The Federal Trade Commission (FTC) and the federal institution regulatory agencies have issued the final rules of the Fair and Accurate Credit Transactions Act. According to a report of the President’s Identity Theft Task Force, identify theft results in billions of dollars of losses each year to individuals and businesses.
The American Medical Association (AMA) and the Medical Group Management Association (MGMA) understand some attorneys in the Privacy and Identity Protection Section of the FTC have taken the position that physicians and hospitals are “creditors” and therefore subject to the Red Flag or final rules. Doctors are considered creditors because they accept insurance and therefore do not require full payment up front at the time they see patients, but rather bill patients after the physician’s services are rendered. Both the AMA and the MGMA have disagreed with the FTC’s interpretation that physicians are “creditors” and are therefore subject to the Red Flag Rules.
Covered financial institutions and creditors must comply with the rules by November 1, 2008. Most physicians are not aware of this and have no policies, procedures, or plans in place. The final rules require each financial entity and creditor that holds any consumer account, or other account for which there is a reasonably “foreseeable” risk of identity theft, to develop such a plan.
The program for combating identity theft in connection with new and existing accounts must include “reasonable” policies and procedures for detecting, preventing, and mitigating identity theft and must enable a financial institution or creditor to:
1. Identify relevant patterns, practices, and specific forms of activity that are red flags signaling possible identity theft and incorporate those red flags into the program;
2. Detect red flags that have been incorporated into the program;
3. Respond appropriately to any red flags that are detected to prevent and mitigate identity theft; and
4 Ensure the program is updated periodically to reflect changes in risks from identity theft.
To keep up with this situation, visit
ama.org.