Client Alerts & Insights
FTC Further Delays Enforcement of Red Flags Rule
November 1, 2009
Authored By:
The Federal Trade Commission (the “FTC”) has delayed enforcement of the Red Flags Rule until June 1, 2010. After three previous delays, the FTC was scheduled to begin enforcing the Red Flags Rule on November 1, 2009. However, in a statement posted on its website on October 30, 2009, the FTC announced that it will further delay enforcement of the Red Flags Rule at the request of members of Congress.
The Red Flags Rule requires financial institutions and creditors to adopt written identity theft prevention programs with respect to “covered accounts.” The Red Flags Rule defines a creditor as any person who: regularly extends, renews, or continues credit; regularly arranges for the extension, renewal, or continuation of credit; or is an assignee of an original creditor who participates in the decision to extend, renew, or continue credit. A “covered account” is an account used mostly for personal, family, or household purposes that involves multiple payments or transactions or an account for which there is a foreseeable risk of identity theft.
The FTC has indicated that a health care provider is a creditor for purposes of the Red Flags Rule if the provider bills consumers after services are completed (including billing for the remainder of fees not covered by insurance), allows patients to set up payment plans after services are completed, or helps patients get credit from other sources.
Health care providers that are creditors under the Red Flags Rule must now have written identity theft prevention programs in place on or before June 1, 2010. These policies must identify relevant red flags of identity theft related to the covered accounts, establish policies and procedures by which the providers will detect and respond to such red flags, and ensure that the programs will be updated periodically to reflect changes in risks to the security of patients’ identities.
The FTC has issued a guide that entities may use in developing identity theft prevention programs. However, entities should ensure that their policies are specifically tailored to their operations.
Additional Information
For more information on compliance with the Red Flags Rule, please contact a member of Benesch’s Health Care Department:
Harry M. Brown at 216.363.4606 or hbrown@beneschlaw.com
Janet K. Feldkamp at 614.223.9328 or jfeldkamp@beneschlaw.com
Alan E. Schabes at 216.363.4589 or aschabes@beneschlaw.com
Latest News
DOJ’s National Fraud Enforcement Division Issues Corporate Enforcement Directive, Signaling Heightened Scrutiny of Corporate Fraud
DOJ’s new enforcement framework reinforces that corporate fraud investigations will remain a significant enforcement priority, particularly in healthcare, government contracting, tax and international trade.
Lessons from Kai Spears v. The New York Times Co.: A Historic Defamation Verdict
The first defamation verdict against The New York Times in more than 50 years highlights the significant litigation risks that can arise when reporting relies on inadequately vetted anonymous sources and critical editorial safeguards are not followed.
Back To Wright Line: NLRB Resets Standards for Workplace Misconduct
Employers have regained greater flexibility to address offensive or abusive employee conduct that occurs during union activity or other activity protected by the National Labor Relations Act. On September 23, 2026, the National Labor Relations Board (the “Board”) issued a significant decision in Lion Elastomers LLC, 375 NLRB No. 41, restoring the prior standard for evaluating discipline when employee misconduct occurs during protected concerted activity from General Motors LLC, 369 NLRB No. 127.
Can an Algorithm Commit a Tort? The Circuit Split Over Section 230
A growing circuit split is reshaping the scope of Section 230 immunity. While the Fourth and Ninth Circuits continue to view algorithmic recommendations as protected publisher conduct, the Third Circuit has taken a narrower approach, holding that certain algorithm-driven content recommendations may constitute a platform’s own conduct and therefore fall outside Section 230’s protections.