Déjá Vu All Over Again? The FTC Delays the Red Flags Rule to November 1
Health Law Update 07/30/09 Sarah E. Coyne, Kevin J. Eldridge
Stop us if you've heard this one before: It's the eve of the effective date for the Federal Trade Commission's ("FTC's") Red Flags Rule (the "Rule"), and as health care providers across the country are scrambling to get policies into place to comply with the Rule (assuming they did not do so for one of the previous compliance dates), the FTC relents and delays the Red Flags Rule for another three months.
Well, on July 29, a mere three days before the Red Flags Rule was to become effective, the FTC announced that it was delaying enforcement of the Rule until November 1, 2009. This follows previous delays in October 2008 and May 2009, so we are now operating under the fourth consecutive compliance date for this rule. The FTC press release announcing the most recent delay is available here: http://www.ftc.gov/opa/2009/07/redflag.shtm.
As we discussed in our April and May Health Law Updates, the Red Flags Rule applies to "creditors" with "covered accounts" - or, in clearer terms, essentially any entities, including health care providers, that permit deferred payment for goods or services. The Rule requires that covered health care providers have in place a program to identity, detect and respond to red flags for potential identity theft in association with patient accounts.
Despite continued protests from the American Medical Association, the FTC has been unwilling to exempt health care providers from the Red Flags Rule. (Don't worry, as lawyers are currently subject to the Rule as well, despite the ABA's threat to sue the FTC if it doesn't exempt lawyers.)
In the most recent press release, the FTC announced that it would soon release additional educational tools pertaining to the Red Flags Rule. Many of the FTC's already existing educational tools are available at the FTC Red Flags website.
For more details, or if you have any questions, please contact Sarah Coyne at (608) 283-2435 / firstname.lastname@example.org, Kevin Eldridge at (608) 283-2452 / email@example.com or your Quarles & Brady LLP attorney.