Congress Passes Bill to Curb Red Flags Rule
In early December, Congress passed the Red Flag Program Clarification Act of 2010. This bill, which awaits the signature of President Obama, would exclude physicians from the list of “creditors” which must abide by the Federal Trade Commission’s Red Flags Rule.
Because the FTC included physicians in their definition of creditor, the Red Flags Rule would have required medical practices to implement certain policies meant to lessen the possibility of identity theft. Originally slated to go into effect on Nov. 1, 2008, the FTC postponed implementation until May 1, 2009, due to the short timeframe in which offices were required to prepare for enforcement. That was followed by numerous other postponements and extensions.
Subsequently, the AMA filed a lawsuit which asked the court to not apply the definition of creditor to physician offices. Because a similar suit had been previously filed by the American Bar Association, the AMA and FTC agreed to wait until the outcome of the ABA case before going forward with their own dispute. The passage of the Red Flag Program Clarification Act has essentially rendered the AMA case moot.
“Red Flags Rule” Apply to Doctors
The Federal Trade Commission is delaying enforcement of its identity theft Red Flags Rule to June 1, 2010. Red Flags requires creditors and financial institutions to have in place identify theft prevention, detection, and response systems.
The rules make it necessary for physicians to implement an office strategy to detect possible identity theft. The AMA is now asking the FTC to submit a new rule and allow for public comment on it. The written compliance program must include the following basic elements: (1) the identification of red flags; (2) the detection of such red flags; (3) the appropriate response to any such detection; and (4) the periodic review of the overall program. Failure to comply may result in penalties not to exceed $2,500.
The MSMA also has a sample red flag rule policy available to members.
Click Red Flag Rules Sample Policy 
Remember, your policy should be tailored to your practice and can include the following “red flags”:
• A query from a patient regarding a bill or insurance statement for services never received or in another individual’s name.
• Records showing medical treatment that is inconsistent with a patient’s medical history.
• Suspicious documents, such as a forged license or insurance card.
• A patient who has an insurance number but never produces a card or other documentation.
• A notice from a patient or law enforcement entity indicating possible identity theft.
• Unusual billing patterns.
These are the types of identity theft red flags that your policy should address. Contact MSMA’s Jeff Howell at jhowell@msma.org or 800-869-6762 for more information.
Red Flags Rules Q & A
Many practices are still in the dark concerning the Red Flags Rule. Here are some answers to the most common questions:
What is the Red Flags Rule?
The Rule (an FTC regulation) requires certain entities to develop and maintain a system of procedures to guard against identity theft. Identity theft occurs when one person uses another’s information to commit fraud. As far as practices are concerned, identity theft usually occurs when a person uses another’s medical information to receive medical services. The information could be someone else’s insurance card, credit card, Social Security number, a false driver’s license, etc.
Why do we have to comply?
You may not have to, but if there’s any doubt, it’s best to have a procedure in place. The FTC extended this regulation to “creditors.” A creditor is defined by the FTC as, “any person who regularly extends, renews, or continues credit or any person who regularly arranges for the extension of credit…” This definition includes those entities which extend credit by allowing deferred payment until insurance is collected. This includes a lot of physicians.
Does this supersede HIPAA?
No. HIPAA is supposed to protect sensitive personal health information. The Red Flags Rule covers PHI, but also covers other sensitive information: credit cards, insurance claim information, tax identification numbers, etc.
What is a “red flag?”
A Red Flag is a pattern, practice, or specific account activity that indicates the possibility of identity theft. The FTC has identified some examples: alerts from a credit reporting agency, suspicious documents, unusual activity related to patient accounts, notices of possible identity theft from patients or law enforcement.
How does my practice comply with the rule?
The rule requires practices to have “reasonable policies and procedures in place” to identify, detect and respond to identity theft red flags. These procedures can be tailored to fit your practice and your degree of risk for identity theft. The procedures should compliment your current HIPAA policy.
Where can I find a policy template to get me started?
Many medical associations have templates, including the MSMA (see above) and AMA. You can also contact your specialty society for assistance.
