Red Flags Rule Issue

Physicians Largely Exempted from FTC 'Red Flags Rule' Compliance

Last year, the President signed the Red Flag Program Clarification Act of 2010 (P.L. 111-319) into law. The Clarification Act redefined the term “creditor” in a manner that substantially limits the application of the Federal Trade Commission’s Red Flags Rule to physicians. The Red Flags Rule requires organizations that collect financial information to develop and implement written programs aimed at identifying, detecting, and responding to patterns, practices, or specific activities, known as “red flags,” that could indicate identity theft. Prior to the Clarification Act, the statute on which the Red Flags Rule is based defined creditors to include entities that allow customers to defer payment for services until sometime after they have been rendered. The FTC interpreted this definition to include attorneys and physicians who do not require payment at the time of service, including (in the case of physicians) because they are expecting insurance reimbursement.

In response to the FTC’s interpretation, the American Bar Association (ABA) filed a lawsuit arguing that Congress did not intend to cover attorneys under the Rule. The American Medical Association (AMA) and the American Osteopathic Association (AOA) filed a similar suit contending that the law was not intended to cover their members. Several other national medical societies, including The Society of Thoracic Surgeons, joined the AMA and AOA in their suit and expanded the request for relief to all physicians. The ABA lawsuit was dismissed as moot on March 4, 2011, because the passage of the Clarification Act effectively overruled the FTC’s application of the Red Flags Rule to attorneys. Shortly afterwards, the AMA, STS and the other intervening medical societies dropped their lawsuit based on the FTC’s agreement that the Clarification Act rejected the agency’s rationale for applying the Red Flags Rule to physicians.

The Clarification Act’s revised definition of creditor includes entities that regularly and in the ordinary course of business: (1) obtain or use consumer reports, directly or indirectly, in connection with a credit transaction; (2) furnish information to consumer reporting agencies in connection with a credit transaction; or (3) advance funds to or on behalf of a person, based on a person’s obligation to repay the funds or on repayment from specific property pledged by or on the person’s behalf. The definition excludes a creditor who “advances funds on behalf of a person for expenses incidental to a service provided by the creditor to that person.” Certain physicians may still be covered by this new definition of creditor — primarily physicians who advance funds to patients, obtain credit reports on patients, or report delinquent patients to consumer reporting agencies. The Clarification Act also gives the FTC the authority to define “creditor” to include an entity “that offers or maintains accounts that are subject to a reasonably foreseeable risk of identity theft.” But, the ABA case strongly suggests that the FTC could not apply the Red Flags Rule to either attorneys or physicians without going through a new notice and comment process.