United States: FTC Again Delays Enforcement of Identity Theft Red Flag Rules

The Federal Trade Commission (FTC) has again delayed enforcement of its identity theft Red Flags Rule (the Rule) through Dec. 31, 2010, while Congress considers legislation to determine the types of businesses that are covered by the Red Flags Rule.

Pressure on the FTC to limit the scope of the Rule has come from several sources, including lawsuits filed by the American Bar Association and several medical associations as reported in our May 2010 Health Care Alert, "Medical Associations File Lawsuit to Prevent Application of FTC Red Flags Rule to Physicians," available at www.btlaw.com/news.asp?news_id=19698.

The Rule is aimed primarily at financial institutions and other "creditors" who maintain "covered accounts" such as credit cards or loans. The Rule requires "creditors" to implement written identity theft prevention and detection plans. The definition of "creditor" was written broadly in the statute and the FTC interpreted it to include attorneys, law firms and health care organizations, including physician practices, that provide professional services and later bill clients or patients on an installment program. The Rule was originally set to take effect Nov. 1, 2008, but has been delayed several times in the face of pressure to limit its applicability.

On Oct. 30, 2009, the U.S. District Court for the District of Columbia ruled that the FTC overstepped its regulatory authority and may not apply the Red Flags Rule to attorneys and law firms. That decision is currently on appeal by the FTC. On June 25, 2010, the medical associations and the FTC reached a joint agreement that the FTC will delay enforcement of the Red Flags Rule with respect to physician members of the medical associations and other state medical societies for 90 days after the date on which the U.S. Court of Appeals for the District of Columbia reaches a decision in the appeal of the American Bar Association lawsuit.

Therefore, general enforcement of the Red Flags Rule is now scheduled to begin on Jan. 1, 2011, but with respect to most physicians, that enforcement date is also subject to pending Congressional action as well as the outcome of the two lawsuits against the FTC.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.