Industry Blog: Red Flag Rules: The FTC Piles On

The FTC Red Flags Rule will be effective November 1, 2009. This rule requires "creditors" under certain "covered accounts" to maintain a heightened alertness to numerous categories of "red flags" that may indicate that the consumer who is the rightful account holder is the victim of identity theft. If a red flag is triggered, the creditor must take steps to notify the consumer and correct any inappropriate information included the creditor's records.

As you probably already know, the FTC is extending its reach with this rule (among others) into the health care sector. (Cf. the FTC's role in enforcing certain Son of HIPAA provisions.) The AMA has all but dropped a draft complaint on the FTC's desk, citing assorted legal precedents in its correspondence with the FTC arguing that the Red Flags Rule should not apply to physician practices. The FTC is unmoved -- except to the extent that it has been willing to delay the effective date three times (from November 2008 to May 2009 to August 2009 to November 2009).