate steps to prevent customers from inserting a payment card into the payment terminal until someone who has been properly trained in the identification and detection of skimmers in motor fuel dispensers has inspected the dispenser. The merchant shall maintain a current photo of the interior of the dispenser that was taken at a time when the merchant is confident that there was no skimmer installed that can be used by the inspector to compare for unauthorized items installed inside the dispenser.

(6) The merchant shall monitor its dispensers and payment terminals for high levels of invalid payment card read errors or other indications of problems accepting payment cards which may indicate the presence of a skimmer. If the merchant detects such suspicious behavior, or if the merchant is notified by a card brand, a payment processor, a financial institution, law enforcement, or the Center that the merchant's place of business or a dispenser at the merchant's place of business is a common point of purchase for fraudulent activity, the merchant shall immediately disable each suspected dispenser until someone who has been properly trained in the identification and detection of skimmers in motor fuel dispensers has inspected the dispenser.

(7) If disabling a motor fuel dispenser as required by subparagraph (5)(F) or paragraph (6) of this section would cause a hardship on the merchant or substantially disrupt the merchant's business, the merchant may continue to allow the dispenser to operate but shall disable the payment terminal or take other steps to prevent customers from using the payment terminal or inserting a payment card into the payment terminal.

(8) The merchant shall maintain an annual log of all inspections conducted pursuant to subparagraph (5)(F) or paragraph (6) of this section and shall retain such logs for a minimum of 12 months after the end of the calendar year for which the log was maintained. The log shall include:

(A) the date and time of the inspection;

(B) the name of person doing the inspection;

(C) the name of the company with which the person doing the inspection is employed, if different from the merchant;

(D) the person's service technician's license number, if applicable; and

(E) an identification of the dispenser inspected.

§56.4.Additional Practices for the Prevention of Skimmers at Previously Compromised Places of Business.

A merchant that has an unattended payment terminal on a motor fuel dispenser at the merchant's place of business, and that has suffered a skimmer breach on more than two occasions in the previous 24 months at that place of business, shall implement the following additional practices to prevent the installation of a skimmer on dispensers at the merchant's place of business:

(1) No later than 30 days after the date on which the third discovery or notification of a skimmer was made or received, respectively, the merchant shall implement a program to electronically monitor motor fuel dispensers by installing an electronic monitoring device on each dispenser with an unattended payment terminal that is not EMV compliant. The merchant's electronic monitoring program must meet the following criteria:

(A) Whenever any door on the motor fuel dispenser is opened without authorization, the electronic monitoring device must:

(i) Immediately shut down power to the dispenser or otherwise prevent the dispenser from dispensing fuel; and

(ii) Sound an alarm that emits an audible alert continuously or at least every 30 seconds until deactivated by the merchant or send a notification to the merchant, including notification to the owner, an executive of the merchant, or someone with supervisory responsibility who has been designated by the owner or an executive of the merchant to receive such notifications;

(B) The electronic monitoring device must create a log of every event (e.g., each time the device is armed, disarmed, triggered, etc.). Such log shall be retained for a minimum of 12 months after the end of the period for which the log was maintained and the merchant shall monitor the logs for suspicious activity, including, for example, that the device was disarmed at unexpected times, that certain employees disarmed the device on a recurring basis, or that the device lost power at unexpected times; and

(C) After the electronic monitoring device has been triggered, the motor fuel dispenser shall remain inoperable until someone that has been properly trained in the identification and detection of skimmers in motor fuel dispensers has inspected the dispenser.

(2) The merchant shall conduct, at least once a month, a thorough inspection of the interior of each motor fuel dispenser with an unattended payment terminal for evidence of tampering or that a skimmer has been installed. Such inspections shall be conducted by a qualified person who has been specifically trained in the identification and detection of skimmers in motor fuel dispensers.

(3) The merchant shall maintain an annual log of all inspections conducted pursuant to subparagraph (1)(C) or paragraph (2) of this section and shall retain such logs for a minimum of 12 months after the end of the calendar year for which the log was maintained. The log shall include:

(A) the date and time of the inspection;

(B) the name of person doing the inspection;

(C) the name of the company with which the person doing the inspection is employed, if different from the merchant;

(D) the person's service technician's license number, if applicable; and

(E) an identification of the dispenser inspected.

§56.5.Additional Practices for the Prevention of Skimmers at Highly Compromised Places of Business.

