This post has been archived and contains information that may be out of date.
In response to requests from Members of Congress, the Federal Trade Commission once again delayed enforcement of the ‘red flag’ rule until June 1, 2010. The FTC announced the delay on October 30, 2009, one day before the rule was to have taken effect.
The red flag rule is aimed at reducing identity theft and requires creditors that hold any consumer account, or other account for which there is a reasonably foreseeable risk of identity theft, to develop and implement an Identity Theft Prevention Program (Program). The FTC deems health care providers, as well as other professionals, that regularly bill for services after services are rendered to be ‘creditors’ under the rule.
Congress requested the enforcement delay to allow for finalization of HR 3763, which would limit the types of “creditors” subject to the rule. HR 3763 passed out of the House of Representatives unanimously on October 20, and is now being considered by the Senate Banking Committee. If enacted in its current form, HR 3763 would exclude, health care, accounting and legal practices with 20 or fewer employees, and “any other business, if the Commission determines, following an application for exclusion by such business, that such business (i) knows all of its customers or clients individually; (ii) only performs services in or around the residences of its customers; or (iii) has not experienced incidents of identity theft and identity theft is rare for a business of that type."
On a related note, in August of this year, the American Bar Association filed a lawsuit against the FTC arguing in part that the Commission’s application of the red flag rule to attorneys exceeds Commission’s statutory authority under the Fair and Accurate Credit Transactions Act of 2003. On October 30, the United States District Court for the District of Columbia granted the ABA’s motion for summary judgment, ruling that the FTC cannot apply the red flag rule to attorneys.
CHA members should continue to monitor developments regarding the application and enforcement of the red flag rules in concert with legal counsel to ensure that all rule requirements are addressed. The FTC has a website that includes guidance and other materials related to the red flag rule: http:ftc.gov/redflagrule, and the full text of the Final Rule may be accessed at http://edocket.access.gpo.gov/2007/pdf/07-5453.pdf.
