House votes for FTC identity theft rule reprieve

Physicians in smaller practices may not need to grapple for long with a federal regulation mandating the implementation of an identity theft prevention program. The House on Oct. 20 passed legislation that would exempt most practices from the "red flags" rule, which has an enforcement date of Nov. 1.

The Federal Trade Commission regulation requires entities that regularly extend credit or defer payment for services to implement a formal policy for detecting and preventing identity theft. Despite objections from the American Medical Association and other organizations, the commission counts physician practices as creditors if they bill patients for past services or allow patients to set up payment plans.

But the new legislation, authored by Rep. John Adler (D, N.J.), would amend the definition of a creditor to exclude businesses with 20 or fewer employees, including health care practices. The bill now heads to the Senate for consideration.

Other provisions would exempt entities that:

• Know all of their customers individually.
• Only perform services in or around the residences of its customers.
• Have never experienced incidents of identity theft or are in an industry where such occurrences are rare.

The legislation leaves it up to the FTC to determine whether a particular business meets the criteria for an exemption.

The AMA has not taken a position on the bill but is generally supportive of efforts to remove doctors from the rule's scope. The Association has argued to the FTC and lawmakers its position that physicians are not creditors under the law, and the mandate would unnecessarily burden small physician practices both administratively and financially.

Efforts by organized medicine have resulted in three prior delays of the final enforcement of the red flags rule.