
At the request of Members of Congress, the FTC (Federal Trade Commission) once again (for the 4th time!), extended the Red Flag Rule enforcement deadline until June 1, 2010. The Red Flag Rule sets up requirements for financial institutions and creditors, subject to enforcement by the FTC, to address the risk of identity theft.
Basically, The Red Flag Rule requires all such covered entities to develop and implement written identity theft prevention programs to help identify, detect, and respond to patterns, practices, or specific activities – known as “red flags” – that could indicate identity theft. As a covered business or organization, you need to implement a written Identity Theft Prevention Program which is set up to detect the warning signs (red flags) of identity Theft in your day to day operations. Although the rule is in place for financial institutions, one of the main sticking points is what businesses or organizations are actually covered, and therefore required to implement this policy.
For example, the FTC applied this rule to doctors and lawyers offices which take credit. At the beginning of this year, the American Medical Association tried to argue that doctors' offices and related health care providers were not “creditors” and therefore did not have to comply. The FTC responded “that the plain language and purpose of the Rule dictate that health care professionals are covered by the Rule when they regularly defer payment for goods or services. We also believe that implementation of the Rule will help reduce the incidence of medical identity theft; and that the burden on health care professionals need not be substantial”. The FTC felt that Medical Identity Theft, when a patient seeks care using the name or insurance information of another person, can result in both false billing and the potentially life-threatening corruption of a patient's medical records. Shortly thereafter, other associations, including the American Bar Association, also tried to argue that lawyers not creditors and were therefore exempt.
This controversy is what caused the delay in implementation for small businesses such as doctors, accountants and lawyers. There are several bills in Congress attempting to opt-out such businesses. However, by doing so, they will be weakening a law which is set up to protect consumers.
So, do you own a business? If so, are you covered and need to comply? Basically, under the law, businesses that allow customers to purchase goods or services on credit must take reasonable and appropriate steps to make sure that they are extending credit to a real person and not an identity thief. Does that include you? If so, then you must comply with The Red Flag Rule! Even if you are in a lower risk class, you still will need to take some steps such as those listed here.
For more information and to find out whether the rule applies to your business or organization, please check out www.ftc.gov/redflagsrule. 
If you want to find out more about Identity Theft, The Little Book of Identity Theft is an excellent resource to find out what it is, how you can take steps to prevent identity theft, and what to do if it happens to you. Check it out now.