Are all physicians subject to the Identity Theft Red Flags Rule?

No, but most are. Because many physicians bill the patient after the claim for service has been processed by a payer and/or accept partial payments on patient balances, it is expected that most physicians and their practices will be subject to the rule.

Physicians are subject to the Red Flags rule if they meet the definition of a creditor under the rule. Under the rule, a physician or practice is a creditor if they extend “credit,” which means they regularly defer payment for goods or services and have covered accounts. A covered account is (1) an account primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions, or (2) any other account for which there is a reasonably foreseeable risk to customers, or the safety and soundness of the financial institution or creditor, from identity theft.