The Federal Trade Commission has delayed enforcement of the Red Flags Rule for a fifth time, again citing Congressional requests as the cause.
The rule requires healthcare providers and others deemed by the FTC as “creditors” to design, implement, and enforce an identity theft prevention program. This program would enable facilities to detect and respond to identity theft “red flags.” Since healthcare organizations typically bill patients after providing treatment, the FTC says they are “creditors” and covered by the rule.
This postponement pushes the enforcement date back to December 31, 2010, in an attempt to allow Congress more time to consider legislation that would exempt some small businesses, including small healthcare providers, from the rule. Meanwhile, another bill has been introduced in Congress to exempt other small businesses.
The first enforcement date for the rule was November 1, 2008. But various Congressional exemption bills and lobbying by industry groups have caused five enforcement delays.
FTC officials expressed some frustration with the most recent delay when they announced the extension on May 28, just three days before the June 1 enforcement deadline.
“Congress needs to fix the unintended consequences of the legislation establishing the Red Flags Rule—and to fix this problem quickly,” FTC Chairman Jon Leibowitz said in a press release. “We appreciate Congressmen Barney Frank and John Adler for getting a clarifying measure passed in the House, and hope action in the Senate will be swift.
“As an agency, we’re charged with enforcing the law, and endless extensions delay enforcement.”
Last year, the House of Representatives passed a bill sponsored by Rep. John Adler (D-NJ) that would exempt healthcare, legal, and accounting practices of 20 or fewer employees from the Red Flags Rule. But for the last seven months, the bill has been awaiting a hearing in the Senate Committee on Banking, Housing, and Urban Affairs.
FTC officials said this latest enforcement delay is to give the Senate more time to consider the House bill that would “resolve any questions as to which entities are covered by the Rule,” the press release stated.
The House isn’t the only one taking action on Red Flags. On May 26, Senators John Thune (R-SD) and Mark Begich (D-AK) introduced similar legislation that would exempt small physician, dental, and veterinary practices from the rule. That Senate bill has been read and referred to the same place the House bill currently sits, the Senate Committee on Banking, Housing, and Urban Affairs.
The contentious rule has also been met by several lawsuits by industry associations whose members are covered by the rule.
After months of lobbying the FTC to exempt healthcare providers from the rule, the American Medical Association filed a lawsuit on May 21 to get its members removed from the law. Attorney and accountant member associations have filed similar lawsuits in the past. The American Bar Association won its lawsuit, but the FTC is appealing.
Although enforcement has been delayed, organizations have been required to be in compliance with the law since the rule’s January 1, 2008, effective date.
The FTC said it hopes to begin enforcing the Red Flags Rule as soon as possible. The commission will begin enforcement of the rule as soon as Congress acts on legislation, even if that action comes before December 31, 2010.