AMA, AAFP Seek Physician Exemption From Identity Theft Prevention Program Rules

The AMA and the AAFP have asked the Federal Trade Commission, or FTC, to exclude physicians from a regulation that would require them to participate in establishing identity theft prevention programs.

The FTC issued final rules (59-page PDF; About PDFs) last November that require financial institutions and creditors to develop and implement written identity theft prevention programs as part of the Fair and Accurate Credit Transactions (FACT) Act of 2003. (62-page PDF; About PDFs) According to the FTC, physicians are creditors and, therefore, are required to develop and implement written identity theft protection programs that will identify, detect and respond to identity theft "red flags."

The FTC, which wants all such identity theft programs in place by Nov. 1 of this year, would require physicians to establish "reasonable policies and procedures for detecting, preventing and mitigating identity theft," according to the final rules.

"Given that (the) final rules go into effect Nov. 1, 2008, we … request that the FTC withhold any plans to apply the red flag rules to physicians until this matter is resolved," says the AMA in a letter (3-page PDF; About PDFs) that was signed by the AAFP and 25 other medical organizations.

In the letter, the AMA, the AAFP and the other organizations voice strong disagreement with the FTC's interpretation that physicians are creditors and, thus, are subject to the red flag rules. The organizations call on the FTC to "immediately provide a cogent legal analysis and judicial precedence which support the views expressed by some staff attorneys that the final rules are applicable to physicians."

The FTC defines a creditor as any person who regularly extends, renews or continues credit or any person who regularly arranges for the extension, renewal or continuation of credit. The FTC definition also includes any assignee of an original creditor who participates in the decision to extend, renew or continue credit.

"We do not believe that most practicing physicians are 'creditors' under the statutory and regulatory scheme," states the letter. Most physicians do not regularly extend, renew or continue credit, it points out.

The final rule's definition of a creditor specifically mentions lenders, such as banks, finance companies, automobile dealers, mortgage brokers, utility companies and telecommunications companies, the letter says. But it does not include physicians, other health care providers or other types of professionals, such as lawyers or accountants, among the trades or businesses identified as creditors.

The letter acknowledges that some staff attorneys in the Privacy and Identity Protection Section of the FTC have taken the position that physicians are creditors if they bill patients after appointments instead of billing them at the time of their appointments.

"We also question if it is a correct interpretation of the final rule to advise that physicians are creditors if they bill patients after their services are rendered," states the letter. "That would lead to the result that anyone issuing a bill or invoice for services rendered would, by definition, be a creditor, which we do not believe is the intent of the statutory and regulatory scheme."

Furthermore, the letter points out, "if a physician's billing to a patient is due when invoiced, the physician should not thereafter become a creditor for purposes of the final rule simply because the physician agrees, after the fact, to let the patient pay in installments as opposed to turning the matter over to a collection agency or suing the patient."

"Likewise, physicians should not be considered creditors simply because they accept insurance and hold the patient responsible for the amount(s) unpaid by insurance," the letter says. The amount owed by the patient "is not fixed or certain, and there is no extension of credit while the claim is being processed by the insurance company."