FTC Identity Theft Red Flags Rule

Well, November 1 has passed. Are you now in compliance with the FTC (Federal Trade Commission) Identity Theft Red Flags Rule? If you're a health care provider and you accept credit cards for payment, then you are technically a "creditor" or "financial institution." You must be prepared to safeguard patient information. Any breach of patient privacy or patient data is now a "red flag" and health care professionals (especially those who accept credit cards) have a responsibility to protect their patients from identity theft. Don't start getting any strange ideas of suing your physician if you become a victim of identity theft.

What's interesting is that fewer medical practices are accepting credit cards these days. You may think that more physicians are embracing plastic, but the reality is that these are difficult economic times even for doctors. As a result, many are having trouble paying for all the fees associated with accepting credit card payments. According to SK&A, roughly 33% do not accept credit cards. Does your physician accept credit cards? If not, then maybe you should be grateful because you may have less risk of identity theft if your medical record gets stolen from your physician's office.

FTC to delay "Red Flags" enforcement until Nov. 1

I just received this Breaking News alert from Modern Physician:

Moving an Aug. 1 deadline, the Federal Trade Commission will wait until Nov. 1 to enforce a provision of the “red flags” rule that requires physicians and hospitals to adopt written plans for tracking and responding to indicators of identity theft in their billing operations.

FTC Announces Expanded Business Education Campaign on 'Red Flags' Rule

Here are a few relevant snippets:

To assist small businesses and other entities, the Federal Trade Commission staff will redouble its efforts to educate them about compliance with the "Red Flags" Rule and ease compliance by providing additional resources and guidance to clarify whether businesses are covered by the Rule and what they must do to comply. To give creditors and financial institutions more time to review this guidance and develop and implement written Identity Theft Prevention Programs, the FTC will further delay enforcement of the Rule until November 1, 2009.

To assist small businesses and other entities, the Federal Trade Commission staff will redouble its efforts to educate them about compliance with the "Red Flags" Rule and ease compliance by providing additional resources and guidance to clarify whether businesses are covered by the Rule and what they must do to comply. To give creditors and financial institutions more time to review this guidance and develop and implement written Identity Theft Prevention Programs, the FTC will further delay enforcement of the Rule until November 1, 2009.

The FTC’s Red Flags Web site, www.ftc.gov/redflagsrule, offers resources to help entities determine if they are covered and, if they are, how to comply with the Rule.

Why the delay? Read more at the FTC site here.