Walgreen’s Android Lollipop App

Quick Guide to Regulatory Guidelines for Kiosks, ATMs and Point-of-Sale Systems

Government rules controlling the use of kiosks in the marketplace change on almost a daily basis. Deployers need to be aware of those regulations to avoid paying hefty fines.

The key measurement to keep in mind when ensuring kiosks are compliant with the ADA is 48 inches.

As kiosks become an increasing fixture in the marketplace, the rules gov- erning the use of those kiosks continue to evolve. And failing to comply with those rules can lead to harsh penalties.

Violations of Americans with Disabilities Act (ADA) standards can incur thousands of dollars in fines for each occurrence as well as the possibility of a lawsuit by the affected party. For merchants accepting credit card pay- ments via a kiosk, running afoul of Payment Card Industry (PCI) standards can result in millions of dollars in fines. Under the Health Insurance Porta- bility and Accountability Act (HIPAA), violations of privacy regulations when using kiosks for patient registration and bill payments can result in fines of up to $1 million a year.

While it is impossible to condense all of the rules and regulations governing kiosks into a few pages, we will try to cover the highlights and show deploy- ers where to go for more information.

Kiosks and ADA
Wondering if a kiosk is going to be covered by ADA standards? If the kiosk is going to be used in a public environment, the answer is yes. In addition, if the kiosk is used internally by employees, if it is operated by a federal, state, city or other governmental organization or if the kiosk or any portion of the project receives any federal funds, ADA standards apply.

Rules governing kiosks and ADA standards primarily revolve around ac- cess. The key measurement to keep in mind when ensuring kiosks are compliant with the ADA is 48 inches. This is the maximum height of the interactive touch point on any kiosk.

Additional measurements to be aware of include:

Forward reach. The minimum height for kiosks to be accessible for all self-service customers is 15 inches (with a maximum of 48 inches). These height requirements may change slightly when an obstruction is placed in front of the kiosk. Obstructions are defined as anything that creates space between the customer and the kiosk’s interactive screen.

Side reach. As long as an obstruction in front of the kiosk is less than or equal to 10 inches, the minimum and maximum heights are not changed.

If the obstruction is greater than 10 inches, however, the maximum height is lowered to 46 inches.

Wall-mounted kiosks. A wall-mounted kiosk must have a horizontal protrusion less than or equal to 4 inches to protect all customers as well as passersby. In addition, the kiosk must be at least 27 inches above the ground but can be no more than 80 inches above the ground.

With the advent of touchscreens, the Department of Justice is considering changes to ADA rules governing access for the visually impaired. Certain kiosks already are required to provide such access.

ADA recommends that the viewing angle for wheelchairs be equivalent.

Other elements include audio voice guidance, raised input devices, key- pads, function keys and Braille.

Kiosks and PCI compliance
The rules governing kiosks that accept payment cards essentially are the same as those governing other avenues of credit and debit card transactions.

The PCI Data Security Standard is the global data security standard adopt- ed by the payment card brands for all entities that process, store or transmit cardholder data. It consists of steps that mirror security best practices.
The PCI Security Council sets the PCI security standards, but each payment card brand has its own program for compliance, validation levels and enforcement.

There are two areas to look at. One is the merchant side, which is most often documented. Self-service public terminals generally will deal with these so that the self-service terminal is “out of scope.”

For reference the merchant steps to ensure PCI compliance include:

• Building and maintaining a secure network
• Protecting cardholder data
• Maintaining a vulnerability management program
• Implementing strong access control measures
• Regularly monitoring and testing networks
• Maintaining an information security policy

The PCI Security Council sets the PCI security standards, but each payment card brand has its own program for compliance, validation levels and enforcement.

For self-service terminals best practices for consideration include:

1. Don’t handle or process any data locally in any fashion if it can be avoided. This is your “out of scope” scenario.
2. If the software application is being provided then the provider ideally is Payment Application – Data Security Standard listed and certified.
3. If the software application provider has not undergone PA DSS certification, have they gone thru Qualified Security Assessor evaluation for compliance criteria? This costs money and verifies that software provider is indeed out of scope. Having a letter that says they are not impacted by PCI is not equivalent.
4. Card readers should support encryption (not necessarily activated).
5. Readers should support EMV. October 2015 is the date for EMV acceptance. If not accepting EMV on that date then MasterCard will not accept any liability due to fraud. More information is available here.

Although many HIPAA regulations are simply common-sense extensions of the rules governing protection of paper records, electronic devices introduce a new set of considerations, including how data is to be encrypted.

