A federal appeals court decision in March means physicians cannot be subject—at least for now—to the so-called Red Flags Rule.

The rule is a 2008 Federal Trade Commission (FTC) regulation stemming from the commission's interpretation of the Fair and Accurate Transactions Act of 2003, designed to tighten security of financial information held by banks and credit-card companies. Under the FTC's interpretation, physicians were classified as "creditors" because physicians bill people for services after they are provided and because physicians sometimes allow payment plans; under these conditions, they would therefore be required to comply with certain identity-theft-protection measures such as installing software security programs.

The next development in this saga occurred in March when the United States Court of Appeals for the District of Columbia Circuit found the application of the current FTC Red Flags regulations to attorneys to be invalid in light of the Red Flags Program Clarification Act of 2010, which was passed by Congress last December (Psychiatric News, March 4). That act, signed into law by President Obama in January, narrowed the term "creditor" to include only entities that use consumer reports, furnish information to consumer reporting agencies, or extend credit.

In revising the definition, the new legislation also undermined the basis for the application of the Red Flags Rule to physicians and other professionals. The appeals court decision was rendered in a suit brought by the American Bar Association, representing lawyers who had also been included as "creditors" in the FTC definition because they bill for services after they are rendered.

According to the court's ruling, "[T]he Clarification Act makes it plain that the granting of a right to ‘purchase property or services and defer payment therefore’ is no longer enough to make a person or firm subject to the FTC's red flags rule—there must now be an explicit advancement of funds. In other words, the FTC's assertion that the term ‘creditor,’ as used in the red flags rule includes ‘all entities that regularly permit deferred payments for goods or services,’ including professionals ‘such as lawyers or health care providers, who bill their clients after services are rendered,’... is no longer viable."

The decision was welcomed by APA, the AMA, and other professional organizations that have argued that the FTC's interpretation was a bureaucratic burden for doctors already subject to regulations that ensure the safety of patient information. Last year, the AMA—along with APA and some two dozen other medical groups—filed suit against the agency to exempt their member physicians.

"The court's decision reinforces the intent of a new law clarifying the scope of the Red Flags Rule and helps eliminate any further confusion about the rule's application to physicians," said AMA President Cecil Wilson, M.D., in a statement released by the AMA. "The AMA will remain vigilant that the FTC respects the meaning and intent of the Clarification Act."

In an interview with Psychiatric News, Robert Portman, J.D., a lawyer representing APA and other specialty societies that have joined in the AMA suit, said, "The appeals court decision is a victory for doctors because it holds that the criteria by which the FTC was applying the rule to attorneys are no longer valid, and since those are the same criteria being applied to physicians, it means doctors can no longer be subject to the current rule."

But Portman said the door wasn't permanently shut on the issue. While the basis for the original inclusion of physicians and attorneys in the Red Flags Rule—that they bill for services after they are rendered—has been ruled inapplicable, he said it is conceivable that the agency, which is charged with protecting consumers from fraud and identity theft in the course of financial transactions, could still find that some physicians fall within the narrower definition of a "creditor" as defined by the Clarification Act. But he said that would require a new ruling and a comment period, with the likelihood of renewed legal action.

More information on the Red Flags Rule is posted at <www.ama-assn.org/ama/pub/physician-resources/solutions-managing-your-practice/practice-management-center/data-security/red-flags-rule.shtml> and <http://business.ftc.gov/privacy-and-security/red-flags-rule>.