FTC delays Red Flags Rule enforcement through December 31, 2010

Previously slated to take effect on June 1, enforcement of the Red Flags Rule has been postponed seven additional months

by Legal and Regulatory Affairs Staff

May 31, 2010 — In a May 28, 2010 press release, the Federal Trade Commission (FTC) announced at the last minute that it once again has delay enforcement of the Red Flags Rule (Rule). Previously slated to take effect on June 1, enforcement of the Red Flags Rule has been postponed seven additional months through December 31, 2010. The FTC stated that it is delaying enforcement at the request of several members of Congress in order to give Congress more time to determine what entities will be subject to the Rule.

The term "Red Flags" refers to "potential patterns, practices or specific activities” that could indicate the possibility of identity theft. Entities covered under the Rule are required to develop and implement written identity theft prevention programs.

Last October, the House passed a bill that would exempt from the Red Flags Rule psychology (and other health care) practices with 20 employees or fewer. Larger practices could apply for a "low risk" exemption under regulations to be developed by the FTC. The low-risk factors most likely to apply to psychology practices are:

  • The practice has not experienced incidents of identity theft and identity theft is rare for businesses of that type, or

  • The practice knows all of its customers or clients individually.

The House bill, H.R. 3763, passed with 400 votes and no objections. The APA Practice Organization supports the passage of similar Red Flags Rule legislation in the Senate. The Senate has not yet taken action on this legislation.

The Rule originally became effective on January 1, 2008 with full compliance originally required by November 1 of that year. However, enforcement of the Red Flags Rule has been delayed five times so far. And while the FTC has stated that the Rule was designed primarily for financial institutions and other traditional creditors, the agency announced in late 2008 that that it would also apply the Rule to health care practitioners who are considered "creditors.”

According to prior FTC guidance, health care practitioners would be considered creditors if they:

  • Provide services and then bill patients later; or

  • Regularly allow their patients to defer payment for services — including by setting up payment plans — on a "regular" basis.

Earlier this month, the American Medical Association and other medical associations filed a lawsuit in federal court to prevent the FTC from applying the Red Flags Rule to physicians. The APA Practice Organization will be evaluating whether legislative, litigation and/or regulatory solutions would be best the best vehicle for relieving psychologists of the burden of the Rule.

We will continue to keep members informed and provide appropriate guidance in light of future developments related to the Red Flags Rule and its impact on practicing psychologists.

For more information, contact the Legal and Regulatory Affairs Department by e-mail or (202) 336-5886.

Please Note: Legal issues are complex and highly fact-specific and require legal expertise that cannot be provided by any single article. In addition, laws change over time and vary by jurisdiction. The information in this article should not be used as a substitute for obtaining personal legal advice and consultation prior to making decisions regarding individual circumstances.