A Red Flag Reprieve for Healthcare Providers? The Door Remains Open Pending Federal Agency Action

Recent developments regarding the Identity Theft Red Flags Rule (the Red Flags Rule) may provide a much hoped-for reprieve for many healthcare providers. New bills passed by Congress appear to remove some providers from the Red Flags Rule.

Pending President Obama's signature, the legislation will exempt from the definition of "creditor" those businesses "that advance funds on behalf of a person for expenses incidental to a service provided by the [business] to that person."

Creditors not covered under the legislative exemption will continue to face the looming Red Flags Rule compliance date of Jan. 1, 2011. Furthermore, there is a chance that federal agencies might seek to pull at least some types of healthcare providers back into the Red Flags Rule.

On Nov. 30, 2010, the U.S. Senate passed the Red Flag Program Clarification Act of 2010 (Clarification Act), S. 8987, and on Dec. 7, 2010, it was sent to the president. A companion bill, HR 6420, also was passed by the House of Representatives on Dec. 7, 2010.

The Clarification Act would exclude from its definition of "creditor," businesses "that advance funds on behalf of a person for expenses incidental to a service provided by the creditor to that person." Although not crystal clear, this definition of "creditor" appears to exclude some healthcare providers that obtain payment for services after they are rendered. Many a provider, however, may continue to fall within the definition even with the Clarification Act.

Moreover, the Clarification Act would allow certain regulatory agencies "listed in 15 U.S.C. 1681m(e)(1)" (which essentially are the Federal Trade Commission (FTC), the federal banking agencies, and the National Credit Union Administration) to extend the Red Flags Rule to cover businesses with accounts that are "subject to a reasonably foreseeable risk of identity theft." Healthcare providers will have to stay tuned to see how those agencies, and most notably the FTC, will respond to this invitation to weigh-in on application of the Red Flags Rule.

Significantly, the FTC has voiced apparent concern with medical identity theft and has, in the past, opined that health care providers are among the "creditors" covered under the Red Flags Rule. In fact, the FTC specifically included healthcare providers among its list of groups that may qualify as examples of creditors (see FTC website for "The Red Flags Rule: Frequently Asked Questions").

The Red Flags Rule was developed in 2007, at Congress' direction, by the FTC and five other federal agencies. As published in November 2007, the Red Flags Rule required that financial institutions and "creditors" with "covered accounts" maintain identity theft prevention, detection, and mitigation programs by Nov. 1, 2008. "Creditors" was broadly defined to include businesses that regularly provide goods or services first and allow customers to pay later.

The Red Flags Rule caught many healthcare providers and other organizations by surprise, with much confusion surrounding exactly who would be covered under the broad scope of the Red Flags Rule. As a result, the FTC delayed enforcement of the Red Flags Rule numerous times. The most recent enforcement date is Jan. 1, 2011, which gives Congress the opportunity to adopt legislation that would limit the types of businesses covered by the Red Flags Rule.