A merchant that has an unattended payment terminal on a motor fuel dispenser at the merchant's place of business, and that has suffered a skimmer breach on more than four occasions in the previous 24 months at that place of business, shall implement the following additional practices to prevent the installation of a skimmer on dispensers at the merchant's place of business:

(1) No later than 30 days after the date on which the fifth discovery or notification of a skimmer was made or received, respectively, the merchant shall install and thereafter maintain high resolution video cameras, positioned to record the license plate of each vehicle that approaches or leaves the merchant's motor fuel dispensers, and to record persons dispensing gas at the dispensers. Video cameras shall be placed so that images of vehicle license plates and of persons dispensing gas at the dispenser are captured at a minimum resolution of 60 pixels per foot. All video footage shall be retained for at least 31 days after the date on which the footage was recorded; and

(2) No later than 30 days after the date on which the fifth discovery or notification of a skimmer was made or received, respectively, the merchant shall install and thereafter maintain proper lighting on the station forecourt. Areas around each dispenser island and under all canopies shall be illuminated so that the minimum horizontal illuminance at grade level is 10 footcandles.

§56.6.Detection, Reporting, and Removal of Skimmers.

A merchant that has an unattended payment terminal on a motor fuel dispenser at the merchant's place of business shall do the following when the merchant detects a skimmer on one of the merchant's motor fuel dispensers or receives a report of a skimmer on one of the merchant's motor fuel dispensers:

(1) The merchant shall not touch the skimmer;

(2) The merchant shall immediately disable both sides of the motor fuel dispenser on which the skimmer was discovered;

(3) The merchant shall immediately notify an appropriate law enforcement agency;

(4) The merchant shall protect the motor fuel dispenser from tampering until law enforcement arrives by taking appropriate steps, including:

(A) Covering the nozzle;

(B) Covering the payment terminal on the dispenser;

(C) Blocking access to dispenser (e.g., by using cones, tape, etc.);

(5) The merchant shall report the skimmer to the Department within 24 hours;

(6) The merchant shall run a receipt for the last transaction on the fuel dispenser to timestamp the event;

(7) The merchant shall cooperate with law enforcement, the Department, and the Center in the investigation of the skimmer, including by providing access to the motor fuel dispenser for removal of the skimmer;

(8) The merchant shall preserve all video surveillance and access logs related to the compromised motor fuel dispenser and provide a copy to law enforcement, the Department, or the Center upon request. Notwithstanding any other retention period mandated by this chapter, the merchant shall retain all video surveillance and access logs related to the compromised dispenser until a copy has been provided to law enforcement, the Department, or the Center, or until the merchant has been advised by law enforcement, the Department, or the Center that the material may be destroyed; and

(9) If neither law enforcement nor the Department has arrived or contacted the merchant within 24 hours after the merchant reports the skimmer to the Department, the merchant may:

(A) While wearing sterile gloves, carefully remove the skimmer;

(B) Place the skimmer in a clear plastic bag, seal the bag, and label the sealed bag with the date and time the skimmer was removed and bagged, along with the initials of the person removing and bagging the skimmer;

(C) Take a picture of the skimmer in the bag; and

(D) Place the bag in a secured area (e.g., locked file cabinet) for pick-up by law enforcement.

The agency certifies that legal counsel has reviewed the proposal and found it to be within the state agency's legal authority to adopt.

Filed with the Office of the Secretary of State on October 21, 2019.

TRD-201903828

Ryan L. Bangert

Deputy Attorney General for Legal Counsel

Office of the Attorney General

Earliest possible date of adoption: December 1, 2019

For further information, please call: (512) 475-3210


PART 15. TEXAS HEALTH AND HUMAN SERVICES COMMISSION

CHAPTER 355. REIMBURSEMENT RATES

SUBCHAPTER J. PURCHASED HEALTH SERVICES

DIVISION 32. CLINICAL LABORATORY SERVICES

1 TAC §355.8610

The Executive Commissioner of the Texas Health and Human Services Commission (HHSC) proposes an amendment to §355.8610, concerning Reimbursement for Clinical Laboratory Services.

BACKGROUND AND PURPOSE

HHSC proposes to amend the rule governing Clinical Laboratory Services reimbursement. This amendment updates the rule to allow HHSC to establish fees based on a percentage of the Medicare fee schedule and removes the limitation that would not allow payments to exceed the Medicare fee schedule. Currently, HHSC Medicaid fees for clinical laboratory services provided by the Department of State Health Services (DSHS) Laboratory are set at 100 percent of the Medicare fee. The Medicare fee schedule may adjust fees more frequently or in a manner that could negatively impact the DSHS Laboratory. Of particular concern is the series of tests that comprise the newborn screening, which are provided solely by the DSHS laboratory for all Texas newborns.

This amendment allows HHSC to reimburse for clinical laboratory services at a percentage of the Medicare fee schedule, which still permits flexibility for HHSC to maintain existing funding for the DSHS Laboratory and their ability to continue to provide newborn screenings for Medicaid newborns.

