FTC Extends Enforcement Deadline for Identity Theft Red Flags Rule

June 4, 2010 | Corporate | Health Services

The Federal Trade Commission (FTC) is further delaying enforcement of the “Red Flags” Rule through December 31, 2010, while Congress considers legislation that would affect the scope of entities covered by the Rule. The Rule currently requires medical practices to develop and implement policies that would help prevent identity theft, arguably a burdensome requirement for small to medium-sized medical practices.

The Rule was developed under the Fair and Accurate Credit Transactions Act, in which Congress directed the FTC and other agencies to develop regulations requiring “creditors” and “financial institutions” to address the risk of identity theft. The resulting Red Flags Rule requires all such entities that have “covered accounts” to develop and implement written identity theft prevention programs to help identify, detect and respond to patterns, practices or specific activities – known as “red flags” – that could indicate identity theft. The FTC maintains that medical practices, who sometimes delay collection of payment for services, fall within covered entities that extend credit to their “customers.” Physicians and attorneys (who are also currently included in the Rule) have argued that the practice of their billing patients and clients after services are rendered should not place them within the category of financial institution entities required to have red flag procedures. Several organizations, including the American Medical Association, have engaged in lobbying and legal efforts to exempt their constituents.

The Rule initially required full compliance for all covered entities originally by November 1, 2008. The FTC has postponed enforcement several times. Most recently, the Commission announced in October 2009 that at the request of certain Members of Congress, it was delaying enforcement of the Rule until June 1, 2010, to allow Congress time to finalize legislation that would limit the scope of businesses covered by the Rule. The FTC has asked Congress to pass legislation that will resolve any questions as to which entities are covered by the Rule and obviate the need for further enforcement delays. According to the FTC, if Congress passes legislation limiting the scope of the Red Flags Rule with an effective date earlier than December 31, 2010, the FTC will begin enforcement as of that effective date.

Reprinted with permission. All rights reserved. Further duplication without permission is prohibited.

Related Publications


Legal updates and news delivered to your inbox