Update 5/28/10: Red Flags? Nah … nothin' but blue skies. The FTC delays implementation of the Red Flags Rule yet again, to December 31.
Update 11/3/09: The FTC announced that implementation of the Red Flags Rule will be delayed once more, this time until June 1, 2010. The announcement came on the heels of losing a court case to the American Bar Association — the court ruled that the rule does not apply to lawyers — and on the heels of a legislative attempt to bar its applicability to small health care, accounting and legal practices. Stay tuned.
Update 7/29/09: The FTC announced today that implementation of the Red Flags Rule will be delayed once again, this time til November 1, 2009. The agency promises to roll out additional information targeted at low-risk entities covered under the rule. Thus far, nothing has changed with respect to the rule and its ultimate effect, so organizations subject to the rule should take the extra time to assess their compliance needs and implement their plans in advance of November 1.
After a couple of delays, the FTC Red Flags Rule will be effective August 1, 2009. This rule requires "creditors" under certain "covered accounts" to maintain a heightened alertness to numerous categories of "red flags" that may indicate that the consumer who is the rightful account holder is the victim of identity theft. If a red flag is triggered, the creditor must take steps to notify the consumer and correct any inappropriate information included the creditor's records.
As you probably already know, the FTC is extending its reach with this rule (among others) into the health care sector. (Cf. the FTC's role in enforcing certain Son of HIPAA provisions.) The AMA has all but dropped a draft complaint on the FTC's desk, citing assorted legal precedents in its correspondence with the FTC arguing that the Red Flags Rule should not apply to physician practices. The FTC is unmoved — except to the extent that it has been willing to delay the effective date twice (from November 2008 to May 2009 to August 2009).
At any rate, the August 1 effective date is around the corner, and affected health care entities need to develop and implement compliance plans now, if they haven't already. (Even the AMA says so, and has published guidance and a sample policy for members.)
A few more general comments before stepping back and examining the language of the rule and its applicability to health care providers.
The federales are taking something of a common-sense approach here, recognizing that a compliance plan needs to be tailored to the specific entity, the nature of its "covered accounts" and its operations. Bank of America, N.A. and Springfield Medical Associates, P.C. will have very different compliance plans, because their potential red flags and the potential risks are vastly different.
Affected health care providers need to understand that the Red Flag Rule requirements overlap with HIPAA and state privacy law requirements (and looming Son of HIPAA requirements in ARRA), but will not be satisfied by implementation of existing privacy policies and compliance plans. Review of the intersection of existing policies and procedures with the new rule's requirements is the first order of business.
As with any other new regulatory scheme, preparing a compliance plan and putting it on the shelf won't cut it. The rule calls for regular monitoring of the plan and issues that arise by a senior manager. Furthermore, best practices would dictate the training of staff to deal with individual issues and, most importantly, with the affected consumers.
Even if not clearly subject to the Red Flags Rule, providers should undertake to comply, for a couple of interrelated reasons:
- Good patient PR. Data security is top of mind these days. Much of the effort required under the rule should be expended anyway simply to respond to market pressures calling for improved data security.
- Potential liability. The creative trial attorney will seek to use the Red Flags Rule as establishing a standard of care for the stewardship of personal information. The incensed jury will go along. The health care provider caught in the middle between thieves and victims may be the only perceived deep pocket available.
OK, so what is a "creditor" and what is a "covered account?"
Any entity that accepts payment other than payment in full at the time of service is a creditor. Health care providers that go the cash-on-the-barrelhead route aren't creditors; all others are creditors.
The FTC Guide defines covered accounts as follows: either
- a consumer account you offer your customers that’s primarily for personal, family, or household purposes that involves or is designed to permit multiple payments or transactions; or
- any other account that a financial institution or creditor offers or maintains for which there is a reasonably foreseeable risk to customers or to the safety and soundness of the financial institution or creditor from identity theft, including financial, operational, compliance, reputation, or li
tigation risks.” Examples include small business accounts, sole proprietorship accounts, or single transaction consumer accounts that may be vulnerable to identity theft. Unlike consumer accounts designed to permit multiple payments or transactions – they always are “covered accounts” under the Rule – other types of accounts are “covered accounts” only if the risk of identity theft is reasonably foreseeable.
