News & Resources

Publications & Media

Change of Deadline: Three More Months To Comply With FACTA Red Flags Rule

Health Law Update Sarah E. Coyne, Kevin J. Eldridge

Take the summer off and relax, assuming the only item on your to-do list is Red Flags Rule Compliance. The Federal Trade Commission ("FTC") announced on Thursday, April 30, 2009 that the "Red Flags" rule compliance date has been changed yet again, to August 1, 2009. Originally, the compliance date was November 1, 2008, but the FTC moved back the date to May 1, 2009. Then, one day before that compliance date, the FTC again put the Red Flags Rule on hold - this time until August 1, 2009. For those interested in the official announcement, the FTC's press release regarding the most recent delay is available here.

The Red Flags Rule was adopted pursuant to the Fair and Accurate Credit Transactions Act of 2003 ("FACTA"), which directed the FTC and other agencies to promulgate rules requiring "creditors" and "financial institutions" with covered accounts to implement programs to identify, detect and respond to patterns, practices or specific activities that could indicate identity theft.

The FTC has acknowledged that the scope of the rule is extremely broad, netting physicians and other health care providers, among many other businesses, based primarily on the definition of "creditor," which means any entity that regularly extends or renews credit, or arranges for others to do so, and includes all entities that regularly permit deferred payments for goods or services. In the press release announcing the delay, the FTC gave some concrete examples of creditors, including finance companies, automobile dealers that provide or arrange financing, mortgage brokers, utility companies, telecommunications companies, nonprofit and government entities that defer payment for goods or services, and businesses that provide services and bill later, including many lawyers, doctors and other professionals.

In our last update on this Rule, we informed you that the FTC had rejected the American Medical Association ("AMA") argument that the rule should not apply to physicians and other health care providers. The AMA has posted, on its Red Flags web page, the following notice: The Federal Trade Commission ("FTC") has delayed the compliance deadline of the Red Flags Rule until August 1, 2009. The AMA will utilize this time to convince the FTC and Congress that physicians are not "creditors" and therefore should not be subject to this rule.

The FTC has provided web resources on the Red Flags requirements, available at Another particularly helpful resource is the FTC's "How-To" guide for complying with the Red Flags Rule.

* * *

For more details, or if you have any questions, please contact Sarah Coyne at 608-283-2435 / [email protected], Kerry Moskol at 608-283-2609 / [email protected], Kevin Eldridge at 608-283-2452 / [email protected] or your Quarles & Brady LLP attorney.

Payment Portal

You are leaving the Quarles & Brady website and being directed to the bill presentment and paying service offered by a third party provider. If you do not wish to continue to the site, click Close or use the Back button on your web browser to return the Quarles & Brady website.