• Privacy for pin entry must be accommodated
• Internal access must be carefully secured.
• No data cached or otherwise stored.
• Encrypted file system in event of theft.

Kiosks and HIPAA
Along with allowing patients to check in and fill out forms electronically instead of via paper, kiosks in health-care facilities are being used to perform a host of functions ranging from verifying insurance coverage to accepting bill payments. In addition, there are a number of new kiosk applications in the marketplace that gather patient health information such as blood pressure and vision tests and allow users to send that information via email or text.

Both of those scenarios fall under the jurisdiction of the Health Insurance Portability and Accountability Act of 1996. Title II of HIPAA, known as the Administrative Simplification provisions, requires the establishment of na- tional standards for electronic health care transactions and national identi- fiers for providers, health insurance plans and employers.

Although many HIPAA regulations are simply common-sense extensions of the rules governing protection of paper records, electronic devices introduce a new set of considerations, including how data is to be encrypt- ed. Physicians need to participate in a formal compliance plan to ensure requirements are met. States may have additional requirements that go beyond federal rules.

The new rules consist of three main components:

HIPAA — The Privacy Rule

The Privacy Rule governs the use and disclosure of an individual’s protect- ed health information. Physicians who transmit a patient’s health informa- tion electronically in a transaction covered under HIPAA, such as filing claim forms electronically or verifying insurance coverage, are bound by HIPAA even if they are using a third-party service to conduct those transac- tions. The Privacy Rule applies to protected health information in any form, including paper and electronic.

HIPAA — The Security Rule

The HIPAA Security Rule establishes national standards to protect indi- viduals’ electronic personal health information that is created, received, used or maintained by a health-care facility or associated entity covered by HIPAA. The rule requires appropriate administrative, physical and technical safeguards to ensure the confidentiality, integrity and security of electronic protected health information. The rule does not apply to information trans- mitted orally or via paper.

HIPAA — The Breach Notification Rule

The Breach Notification Rule requires facilities covered by HIPAA to notify affected individuals as well as the Department of Health and Human Ser- vices in the event of a breach of a patient’s personal health information. In some cases, the facility will be required to notify the media as well.

Best practices for patient terminals include:

• Privacy wings, privacy screens or “lenticular” screens
• Ideal placement of input screen for each patient for maximum privacy effect.
• Encryption of devices including computer file system.
• Placement of kiosks with consideration of privacy.

Additional Standards in Plain English

• UL : In the US it is important to utilize UL certified components. Be care-ful of lower cost “modified” components which violate those regulations.
• UL-291 : the is the rating for safes. A UL-291 certified safe will present x amount of difficulty for thieves to break into. There are also UL-291 “compliant” safes (see note above re: UL)
• OPOS – common framework that transactional devices utilize in POS allowing for interchange of devices from different manufacturers. This is Unified POS in ARTS by NRF.
• ARTS – originated by National Retail Federation and includes Data Model, UnifiedPOS, and ARTS XML
• XFS : used in the ATM industry as interface platform standard.
• CUSS Certified – an airline check-in device which has been tested and certified in a platform by IATA.

Dates to remember:

September 23, 2013 ― Covered entities and business associates are required to come into full compliance with the HIPAA Omnibus Rule.
November 7, 2013 ― Release of Version 3.0 of the PCI Data Security Standard.

April 2014― Rules covering the accessibility of public websites under consideration.

In conclusion

The government regulations covering the use of kiosks in the marketplace change on nearly a daily basis, and it is impossible for any deployer to keep up with those regulations while managing its own business. An experienced kiosk provider, on the other hand, is involved in the industry every day and keeps up with those ever-changing regulations. While this paper can serve as a starting point for merchants to familiarize themselves with the rules governing the use of kiosks, the best way to protect oneself is to work with such a provider.

Writer(s):  Craig Keefner with Richard Slawsky

Self-Service technology is more and more a critical component of a company’s business plan. According to research firm Technavio, the global market for interactive technology is forecast to grow by as much as 15 percent a year by 2016.

Developing a strategy typically involves a long, costly planning process to establish the most effective way of converting more conventional mechanisms into customer self-service and how that impacts employees, your company’s operations, not to mention hardware, application or infrastructure and software costs. So when a business looks for ways to manage initial up-front capital costs of a deployment, usually any hardware, software and/or application development is going to come under careful scrutiny.