Any creditor with covered accounts must have a red flags rule compliance plan in place with policies and procedures for dealing with "red flags" — i.e., signs that personal information may have been compromised. The World Privacy Forum suggests that the following red flags are the ones most applicable in the health care context:
o a bill for another individual
o a bill for a product or service that the patient denies receiving
o a bill from a health care provider that the patient never patronized or
o a notice of insurance benefits (or Explanation of Benefits) for health services never received.
• Records showing medical treatment that is inconsistent with a physical examination or with a medical history as reported by the patient.
• A complaint or question from a patient about the receipt of a collection notice from a bill collector.
• A patient or insurance company report that coverage for legitimate hospital stays is denied because insurance benefits have been depleted or a lifetime cap has been reached.
• A complaint or question from a patient about information added to a credit report by a health care provider or insurer.
• A dispute of a bill by a patient who claims to be the victim of any type of identity theft.
• A patient who has an insurance number but never produces an insurance card or other physical documentation of insurance.
• A notice or inquiry from an insurance fraud investigator for a private insurance company or a law enforcement agency.
If a situation is flagged, a creditor must take steps to mitigate the risk of identity theft or continued identity theft. Again, the World Privacy Forum notes:
There need to be uniform but appropriately flexible answers to these questions:
- What do we do when a patient claims fraud is in their files?
- What do we do when a patient says the bills are for services she did not receive?
- What do we do for patients and other impacted victims when we uncover a fraudulent operation?
- When we have a real case of medical identity theft, how can we work with patients to fix the records and limit future damages?
- What do we do when a provider has altered the patient records?
- How do we handle police reports and requests for investigation from victims?
The answers to these questions need to viewed not just from the provider’s perspective, but also from the victim’s perspective, which can differ substantially.
There are a number of useful resources available for health care providers seeking to take stock of their situation, establish Red Flags Rule compliance policies and procedures, and undertake staff training on the subject. For example, the FTC, the AMA and the World Privacy Forum have all released valuable guidance documents (all linked to above) that would assist any organization with coming into compliance.
As with any effort of this sort, it is often valuable to have someone outside the organization come in to review existing policies, procedures and workflow in order to highlight potential risks and opportunities for improvement. The HealthBlawger and members of the HealthBlawger's virtual consulting network are available to come in and assess, plan and help implement compliance strategies for organizations large and small touched by the Red Flags Rule.
Whatever the size or nature of your business, please take a moment to consider how the Red Flags Rule may apply to its operations, and how it may relate to other regulatory schemes such as HIPAA and state laws.
David Harlow
The Harlow Group LLC
Health Care Law and Consulting
Great article! I will add two things: Vendor Management and those valuable guidance documents from the FTC, the AMA and the World Privacy Forum.
Vendor Management is a must. Most businesses continue to believe by outsourcing will relieve their liability. Liability follows the data. Next to employees, third parties are just as responsible for data breaches in the workplace.
Those docs are valuable, but businesses and healthcare providers are believing that by simply getting those documents and telling their employees to read them is red flags compliance. The rule specifically says to have a program not just a policy.
Are we trying to stop identity theft or not!
Mike — I agree with you on both counts. Creditors need to take a holistic approach towards red flags rule compliance; and there is no such thing as paper compliance, in this arena as in so many others.
Mike I visited your web site (and it is indeed extremely comprehensive and informative). I understand that the law affects any company/entity that has consumer accounts that may defer payment for goods or services. However, does the law imply that employees of a typical company are also affected? Since all companies have detailed information on each employee (e.g., SSN, address, phone, email, etc.,) they can also have miscellaneous credit card information as well. This could be as a result of an employee purchasing items or services from the company.