In a development that will enable many lawyers, doctors, dentists and other professionals to breathe a sigh of relief, the House of Representatives passed the “Red Flag Program Clarification Act of 2010” (“RFPCA”) on Tuesday, just one week after the bill passed the Senate. The RFPCA clarifies the applicability of the onerous requirements of the Federal Trade Commission’s (“FTC”) Red Flags Rule (“Rule”).

Originally issued in November 2007 (as required by Section 114 of the Fair and Accurate Credit Transaction Act of 2003), the Rule requires “creditors” and “financial institutions” to have a written Identity Theft Prevention Program in place. There have been several delays in the enforcement of the Rule, and considerable controversy regarding the breadth of the Rule’s applicability. On May 28, 2010, the FTC announced its most recent delay, requesting that Congress pass legislation to resolve questions concerning which entities should be covered as “creditors.” A number of professional organizations, including the American Bar Association and American Medical Association, have brought suit against the FTC for subjecting them to the Rule based on their industry practices of allowing clients to submit payment for services after they have been performed.

With the passage of the RFPCA, Congress clarified the definition of “creditor,” and exempted those in certain professional industries -- such as lawyers, dentists, doctors, veterinarians and accountants -- who do not otherwise fall under the amended definition. The amended definition applies the Rule only to those who:

  • regularly and in the ordinary course of business obtain or use consumer reports in connection with a credit transaction;
  • furnish information to consumer reporting agencies in connection with a credit transaction; or
  • advance funds to or on behalf of a person, based on an obligation of the person to repay the funds

Should the FTC later determine that a certain industry presents a reasonably foreseeable risk of identity theft; the FTC also has the authority to issue a proposed rule (open for public comment) demonstrating that the industry should comply with the Rule.

The Congressional Record indicates a clear intent to exempt small businesses and professionals who fell under the former definition of “creditor” merely as a byproduct of permitting clients to pay for services after the services are performed.

“[T]he legislation makes clear that an advance of funds does not include a creditor’s payment in advance for fees, materials, or services that are incidental to the creditor’s ability to provide another service that a person initiated or requested, such as the advance payment of expert witness fees by a lawyer to support the representation of a client,” said Senator John Thune (R-S.D.), who introduced the bill on November 17, in a colloquy included in the Congressional Record.

“[O]ur doctors and dentists across the country are not financial institutions, do not present an identity theft risk, and should not be treated as such,” added Rep. Michael Simpson (R-ID.) in a colloquy.

The RFPCA was sent to the White House on Tuesday, and will go into effect once President Barack Obama, as expected, signs it into law. Enforcement of the Rule in its amended form will then begin on January 1, 2011.