Compliance Deadline for Federal 'Red Flags' Rule Draws Near

AAFP Resources Can Help Members Adhere to ID Theft Rule

By News Staff
4/16/2009

Despite the Academy's attempts to get its members exempted, as of May 1, nearly all physician practices in the country will be required to comply with a new federal rule aimed at safeguarding consumers' personal identifying information. The Identity Theft Red Flags Rule will require family physicians to determine what identity theft red flags may occur in their practices and have a plan for responding to those red flags.

The new federal regulation, which will be administered by the Federal Trade Commission, or FTC, requires financial institutions and creditors -- including physician practices -- to develop and implement written identity theft prevention programs as part of the Fair and Accurate Credit Transactions Act of 2003. (62-page PDF; About PDFs)

Initially, the Academy and several other medical specialty organizations tried to convince the FTC to exclude physicians from the regulation. Despite their efforts, however, the FTC decided that many physicians are creditors and, therefore, are subject to the rule.

"The red flags rule is intended to address all forms of identity theft, including those involving the provision of health care," says a Feb. 4 letter from the agency (9-page PDF; About PDFs). "Although identity theft most commonly is associated with financial transactions, there are increasing concerns about identity fraud in the context of medical care."

To help Academy members prepare for the approaching compliance deadline, the AAFP's Practice Support Division has created an online resource. The Identity Theft Red Flags Rule Web page includes a 35-page, members-only PowerPoint presentation on complying with the rule; responses to a number of frequently asked questions; and a list of additional Web sites that may prove helpful to physicians.

Visitors will find documents that define terms, explain the purpose of the rule, spell out what is required of physicians and give some examples of how the red flags rule may apply to a physician's practice.

Under the heading, "What is a Red Flag?" users will find a checklist that ticks off particular activities that could alert practice staff to possible identity theft. Examples include

altered or forged patient documents;
inconsistent patient identification information, including a personal description or photograph that doesn't match the patient;
invalid phone numbers;
suspicious addresses that could indicate a post office box or prison; and
similar or identical social security numbers or addresses presented by multiple patients.

The red flags rule materials also guide physicians through specific steps to help them comply with the rule, such as

developing a written program to identify, protect and respond to possible risks of identity theft;
updating the program periodically;
identifying an individual within the practice who will oversee the program; and
reporting, at least annually, on the program's effectiveness.

Printer-friendly version

Email this page