SECTION-BY-SECTION SUMMARY

The proposed amendment to §355.8610 updates language to specify that fees will be established at a percentage of the Medicare fee schedule and removes the reference for payments to be limited to the Medicare fee schedule.

FISCAL NOTE

Trey Wood, Chief Financial Officer, has determined that for each year of the first five years that the rule will be in effect, enforcing or administering the rule does not have foreseeable implications relating to costs or revenues of state or local governments.

GOVERNMENT GROWTH IMPACT STATEMENT

HHSC has determined that during the first five years that the rule will be in effect:

(1) the proposed rule will not create or eliminate a government program;

(2) implementation of the proposed rule will not affect the number of HHSC employee positions;

(3) implementation of the proposed rule will result in no assumed change in future legislative appropriations;

(4) the proposed rule will not affect fees paid to HHSC;

(5) the proposed rule will not create a new rule;

(6) the proposed rule will not expand, limit, or repeal existing rules;

(7) the proposed rule will not change the number of individuals subject to the rule; and

(8) the proposed rule will positively affect the state's economy.

SMALL BUSINESS, MICRO-BUSINESS, AND RURAL COMMUNITY IMPACT ANALYSIS

Trey Wood has also determined that there will be no adverse economic effect on small businesses, micro-businesses, or rural communities as there is no requirement to alter business practices.

LOCAL EMPLOYMENT IMPACT

There will be no impact on local economy.

COSTS TO REGULATED PERSONS

Texas Government Code §2001.0045 does not apply to this rule because the rule does not impose a cost on regulated persons.

PUBLIC BENEFIT AND COSTS

Victoria Grady, Director of Rate Analysis, has determined that for each year of the first five years the rule is in effect, the public will be ensuring the Department of State Health Services Laboratory receives a reimbursement rate adequate to be able to continue performing public health activities.

Victoria Grady has also determined that for the first five years the rule is in effect, there are no anticipated economic costs to persons who are required to comply with the proposed rule.

TAKINGS IMPACT ASSESSMENT

HHSC has determined that the proposal does not restrict or limit an owner's right to his or her property that would otherwise exist in the absence of government action and, therefore, does not constitute a taking under Texas Government Code §2007.043.

PUBLIC COMMENT

Questions about the content of this proposal may be directed to Kevin Niemeyer in HHSC Rate Analysis at (512) 730-7445.

Written comments on the proposal may be submitted to HHSC, c/o Kevin Niemeyer, Mail Code H400, 4900 North Lamar Blvd, Austin, Texas 78751-2316 by fax to (512) 730-7475; or by email to RateAnalysisDept@hhsc.state.tx.us.

To be considered, comments must be submitted no later than 31 days after the date of this issue of the Texas Register. Comments must be: (1) postmarked or shipped before the last day of the comment period; (2) hand-delivered before 5:00 p.m. on the last working day of the comment period; or (3) faxed or e-mailed before midnight on the last day of the comment period. If last day to submit comments falls on a holiday, comments must be postmarked, shipped, or emailed before midnight on the following business day to be accepted. When faxing or e-mailing comments, please indicate "Comments on Proposed Rule 19R042" in the subject line.

STATUTORY AUTHORITY

The amendment is authorized by Texas Government Code §531.0055, which provides that the Executive Commissioner of HHSC shall adopt rules for the operation and provision of services by the Health and Human Services agencies; Texas Government Code §531.033, which provides the Executive Commissioner of HHSC with broad rulemaking authority; Texas Human Resources Code §32.021 and Texas Government Code §531.021(a), which provide HHSC with the authority to administer the federal medical assistance (Medicaid) program in Texas; and Texas Government Code §531.021(b), which establishes HHSC as the agency responsible for adopting reasonable rules governing the determination of fees, charges, and rates for medical assistance (Medicaid) payments under Texas Human Resources Code Chapter 32.

The amendment affects Texas Government Code §531.0055, Texas Government Code Chapter 531, and Texas Human Resources Code Chapter 32.

§355.8610.Reimbursement for Clinical Laboratory Services.

Clinical diagnostic laboratory tests performed in a practitioner's office, by an independent laboratory, or by a hospital laboratory for its outpatients shall be reimbursed the lower of the provider's usual customary charge for that service or a maximum fee determined by the Texas Health and Human Services Commission (HHSC) or its designee. HHSC or its designee will review maximum fees at least every two years, with any adjustments made within available funding. Fees [Payments] for services provided will be established at a percentage of [must not exceed] the Medicare fee schedule.

The agency certifies that legal counsel has reviewed the proposal and found it to be within the state agency's legal authority to adopt.

Filed with the Office of the Secretary of State on October 17, 2019.

TRD-201903781

Karen Ray

Chief Counsel

Texas Health and Human Services Commission

Earliest possible date of adoption: December 1, 2019

For further information, please call: (512) 730-7445