• FTC Agrees to Defer Application of Red Flags Rule to Physicians
  • July 19, 2010 | Author: Edgar C. Morrison
  • Law Firm: Jackson Walker L.L.P. - San Antonio Office
  • On June 25, 2010, the Federal Trade Commission (FTC) and several medical group trade associations reached an agreement that the agency would not enforce its so-called “Red Flags Rule" with respect to physician members of the associations until the D.C. Circuit issues a decision in the pending challenge to identity theft regulations brought by the American Bar Association (ABA).

    The Red Flags Rule imposes new obligations on “creditors” to detect, prevent, and mitigate identity theft. The Rule was developed under the Fair and Accurate Credit Transactions Act, in which Congress directed the FTC and other agencies to develop regulations requiring “creditors” and “financial institutions” to address the risk of identity theft. The resulting Red Flags Rule requires all such entities that have “covered accounts” to develop and implement written identity theft prevention programs to help identify, detect, and respond to patterns, practices, or specific activities - known as “red flags” - that could indicate identity theft.

    Physicians and others in the healthcare industry immediately objected to the rules as not appropriate for healthcare providers who are not intentionally “creditors”. The original deadline to comply with the identity theft program requirement was November 1, 2008, but due to the widespread objections from the public and Members of Congress, it has been extended by the FTC five times so far. The most recent extension is until December 31, 2010, with the FTC stating it decided to delay enforcement while Congress considers legislation that would affect the scope of entities covered by the rule.

    In May, the American Medical Association (AMA), American Osteopathic Association, and the Medical Society of the District of Columbia filed a lawsuit in the U.S. District Court for the District of Columbia seeking to block the application of the Red Flags Rule to physicians. The medical groups’ lawsuit alleged that the FTC exceeded its authority in extending the Red Flags Rule to physicians.

    In a similar case, the U.S. District Court for the District of Columbia enjoined application of the Rule to attorneys, finding that the FTC had overstepped its regulatory authority [American Bar Ass’n v. FTC, No. 09-1636 (D.D.C)]. The decision is on appeal to the D.C. Circuit. The stipulation filed this week in the AMA case indicates that the FTC will not enforce the Red Flags Rule to physician members of the associations until the federal appeals court issues a ruling in the ABA action.