FTC Identity Theft Rule Enforcement Postponed from June 1

The Federal Trade Commission (FTC) announced today - just days short of the June 1 deadline - that it is further delaying enforcement of the "Red Flags" Rule through Dec. 31, 2010.

The delay comes on the heels of an AMA lawsuit and ongoing Congressional consideration of legislation that would exempt several business types, including physicians and dentists. Several members of Congress had requested that the FTC halt implementation so that the legislation passed in the House last year could be acted on by the Senate.

The Red Flags Rule was developed under the Fair and Accurate Credit Transactions Act, in which Congress directed the FTC and other agencies to develop regulations requiring "creditors" and "financial institutions" to address the risk of identity theft. The resulting Red Flags Rule requires all such entities that have "covered accounts" to develop and implement written identity theft prevention programs to help identify, detect, and respond to patterns, practices, or specific activities - known as "red flags" - that could indicate identity theft. FTC applied broad application of the rules to include health care and other small business providers.

The Academy has worked with a coalition of health care associations to try to persuade the FTC that physicians are not "creditors" and therefore should not be subject to the rule.

The FTC has created a website specifically about the rule and its implementation.