Law Exempts Most Physicians From FTC's Red Flags Rule

President Obama signed legislation last December that narrows the definition of a "creditor" under the so-called Red Flags Rule so that its provisions will not apply to most physicians.

The Red Flags Rule is a 2008 Federal Trade Commission (FTC) regulation stemming from the commission's interpretation of the Fair and Accurate Transactions Act of 2003, designed to tighten security of financial data held by banks and credit card companies. Under the FTC's interpretation, physicians were classified as "creditors" because physicians bill people for services after they are provided and because physicians sometimes allow payment plans. Under these conditions, they would therefore be required to comply with certain identity-theft-protection measures such as installing monitoring programs.

The regulation has been opposed from the beginning by the AMA and other physician groups, including APA, who have argued that the FTC's interpretation was a bureaucratic burden for doctors already subject to regulations that ensure the safety of patient information. APA, the AMA, and some two dozen other medical groups filed a lawsuit last year to exempt members from the Red Flags Rule; that suit is still pending.

Opposition to the ruling has resulted in five delays in the FTC's enforcing the rule on physicians. In June 2010, during the AMA House of Delegates Annual Meeting, FTC Chair Jon Leibowitz agreed that applying the Red Flags Rule to physicians was an overly broad interpretation of the Fair and Accurate Transactions Act. But he said it was up to Congress to amend the language of the law.

The Red Flag Program Clarification Act of 2010, approved by the Senate last November and by the House of Representatives in early December, does just that by narrowing the term "creditor" to include only entities that use consumer reports, furnish information to consumer reporting agencies, or extend credit.

Robert Portman, an attorney representing APA and the other groups in the suit, said that though the legislation clarifies the definition of a creditor, a definitive ruling from the FTC about the status of physicians and other professionals will likely be necessary. He said the FTC has indicated that it will not make a final ruling one way or the other regarding the inclusion of physicians as creditors under the rule until a similar suit filed by the American Bar Association to have attorneys removed from inclusion in the ruling is decided; that decision is not expected until later this year.

"The new legislation narrows the definition of a creditor subject to the Red Flags Rule in a way that probably exempts most physicians," Portman told Psychiatric News. "But some may still qualify as creditors, and the amendment gives the FTC broad discretion to identify other kinds of creditors subject to the rule, which may give the agency the power to include physicians if it wants to."

More information on the Red Flags Rule is posted at <www.ama-assn.org/ama/pub/physician-resources/solutions-managing-your-practice/practice-management-center/data-security/red-flags-rule.shtml> and <http://business.ftc.gov/privacy-and-security/red-flags-rule>.