FTC delays enforcement of Red Flags Rule until June 2010

In October, the House passed a bill exempting certain psychology practices from the Red Flags Rule

by Legal and Regulatory Staff

November 23, 2009 — On October 21, the House passed a bill that would exempt from the Red Flags Rule psychology practices with 20 employees or fewer, as well as certain practices with low risk of identity theft. The bill, H.R. 3763, passed with 400 votes and no objections, and now moves to the Senate.

Enforcement delayed to June 1, 2010
With legislation on the Rule pending, members of Congress asked the Federal Trade Commission (FTC) to again delay enforcement of the rule the agency developed to prevent identity theft. On October 30, the FTC announced that it would, for the fourth time, delay enforcement of the Red Flags Rule. The agency is now slated to begin enforcement of the Red Flags Rule on June 1, 2010.

Small and "low-risk" practices exempt from rule
The American Psychological Association Practice Organization (APAPO) expects that a Senate bill will emerge with the same basic structure as the House bill. Under H.R. 3763, health care, legal or accounting practices with 20 or fewer employees would automatically be exempt from the Rule. Larger practices could apply for a "low risk" exemption under regulations to be developed by the FTC. The low-risk factors most likely to apply to psychology practices are:

  • The practice has not experienced incidents of identity theft and identity theft is rare for businesses of that type, and

  • The practice knows all of its customers or clients individually.

If exemption legislation passes the Senate and is signed into law, the APAPO will advocate for regulations that make the exemption application process as simple as possible and that define the relevant exemptions favorably. For example, the APAPO will urge that the regulations define "type of business" narrowly enough that the practice of psychology, which has a low incidence of identity theft, is not included with medical practice, which is subject to a considerable amount of ID theft.

We anticipate that Congress will act in advance of the new June 1 deadline and will keep members posted on developments in future issues of this newsletter.

For more information, contact our Legal and Regulatory Affairs Department at (202) 336-5886.

PLEASE NOTE: Legal issues are complex and highly fact-specific and require legal expertise that cannot be provided by any single article. In addition, laws change over time and vary by jurisdiction. The information in this article should not be used as a substitute for obtaining personal legal advice and consultation prior to making decisions regarding individual circumstances.