Red Flag Rules - Identity Theft Protection Program*

Based on legislation passed by Congress in 2003, in 2007, the Federal Trade Commission (FTC) first issued regulations stating that financial institutions and creditors are required to develop and execute written "identity theft prevention programs" that must provide for the identification, detection, and response to patterns, practices, or specific activities. These are known as "red flags" and could indicate identity theft. Enforcement of the regulation has been extended and begins August 1, 2009. Until recently, there was much ambiguity regarding the regulations and questions were raised as to whether physician offices fell under the FTC red flags guidelines. In February, the FTC clarified that Identity Theft Red Flag Rules do indeed apply to physicians including doctors of chiropractic. The FTC does not believe that the regulations will inflict any substantial burdens on most healthcare providers. The goal of the Rule is "to reduce the overall incidence and impact of identity theft, including medical identity theft." Medical identity theft can occur when a patient seeks care using the identity or insurance information of another person. The rules are also intended to reduce risk of theft of credit information.

Does the Rule apply to me?

Practices are covered under the rule if two conditions are met:

1. They are a "creditor" organization, and
2. They have "covered accounts"

Under the rule, "credit" means an arrangement by which you defer payment of debts or accept deferred payments for the purchase of property or services. A healthcare practice is a "creditor" organization if it first submits a claim for services to insurance and then bills any remaining amount to the patient after the claim is adjudicated. The FTC considers this to be a creditor arrangement since payment for goods and services is deferred until the claim is processed.

Patient billing records are "covered accounts" under the Red Flag Rules if they permit multiple payments or if they have a reasonable risk of identity theft.

The FTC does not believe that the Red Flag Rules will impose any significant burdens on most healthcare providers. Red Flag Rules are risk based and designed to be flexible based on the level of risk faced by each practitioner. The FTC states that: "...for most physicians in a low risk environment, an appropriate program might consist of checking a photo identification at the time services are sought and having appropriate procedures in place in the event the office is notified…that the consumer's identity has been misused."

What must a practice do?

Develop a written program and there are four steps to developing a compliant program:

1. Identify Red Flags
2. Detect Red Flags
3. Prevent and Mitigate Identity Theft
4. Update your program regularly

In addition, the program must spell out how it will be administered. The program should be appropriate to the size and complexity of your company or organization, as well as the nature of your operations.

According to the FTC, physician offices with covered accounts (see above) must develop a written program to identify the warning signs of identity theft. Below are the main categories of warning signs or "red flags" that your program must identify and address:

• Alerts, notifications, or warnings from a consumer reporting agency;
• Suspicious documents;
• Suspicious personally identifying information;
• Suspicious activity relating to a covered account; or
• Notices from customers, victims of identity theft, law enforcement authorities, or other entities about possible identity theft in connection with covered accounts.

When identifying red flags, consider the nature of your business and the type of identity theft to which you might be vulnerable. Because health care providers may be at risk for medical identity theft, you'll need to identify the warning signs that reflect this risk.

MORE INFORMATION
PayDC and TLC, in conjunction with The Martin Law Firm, has developed a policy manual to help practices comply with this rule. For more information regarding this program, contact us by sending an email to info@paydc.com or call 888-306-1256.

For advice from the FTC about complying with the Red Flag Rules, go to:
http://www.ftc.gov/bcp/edu/pubs/articles/art11.shtm

*NOTE: How you use PayDC Resources is subject to our Legal Notice.
Resources of PayDC do not constitute legal advice and do not establish a client-attorney relationship. If you have questions of a legal nature, you should contact a health care attorney. Read Legal Notice for more information.

PayDC is an innovative web-based software solution that is revolutionizing how chiropractors confidently create, explain, and manage the entire course of care to patients.

Now you can quickly develop highly detailed care plans, estimate insurance, customize payment plans from patient to patient, and even automate credit card processing -
all on one single platform.

PayDC – maximizing patient conversion, collections, compliance, and peace of mind.

Learn more

Contact us today to learn more about the system, and get a sneek-peek of how we're changing the industry!