Related Practices

Advisory Sign Up


receive insight on

legal developments

from Troutman Sanders.

News & Knowledge

FTC to Delay Enforcement of Red Flags Rule Until August 1, 2009


Just announced, the FTC will suspend enforcement of the Red Flags Rule again - this time until August 1, 2009 (resulting in an additional three month delay from its current compliance date of May 1, 2009). This suspension will give healthcare providers more time to develop and implement identity theft prevention programs. The FTC explained that this action results from the ongoing debate regarding whether the Red Flags Rule is too broad in its application. Its application to healthcare providers has been the subject of ongoing debate, and the FTC has recently confirmed that healthcare providers must comply with the Red Flags Rule. This additional three month delay will allow the healthcare industry and its many associations to share guidance with their members and will also provide Congress time to consider the issue further. During this time period, the FTC also has stated it will release a template to help entities that have a low risk of identity theft to comply with the law. The FTC will forebear from bringing any enforcement action for violation of the Rule during this additional three-month compliance period. The FTC's announcement, however, applies only to entities subject to its jurisdiction and does not affect the other agencies charged with overseeing enforcement of this Rule: the Office of the Comptroller of the Currency, Federal Reserve Board, Federal Deposit Insurance Corporation, Office of Thrift Supervision, and the National Credit Union Administration.

The Red Flags Rule resulted from the Fair and Accurate Credit Transactions Act of 2003, which amended the Fair Credit Reporting Act, and requires covered entities to develop and implement a written Identity Theft Prevention Program designed to detect, prevent, and mitigate identity theft. The FTC explained that many entities subject to the Rule were uncertain about their coverage under the Red Flags Rule. During the first extension period, the FTC conducted outreach efforts and developed and published materials to help explain what types of entities are covered.

For more information, see the FTC Web site.

This is one in a series of advisories regarding “Red Flags Rule”.   Please contact us if you have questions or would like copies of previous advisories related to this topic. Troutman Sanders LLP offers a full array of services to help bring healthcare providers into compliance with the Red Flags Rule.