[ Wednesday, July 29, 2009 ]
Red Flags Update: The FTC has again delayed enforcement of the Red Flags Rule, which requires financial institutions and other "creditors" to establish identity theft protection programs to (i) identify "red flags" that would indicate that a customer or client might be the victim of identity theft (ii) detect when a "red flag" has been raised, and (iii) take steps to address any identity theft situation that comes to light.
This is the third delay of the effective date of the Rule. The original rule was to be effective January 1, 2009 for most "creditors" (financial institutions have been subject to the rule since November 2008), but the effective date was delayed to May 1, 2009 due to confusion among entities (specifically including physicians) who might be considered "creditors." On the day before the May 1 deadline, the FTC announced that it would push the deadline back to August 1, and would provide a template that creditors could use to form their own identity theft prevention programs. As the August 1 deadline loomed, without the promised delivery of the template from FTC, the agency again decided to extend the deadline, this time until November 1, 2009.
The AMA engaged in a highly-publicized fight with the FTC over whether physicians should be considered "creditors" at all. The FTC has stated that it considers physicians to be "creditors" because of the customary delay between providing services and collecting payments, but the AMA has not conceded the fight yet, and has threatened to sue the FTC and force it to re-issue the Red Flags Rules in the Federal Register (at least as relates to the applicability to physicians) and re-open the regulations for public comment.
Interestingly, the FTC's announcement that it was moving the May deadline came in a press release entitled "FTC Will Grant Three-Month Delay . . .", while the announcement moving the August deadline is entitled, "FTC Announces Expanded Business Education Campaign on Red Flags Rule." Instead of focusing on the need to give businesses more time to construct their programs, the announcement focuses on the FTC's "redoubl[ing] its efforts to educate" small businesses and "providing additional resources and guidance. . . ." The press release specifically notes that alleviating the burden on health care providers is an impetus behind the new delay.
Jeff [10:44 AM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
