On November 9, 2007, the Federal Trade Commission (FTC) published its Red Flag rule concerning identity theft.  Under the rule, financial institutions and creditors are required to develop and implement a written identity theft program to identify, detect, and respond to possible risks of identity theft relevant to them.  The original compliance deadline was November 1, 2008.  The FTC extended the deadline to June 1, 2010 after receiving complaints, particularly from the medical community, regarding the definition of creditor.

According to the FTC, a creditor is "any person who regularly extends, renews, or continues credit; any person who regularly arranges for the extension, renewal or continuation of credit; or any assignee of an original creditor who participates in the decision to extend, renew or continue credit."  FTC attorneys have taken the position that physicians are creditors, if they do not require full payment upfront at the time they see patients, but bill patients after the services are rendered.  The physician associations have called on the FTC to not apply this rule to the physician community.

In February, the FTC responded to physicians associations in a written letter that the creditor definition does apply to the physician community.  The FTC noted that the rule's requirements are risk-based, meaning that the steps covered entities must take to address potential identity theft should be commensurate with the risks they encounter.  Therefore, if a physician's practice is at low risk for identity theft, an appropriate program may consist of checking photo identification and having procedures in place in case the physician's office is notified that the patient's identity has been misused.

The AOA recently signed onto a letter with the AMA and other physician associations maintaining our position that the FTC rule should not apply to the physician community.  We also called on the FTC to reopen the rule for public comment.  In the meantime, the AOA has compiled this Frequently Asked Questions and Guide to help our members with the red flag rule.

What is a Red Flag? 

The FTC defines the Red Flag as a pattern, practice, or specific activity that indicates the possible risk of identity theft.  Examples include:

Does the red flag policy differ from HIPAA?

HIPAA's privacy and security requirements are meant to protect a patient's personal health information. The FTC Red Flag Rule extends protection to other information such as credit card information, tax identification numbers (i.e., Social Security numbers), and insurance claim information.

How prevalent is Medical Identity Theft?

According to the FTC, 8.3 million American adults were victims of identity theft in 2005.  Three percent of those victims said that the thief had obtained medical treatment, services, or supplies using their personal information.

What are some examples of Medical Identity Theft?

The World Privacy Forum has released a report on how the FTC rule applies to health care providers.  The report gives many examples of medical identity theft, such as your patient receives a bill for another individual, or for a product or service he/she did not receive, or from a doctor he/she did not see.  (For the full report, go to www.worldprivacyforum.org) Other examples are:

How to detect a suspicious document?

According to the FTC, suspicious documents include ones for identification that are inconsistent with:  the appearance of the individual presenting the identification; information provided by the individual; readily accessible information that is on file with the physician's practice such as a recent check.  Other examples that could indicate identity theft: the individual's phone number is invalid, or associated with a pager or answering service; there's no correlation between the Social Security Number range and date of birth; the address provided is fictitious, a mail drop, or a prison; and the documents presented for identification appear forged or altered. 

What is my practice required to do under the FTC Red Flag Rule?

As stated earlier, the rule's requirements are risk-based, meaning that the steps covered entities must take to address potential identity theft should be commensurate with the risks they encounter. For example, the risk of identity theft may be low for a small practice in which the patients are more familiar to the physician and staff. In that case, checking photo identification, i.e., driver's license and having a plan in place in case the physician's office is notified that the patient's identity has been misused may be sufficient.

In general, however, physicians who are creditors by the agency's definition must:

What procedures should my practice consider?

When a patient makes an appointment, the patient should be instructed to bring at the time of the appointment a photo ID and health insurance card. If the photo identification does not indicate a current home address, the patient should bring utility bills or other correspondence indicating current residence. This procedure could be waived if this is an established patient.  Staff should update patient information particularly if the patient has not been seen within the last six months. 

What are appropriate responses to detecting Red Flags?

If a red flag is detected, the staff should document and report the incident to his/her supervisor or designated compliance officer. If the activity is determined to be fraudulent, the physician practice should consider: 1) not open a new account; 2) cancel existing account; 3) contact the affected patient; 4) contact law enforcement; 5) contact affected physician(s).

What steps should I consider if my patient claims to be a victim of identity theft?

Encourage your patient to contact law enforcement and to fill out the FTC's ID Theft Affidavit (www.ftc.gov/bcp/edu/resources/forms/affidavit.pdfhttp://www.ftc.gov/bcp/conline/pubs/credit/affidavit.pdf), or call (877) IDTHEFT.   Compare the patient's documentation with personal information in the practice's records. If the patient's identity has been stolen, the practice should consider additional actions to determine whether the patient's medical records were affected and if they were, identity theft should be noted in the record. The practice also should determine if any additional files were affected and take appropriate action.

Are there penalties for non-compliance?

Physician practices may face a penalty of up to $2,500 per "knowing violation."