Red Flag Rules deadline delayed

1 June 2010

Once again, the Federal Trade Commission (FTC) has delayed the deadline for enforcement of the Red Flag Rules until Dec. 31, 2010 at the request of several members of Congress. This was done in part by the efforts of several national medical societies to block the rule by filing a lawsuit in federal court.

The rule was developed under the Fair and Accurate Credit Transactions Act in which Congress directed the FTC and other agencies to develop regulations requiring “creditors” and “financial institutions” to address the threat of identity theft. Essentially, by establishing an account that allows a patient to make multiple payments, a health care provider is considered a “creditor” maintaining “covered accounts,” and thus is subject to certain provisions of the Red Flag Rules.

The Red Flag Rules have been issued enforcement extensions multiple times since its original deadline for compliance by Nov. 1, 2008. Health care providers will now have until Dec.31, 2010 to implement a written medical identity theft program. However, if Congress passes legislation limiting the scope of the rule with an effective date earlier than Dec. 31, the Commission will begin enforcement as of that date. 

For more information and for sample Red Flag Rule policies, please visit MSV's Knowledgebase: http://www.msv.org/RedFlagRules