New Law Limits Reach of Red Flags Rule for Many Businesses and Professional Firms

Written by: Douglas R. Chamberlain, co-Leader of Sulloway's Health Care Practice Group and member of Sulloway's Business and Private Clients Practice Group

On December 18, 2010, the Red Flag Program Clarification Act of 2010 became law. Readers will recall that several years ago the Federal Trade Commission (FTC) issued an Identity Theft Red Flags Rule (the Rule), requiring financial institutions and other "creditors" to develop written identity theft prevention programs. Initially the FTC sought to apply the Rule to virtually any business or professional firm that did not receive immediate payment (by cash, check or credit card) when goods or services were provided. Professional groups in particular, including the American Bar Association and the American Medical Association, strongly protested the application of the Rule to their members. Specifically, the ABA secured a court order barring the FTC from enforcing the Rule against attorneys. In response to these protests and Congressional pressure, the FTC several times delayed enforcement of the Rule, most recently to December 31, 2010.

The Clarification Act limits the Rule's application to creditors that regularly and in the ordinary course of business: 1) obtain or use consumer credit reports, directly or indirectly, in connection with a credit transaction; 2) furnish information to consumer credit reporting agencies in connection with a credit transaction; or 3) advance funds to or on behalf of a person based on his or her obligation to repay the funds, or on repayment from specific property pledged by or on the person's behalf. Thus, firms that simply provide goods and services on an open credit basis are generally not subject to the Rule unless they advance funds out of pocket on the customer's behalf for which they expect repayment, or if the customer pledges real or personal property to secure repayment of these sums.

Importantly, the Act excludes any creditor that "advances funds on behalf of a person or expenses incidental to a service provided by the creditor to that person." By thus limiting the definition of "creditor" for purposes of the Rule, professional service providers such as attorneys, accountants and physicians will no longer be classed as creditors simply because, for example, they pay for filing fees (in the case of attorneys and accountants) or tests (in the case of health care providers) on behalf of their clients or patients, and in either case expect to be reimbursed for these expenses when the bills for their own services are paid.

It is vital to note, however, that such service providers can still be considered creditors subject to the Rule if they obtain or use consumer credit reports or furnish information to consumer credit reporting agencies. Service providers wishing to avoid running afoul of the Rule should thus exercise caution in requesting or acting on credit reports in their dealings with customers, clients or patients, and should refrain from furnishing information to credit reporting bureaus concerning these individuals.

Finally, the amended definition of "creditor" included in the Clarification Act also includes other creditors whose "regulating authority" issues a rule pursuant to "a determination that such creditor offers or maintains accounts that are subject to a reasonably foreseeable risk of identity theft." Therefore, a service provider that is subject to a regulating authority (such as the state Supreme Court in the case of an New Hampshire attorney, or the Board of Medicine with respect to a New Hampshire physician) could also become subject to the Rule should that authority choose to regulate professional practice in this regard.

Nonetheless, the Red Flag Program Clarification Act represents a welcome development in terms of easing compliance burdens for health care providers, attorneys and other professionals, as well as businesses of all sorts who, as an accommodation to their customers, clients or patients, permit them to pay their bills within a reasonable time after services are provided, and are not in the business of extending credit to these individuals on a regular basis.

If you have any questions concerning the Red Flag Program Clarification Act or its applicability to your business or professional practice, please contact Doug Chamberlain of our Health Care and Business/Private Clients Groups.