But short-changing up front rarely results in an effective result later, and the project usually ends up costing much more down the road in terms of lost revenue or dissatisfied customers. In some corporate environments a manager’s term might average 12 months before a new position and there can be the manager who starts the projects, then the manager who kills (or fixes) the project. Unless the self-service initiative is defined as short term in nature (e.g. Christmas promotion), off the shelf consumer-driven products will never be the best option. Short term is where optimizing costs via “distressed consumer inventory” can be a COGS opportunity, never in medium or long-term.

Deciding how to proceed

Self-service stations, whether tablet, mobile or terminals, are being deployed in industries ranging from retail to health care, offering services such as product information and ordering, bill pay and check-in. The applications are limited only by the imagination and budget of your company.

When it comes to converting to self-service, there are generally two ways that will be recommended to you on how to proceed: Adapting an off-the shelf “done before” unit to meet the end users’ needs or working with your partner firm to custom design a unit designed for a specific purpose.

Off-the-shelf “standard” metal kiosks are those that can be manufactured in anticipation of mass purchases. With metal kiosks this means lower metal costs for the manufacturer (if you use metal) and overall fewer processes and variables. Because those units are manufactured in bulk, they are typically less expensive than their custom counterparts. For a long time the standard was wood and particle board for conventional kiosks, then that became metal (16 gauge steel) and now that has started to evolve to lower cost materials, as well.

“Some types of units such as ATMs or point-of-sale terminals have a primary and definitive function, so it’s easy and fast to use those units in multiple environments,” said Craig Keefner, manager with Menomonee Falls, Wis., interactive solutions provider CTS. “On the other hand, try and add additional functions to those types of devices and suddenly transaction times slow down. Unless the additional transaction can be done in parallel the customer ends up asking why it took so long.”

But then consider how the advent of mobile O/S into POS systems is now providing an enhanced multi-threaded experience. The social connection frameworks for iPad and Android tablets allow for vendors such as Revel Systems, to query, in parallel, the social networks for any consumer reaction while it is still processing their order and/or payment. The end result
is the restaurant gets an opportunity to protectively react to a positive or a negative review.

If the proposed application is one that isn’t already in widespread use, chances are an off-the-shelf unit will not fully address the potential deployer’s needs. Trying to shoehorn a standard unit with new ad hoc functions for which it wasn’t designed will almost always lead to less-than-satisfactory or marginal results. It is natural to try to take this approach. Ironically, your vendor will also tend to favor the fastest transaction and most times will support that point of view. That can be a sure sign that your vendor is more interested in your money than your success.

In addition, everything from the main interaction screen to accompanying digital signage and the kiosk enclosure, as well as the user experience itself, offers an opportunity to enhance the branding experience and even monetize that branding. A standard unit with some sort of vinyl decal can marginalize your brand (and in turn that brand’s profits). There can be spe- cific regulatory standards in your market that benefit from more precise targeting (or fitting). Better to protect your assets than to create liabilities. You can have existing “environments” where the self-service needs to be part of integrated design, not just an isolated, cold, sterile, stainless steel pedestal in the corner. In these scenarios a “fitted” self-service solution is in order.

Benefiting from the right partner’s experience

Rather than taking a standard consumer-driven product and trying to adapt it to a purpose for which it was not designed, the deployer can work with a full service design firm to come up with a solution that meets all their needs, not just the expedient initial cost equation. In addition, an experienced solutions partner works with you to evaluate the possibilities and determine the best way to accomplish the goals you have in mind.

While working with a custom solutions provider may cost a bit more up front, the long term savings both in terms of heartache and dollars can be immense. It can easily be 12 months before you can fully judge the value and the relationship. Does this provider have long term design relationships or do they just sell “that kiosk”?

Which partner to pick depends on the goal the end user hopes to achieve, and rating providers by their experience in similar projects is a key part of due diligence. The healthcare market has very specific characteristics, for example, while retail and banking have a different but equally important set of issues that come in to play. The same applies to any industry that may benefit from the use of self-service devices.

Your provider should offer a wide variety of form factors and materials. The older kiosk enclosure companies tend to work in metals and there is wider
Custom kiosks vs. off-the-shelf

OFF-THE-SHELF

Pros

• Low initial cost
• Faster deployment
• Standard design

Cons

• May not meet the deployer’s specific needs
• May not match the deployer’s branding efforts

CUSTOM

Pros

• Can be designed to meet specific needs
• Can be integrated with existing branding efforts
• Experienced kiosk design can help avoid costly missteps

Cons

• Higher cost
• Design process can take a significant amount of time.