FTC further delays Red Flags Rule until year's end

The U.S. Federal Trade Commission (FTC) will further delay enforcement of the Red Flags Rule until Dec. 31 at the “request of several members of Congress” to narrow the scope of the regulation. The rule was set to take effect today.

According to the FTC, the rule was developed under the Fair and Accurate Credit Transactions Act, in which Congress directed the FTC and other agencies to develop regulations requiring “creditors” and “financial institutions” to address the risk of identity theft. The resulting Red Flags Rule requires all such entities that have “covered accounts” to develop and implement written identity theft prevention programs to help identify, detect, and respond to patterns, practices or specific activities—known as red flags—that could indicate identity theft. The rule requires physicians and hospitals to adopt written plans for tracking and responding to indicators of identity theft in their billing operations.

On May 25, Sens. John Thune, R-S.D., and Mark Begich, D-Alaska, introduced a bill (S 3416), seeking to exempt certain small businesses, including physician and dentist offices from the rule.

Also, last week, American Medical Association, American Osteopathic Association and the Medical Society of the District of Columbia announced they had jointly filed a lawsuit in federal court seeking to prevent the FTC from extending identity theft regulations to physicians.

“Congress needs to fix the unintended consequences of the legislation establishing the Red Flags Rule – and to fix this problem quickly. We appreciate the efforts of Congressmen Barney Frank and John Adler for getting a clarifying measure passed in the House, and hope action in the Senate will be swift,” FTC Chairman Jon Leibowitz said. “As an agency we’re charged with enforcing the law, and endless extensions delay enforcement.”

The FTC was originally supposed to start enforcing the Red Flags Rule in 2008, but this marks the fourth time it has been postponed, after its most recent delay in November 2009.

The Commission is urging Congress to “act quickly” to pass legislation that will resolve any questions as to which entities are covered by the rule and obviate the need for further enforcement delays. If Congress passes legislation limiting the scope of the Red Flags Rule with an effective date earlier than Dec. 31, the Commission said it will begin enforcement as of that effective date.