The Federal Trade Commission’s (FTC) Red Flag Rules have been revised to exclude certain professionals prior to the latest enforcement deadline of December 31, 2010. Specifically, President Obama signed into law on December 18, 2010, the Red Flag Program Clarification Act of 2010 (Clarification Act), which clarifies the scope of the FTC’s Red Flags Rule. Under the amendment, professionals such as doctors, lawyers, and accountants are excluded from the Red Flags Rule. For a full copy of the Act, click here
The Red Flags Rule was enacted to protect consumers from identity theft by requiring “creditors” covered under the Rule to establish written policies and procedures to identify risks of identity theft to their customers. Under the plain language of the Red Flags Rule, a business becomes a “creditor” when it provides products or services in advance and require payment from the customer at a later time. Further, under prior FTC interpretations “creditor” was broadly interpreted to cover lawyers, doctors, accountants, and others because they bill for services after the services have been performed.
Under the the Clarification Act, however, the meaning of the term “creditor” now includes only those who (1) regularly and in the ordinary course of business obtain or use consumer reports in connection with a credit transaction; (2) furnish information to consumer reporting agencies in connection with a credit transaction; or (3) advance funds to or on behalf of a person, based on an obligation of the person to repay the funds. The Clarification Act does not specifically exclude doctors, lawyers, and accountants. But Senator Christopher Dodd (D.-Conn.) and Senator Mark Begich, (D.-Alaska) make clear that the Clarification Act does not extend to these professionals and other small businesses as creditors covered under the Red Flags Rule simply because they provide services and bill clients, patients, and customers for payment at a later time, except to the extent that they furnish information to consumer reporting agencies in connection with a credit transaction. Finally, the Clarification Act allows the FTC to determine in the future whether the scope of the Rule should be expanded to include other types of creditors that offer or maintain accounts subject to a reasonably foreseeable risk of identify theft.
From a practical standpoint, even those professionals and businesses specifically exempted from the Red Flags Rule should establish an identity theft prevention program: It is a good business practice to eliminate or, at least, minimize the chance of a data breach and minimizing the subsequent fall out with your customers. Additionally, there may be other applicable regulations that may require certain protection programs. For example, doctors must have HIPAA security programs in place and there is a patchwork of state statutes that cover data security and reporting requirements for breaches.
For questions about Red Flags Rule Compliance, establishing an information security program, or improving your organization’s current policies and procedures for preventing losses, contact E-Business Counsel, PLC.