FTC Delays Enforcement of "Red Flag" Rules Until May 1, 2009
October 24, 2008
On October 22, 2008, the Federal Trade Commission (FTC) announced that it will "suspend enforcement" of the "Red Flag" rules, which were originally designated to take effect November 1, 2008. According to this announcement, the rules will not be enforced by the FTC until May 1, 2009. This delay was the result of pressure from, among others, the American Medical Association and a consortium of other healthcare organizations, that complained (justifiably) that they had no reason to familiarize themselves with FTC rules to which they are generally not subject.
Technically, a suspension of enforcement is not the same as a delay in implementation. However, the suspension was provided, according to the FTC announcement, specifically to give financial institutions and creditors "additional time in which to develop and implement written identity theft programs." On its face, this appears to amount to the same thing as a delay in implementation.
It is also important to note that the "Red Flag" rules were issued jointly by six agencies. In addition to the FTC, The Office of the Comptroller of the Currency, The Federal Reserve System, The Federal Deposit Insurance Corporation, The Office of Thrift Supervision and the National Credit Union Administration issued identical rules. While it is unlikely that healthcare providers fall under the jurisdiction of any of these agencies, their versions of the rules are unaffected by the FTC announcement.
Given the delay, the FTC will likely raise its expectations for the content and sophistication of identity theft programs. It is possible, of course, that in the ensuing months those organizations (such as the American Medical Association) that protested the FTC's broad definition of "creditor" for purposes of jurisdiction of the Red Flag Rules will persuade the FTC to narrow the definition of "creditor" to a more traditional scope. Such an adjustment would take many, if not most, health care providers out of the ambit of the Rule. However, that appears unlikely, and healthcare providers would be well advised to make good use of the extension.
You may review the FTC press release at www.ftc.gov/opa/2008/10/redflags.shtm.
You may review Ober|Kaler's more in-depth analysis of the Red Flag rules here.