June 15, 2009


 Red Flags Rule requires identity theft prevention programs

AVMA continues efforts to exempt health care providers

Posted June 1, 2009

The Federal Trade Commission has again delayed enforcement of a rule that requires creditors to develop programs to prevent identity theft. The FTC maintains that most health care providers must comply with the rule.

The Red Flags Rule requires creditors to develop programs to detect warning signs of identity theft, or red flags, and then respond appropriately. The rule took effect last year, but the FTC delayed enforcement until May 2009 because of questions about who is subject to the rule. The agency recently delayed enforcement again until August.Red flags

The AVMA has asked that the FTC consider veterinarians as not being creditors under the Red Flags Rule. At the same time, the AVMA has posted information about the rule on its Web site and is offering webinars with an outside expert on identity theft.  

AVMA viewpoint

"It makes good business sense to make sure your records are safe and to protect your clients," said Gina Luke, an assistant director of the AVMA Governmental Relations Division in Washington, D.C. "But is it necessary to apply a rule to veterinarians that was intended for banks and credit card companies?"

The Red Flags Rule implements a provision of the federal Fair and Accurate Credit Transactions Act of 2003, which required the FTC to "establish and maintain guidelines for use by each financial institution and each creditor regarding identity theft with respect to account holders at, or customers of, such entities."

By the FTC's interpretation, health care providers are creditors if they do not always receive payment in full from their clients at the time services are provided. In a letter to the agency earlier this year, the AVMA argued that categorizing health care providers as creditors is not consistent with the intent of the FACT Act. The FTC responded by stating that veterinarians will be subject to the Red Flags Rule but indicated a willingness to continue dialogue to ensure compliance will not place undue burdens on the veterinary profession.

Recently, Luke has been meeting with congressional staff to request that members of the House and Senate put pressure on the FTC to exempt health care providers from the Red Flags Rule. Other organizations, such as the American Medical Association and American Dental Association, also have been lobbying Congress on the issue.

Nydia M. Velázquez, chairwoman of the House Committee on Small Business, wrote to the FTC in April asking the agency to delay the enforcement of the Red Flags Rule until November. She also urged the FTC to revise the rule to include an analysis of the burden on health professionals and then solicit comments specifically from health professionals. Members of the Congressional Doctors Caucus wrote a similar letter to the agency.

The FTC replied by delaying the enforcement of the Red Flags Rule until August. Jon Leibowitz, agency chairman, said the delay was because of "the ongoing debate about whether Congress wrote this provision too broadly." In the meantime, the agency will create a template to help low-risk entities—such as health care providers—comply with the rule. The template will be available at www.ftc.gov/redflagsrule, a Web site that already offers a general how-to guide for business.

Luke added that the FTC will not be knocking on veterinarians' doors in August to enforce the Red Flags Rule, but the agency could respond to a complaint in a case of identity theft.

"As many veterinarians as possible should be taking the opportunity to avail themselves of the materials AVMA is making available," Luke said.

Web resources

The AVMA already has offered a number of free webinars on the Red Flags Rule with John P. Gardner Jr., JD, an expert on identity theft. Additional webinars are on the schedule between June 15 and July 31. 

Gardner notes that identity theft extends beyond the theft of financial information. Valuable information can include driver's license numbers, Social Security numbers, medical records, and criminal records.

"Businesses are the source of the information the thieves want—because they have credit card numbers, they may have taken driver's license numbers with checks, they have employees with Social Security numbers," Gardner said. "And they're the source of the collection of the information that we want to reduce. In other words, it is at businesses that people work under other people's Social Security numbers. It is at businesses that people use credit cards that don't belong to them."

Gardner said simple steps help prevent identity theft, such as asking customers who want to pay by credit card to show a government-issued picture identification.

To comply with the Red Flags Rule, according to FTC guidelines, the first step for businesses is to determine major warning signs of identity theft that they come across in their line of work. Warning signs can include alerts from consumer reporting agencies; suspicious documents, personal information, or account activity; and notices from customers, victims of identity theft, law enforcement authorities, or other entities.

Each business must write, implement, and administer an ongoing program to detect warning signs and respond appropriately to prevent or mitigate identity theft after finding a red flag. Responses to warning signs could include monitoring accounts or changing account numbers, according to the FTC guidelines.

Gardner said the penalty for failure to comply with the Red Flags Rule is up to $3,500 per violation.

"There is a misconception right now about the delay in the rule until August 1," Gardner said. "The rule has been in effect since January 1, 2008. The penalty provisions, from the FTC's perspective, have been delayed until August 1—but the standards of the rule are in effect as we speak."

If a client files a lawsuit relevant to identity theft against a veterinarian, Gardner said, the plaintiff's counsel will ask whether the veterinarian took steps to prevent identity theft that are reasonable under the law.

In addition to the webinars through the AVMA, Gardner offers a $150 online training program on the Red Flags Rule for veterinary practices with up to 15 employees. He also offers the program at the same cost to veterinarians' vendors of similar size.

Veterinarians can register for one of the free webinars or the online training program on the AVMA Web site. The site includes answers to frequently asked questions. The site also provides links to the text of the Red Flags Rule, an FTC article for health care providers, and other resources. The AVMA will continue updating the site with additional guidance to help veterinarians comply with the Red Flags Rule.