Federal Trade Commission Delays "Red Flags Rules" Enforcement
by Legal and Regulatory Affairs Staff
November 20, 2008—The Federal Trade Commission (FTC) announced in October that it will delay until May 1, 2009 enforcement of its new "Red Flags Rules," regulations intended to reduce identity theft. These rules were designed primarily for financial institutions and other major creditors, such as auto dealers.
However, the federal agency has indicated that it broadly interpreted the definition of who is considered a "creditor" subject to the rules. That broad interpretation would include health care providers who regularly let patients defer payment for services.
The FTC does not normally regulate health care professionals. The agency recognized that health care providers had not expected the Red Flags Rules to apply to them and had not been prepared for the original compliance deadline of November 1, 2008. Accordingly, the FTC extended its deadline for enforcing the rule by six months.
The term "red flag" refers to a pattern, practice or activity that indicates the possible existence of identity theft. The idea behind the rules is that creditors should actively monitor for and protect against identity theft by developing and implementing a written identity theft prevention program that will involve:
• Identifying potential red flags
• Detecting red flags
• Responding to red flags that are detected, for example, by changing passwords or other security and notifying law enforcement, and
• Periodically assessing and updating the written identity theft prevention program.
Assuming the Red Flags Rules will be implemented in May 2009 as now written, the APA Practice Organization (APAPO) plans to develop detailed information and guidance for practitioners about whether the rules apply to them, and if so, potential compliance strategies. Meanwhile, attorneys for the APAPO are exploring possible advocacy efforts aimed at challenging the Red Flags Rules' application to practicing psychologists. 
FederalTradeCommissionDelaysRedFlagsRulesEnforcement.pdf
(79.99 Kb)
