On May 28, 2010, the FTC announced that it is again delaying enforcement of the Red Flags Rule (the Rule), at the request of several members of Congress. Unless Congress enacts legislation modifying the Rule, the new enforcement date will be January 1, 2011. This constitutes the fourth time that the FTC has delayed enforcement of the Rule, which was originally scheduled for enforcement on November 1, 2008. In a press release announcing the delay, FTC Chairman John Leibowitz credited the efforts of Congressmen Barney Frank (D-Mass.) and John Adler (D-N.J.), who succeeded in getting a clarifying measure passed in the House. Chairman Leibowitz expressed hope that action in the Senate will be swift.
In a separate development, on May 21, 2010, the American Medical Association (AMA) and two other physician associations filed a lawsuit challenging the application of the Rule to physicians. The lawsuit asserts that the FTC exceeded its authority by including physicians in the Rule. In a statement issued when the lawsuit was filed, the groups state that, “[t]his unjustified federal regulation of medicine treats physician practices like banks, credit card companies and mortgage lenders.” Previously, in a lawsuit brought by the American Bar Association, a federal court ruled on November 29, 2009 that the Rule does not apply to attorneys.
By way of background, the Rule was enacted under the Fair and Accurate Credit Transactions Act of 2003, in which Congress directed the FTC and other agencies to develop regulations requiring “creditors” and “financial institutions” to address the risk of identity theft. The Rule requires that all entities meeting these definitions develop and implement identity-theft prevention programs. The FTC issued guidance indicating that any health care provider that does not obtain full payment for its services at the time of service is a “creditor” within the meaning of the Rule. The AMA and other health care trade associations have objected to that interpretation, and members of Congress have been sympathetic to those objections.
The latest delay in the enforcement of the Rule suggests that Congress may eventually pass legislation either exempting health care providers from the Rule or making changes that reduce the burdens of compliance.