In order to give "creditors," which by definition includes most, if not all, medical practices, more time to comply with its "Red Flags Rule," the Federal Trade Commission has announced that it will delay enforcement of the Rule until August 1st.
 
What is the Red Flags Rule?
 
The Red Flags Rule is federal regulation aimed at detecting identity theft through the identification by financial institutions and creditors of "red flags," indicators of possible identity theft appropriate to the specific business relationship, in order that action can be taken to expose actual instances of that crime, mitigate its damage, and prevent future occurrences. 
 
Despite protest by the American Medical Association and other groups that the federal statue pursuant to which the Red Flags Rule was issued was never meant to cover the doctor-patient relationship, and that, therefore, the Rule is overbroad, the FTC has not agreed with that position. 
 
In announcing the extension of the enforcement date, the FTC acknowledged the debate concerning the scope of the Rules and stated that it will release a template to help entities that have a low risk of identity theft, including those that know their customers personally, comply with the law.
 
Why Should You be Concerned?
 
Physicians need to be concerned with the Rule and compliance with it for several reasons.
 
First, the penalty for noncompliance with the Rule could be as high as $2,500 for each "knowing violation."  As it is likely that your noncompliance would be global and not just limited to a single instance, it is conceivable that if you are liable for one penalty you would simultaneously be liable for many penalties.
 
Second, there are other good reasons to comply with the Rule besides the avoidance of penalties:

 

●  The Rule operates as a logical component to patient privacy laws including HIPAA, with which your practice already complies.  HIPAA and other privacy laws are designed to keep a patient's healthcare information restricted to those who should be using it - the Red Flags Rule operates to prevent a patient's healthcare information from being "polluted" with inapplicable data, the data of a third party who has assumed the patient's identity.  In this light, the Red Flags Rule is another component of assuring data security and trustworthiness.

 ●  Unpolluted data not only benefits the "real" patient, in certain circumstances it can benefit your ability to interpret and diagnose.  For example, it increases the chances that an image taken previously is really of the same individual.

 ●  Additionally, it increases the odds that you will not be conned into providing care that will not be reimbursed.  For example, Ms. Jones' carrier will not pay for services delivered to Ms. Smith masquerading as Ms. Jones.
 
How Can You Determine if Your Practice is Required to Comply With the Rule?
 
The Rule sets out a test to determine if you fall within its scope.
 
First, you must be a "creditor" which, for medical practices means that you regularly defer payment by your patients -- that is, they do not pay 100% of the fee at the time of service.  Of course, if you accept later payment from your patients' carriers or bill for co-pays or deductibles, or allow payment plans, then you've met this requirement.
 
If you are a creditor, the Rule applies only if you have "accounts," which requires a continuing relationship with your patients.  Although it might be conceivable that your practice has one-time patient encounters only, most if not all practices will have multiple transactions with some patients and will therefore fall subject to the Rule.  Because of the penalties that can be imposed for noncompliance, it's prudent to err on the side of caution when considering whether your practice meets this requirement.
 
The next step is to determine if your accounts are "covered accounts."  There are two tracks to covered account status.  One is that the service underlying a multiple payment account relates to personal, as opposed to business, purposes; most healthcare services would be included within this track.  The other track is that there is a reasonably foreseeable risk of harm (financial, operational, compliance, reputation, or litigation risk) to your "customers" or to your practice from identity theft -- this, too, is would generally be the case.
 
We're Covered, So Now What?
 
If your practice is covered by the Rule, you are required to implement a written "Identity Theft Prevention Program" by August 1, 2009.  The Program must be approved by your entity's board of directors or like governing body or by the group's senior management.
 
The first step in developing the Program is to identity "red flags" of identity theft relevant to your practice.  For example, red flags might include identification that is obviously forged or phony, a social security number outside of the date range of the patient's stated age, an address which turns out to be nonexistent or otherwise not valid, or receipt of a complaint from the person receiving your statement that he or she has never been a patient of your practice.

 

You have to design and implement procedures for identifying those red flags, both in respect of new patient accounts and existing ones.  This includes staff training on the implementation of policies designed to discover incidents of red flags.
 
You need a plan for how to react if a red flag is detected.  Your plan might include steps such as informing the police and other authorities, notifying the victim of the identity theft, and assessing the injury to your practice and its medical records.
 
Your Identity Theft Prevention Program must be overseen by your entity's board, senior management or by someone to whom that task is delegated.  And, you need to make periodic assessments of how your plan is operating and of any changes to it that should be made.

 

Hospital-based groups, as well as other practices, that bill though outside billing services, need to coordinate their program design and implementation with their billing service.  Note, however, that as it is your obligation, and not the billing service's, to comply with the Red Flags Rule, and as the FTC will levy penalties against you directly, you cannot simply "outsource" all responsiblity and oversight to your billing service. 

What's the Practical Bottom Line?
 
From a practical perspective, it makes little or no sense to rely on the argument that the Red Flags Rule or the statute underlying it is overbroad and not meant to apply to healthcare providers. 
 
Even if the FTC were to change its position on the applicability of the Rule, it is beneficial to physicians to adopt its practices to reduce the risk that you might be creating medical data that "pollutes" your medical records, and that increases the chances that you will be paid for your services.
 
Lastly, compliance is relatively easy, especially when considered as a complement to existing HIPAA policies and procedures.  
 
Contact Mark F. Weiss for more information.