Red Flags Rule Enforcement Deadline Postponed Again

In November 2007, the Federal Trade Commission and five other federal agencies jointly promulgated the “Red Flags Rule” implementing the Fair and Accurate Credit Transaction Act of 2003.  Under the Red Flags Rule, financial institutions and creditors with certain credit accounts must develop and implement an identity theft prevention program, which provides for the identification, detection, and response to “Red Flags”: patterns, practices, and specific activities that could indicate identity theft.

Under the Red Flags Rule, the definition of creditor is so broad that it includes any entity that permits persons to pay for products or services for personal, family, or household purposes, with multiple deferred payments or transactions.  Thus, a health care provider that allows patients to pay for medical services with multiple payments is a creditor under the Red Flags Rule, and must have an identity theft prevention program in place.

The FTC has postponed enforcement of the Red Flags Rule until December 31, 2010. Originally scheduled for a November 1, 2008 compliance date, the Rule has been postponed several other times, with the most recent deadline of June 1, 2010 now pushed to December 31. The additional delay is likely due to the advocacy of groups who challenge the applicability of the Red Flags Rule to certain professionals, as well as pending legislation. Last year, the American Bar Association successfully challenged the law on the basis that it should not apply to attorneys (an FTC appeal is pending). Recently, the American Medical Association, the American Osteopathic Association, and the Medical Society of the District of Columbia, filed a lawsuit against the FTC, asserting that the Red Flags Rule should exempt physicians from compliance.

The new December 31, 2010 enforcement deadline provides entities that fall under the Red Flags Rule’s definition of “creditor” additional time to comply with the rule—or to avoid enforcement altogether. Certain entities could avoid enforcement if, before the December 31 deadline, the pending lawsuits result in an exemption—or if pending legislation passes in the interim. On May 25, 2010, the U.S. Senate filed a bill that would exclude health care, legal, accounting, and certain other businesses with 20 or fewer employees from the Red Flags Rule. The U.S. House of Representatives passed a similar bill in 2009.  The FTC has advised that, if Congress passes the exemption legislation before December 31, 2010, the FTC will move up its enforcement date accordingly.

For more information, please contact your Lashly & Baer attorney or Margaret Scavotto at (314) 621-2939.