Exception Coming on Red Flags Rule?
The oft-delayed Red Flags Rule, scheduled to take effect November 1, may be in for a major change. A bill that passed the US House October 20 and arrived in the Senate the next day would exempt, among others, healthcare practices with 20 or fewer employees from meeting the law’s requirements.
The amendment is intended to relieve the administrative burden on small businesses.
The Red Flags Rule, part of the Fair and Accurate Credit Transaction Act of 2003, requires “creditors” and financial institutions to develop and implement written identity theft prevention programs. As described in the rule, creditors are organizations that maintain consumer accounts that receive multiple payments or payments made in installments.
In full, HR 3763 amends the Fair Credit Reporting Act to exclude “any health care practice, accounting practice, or legal practice with 20 or fewer employees.” It also excludes any other business that the Federal Trade Commission, which oversees the rule, determines:
- knows all its customers or clients individually;
- only performs services in or around the residences of its customers; or
- has not experienced incidents of identity theft, and identity theft is rare for businesses of that type. (more…)



