Congress passed legislation clarifying its definition of a “creditor” under the Red Flags rule, a move that could help bolster the case that physicians should not have to abide by the new identity theft safeguards.
Physicians currently have until Dec. 31 before the Federal Trade Commission is set to begin enforcing the Red Flags rule. The rule was written to implement provisions of the Fair and Accurate Credit Transactions Act, which calls on creditors and financial institutions to address the risk of identity theft.
The rule requires creditors to develop formal identity theft–prevention programs that would allow an organization to identify, detect, and respond to any suspicious practices (“red flags”) that could indicate identity theft. However, physician groups have long asserted that they are not creditors and should be exempt from the requirements, which they consider overly burdensome.
Under the new legislation (S. 3987), which was passed this month, Congress clarifies that a creditor is not someone who simply “advances funds on behalf of a person for expenses” related to a service. The American Medical Association and other physician groups are hopeful that the clarification will be enough to convince officials at the Federal Trade Commission to exempt physicians from the Red Flags rule.
“The AMA is pleased that this legislation supports AMA's long-standing argument to the FTC that physicians are not creditors. This bill will help eliminate the current confusion about the rule's application to physicians,” AMA President Cecil B. Wilson said in a statement. “We hope that the FTC will now withdraw its assertion that the red flags rule applies to physicians.”
The Red Flags rule became effective on Jan. 1, 2008, with an original enforcement deadline of Nov. 1, 2008. However, the FTC has delayed enforcement of the rule several times.