Red Flags Rule: The FTC piles on, because HIPAA, ARRA and overlapping state laws just weren't enough
After a couple of delays, the FTC Red Flags Rule will be effective August 1, 2009. This rule requires "creditors" under certain "covered accounts" to maintain a heightened alertness to numerous categories of "red flags" that may indicate that the consumer who is the rightful account holder is the victim of identity theft. If a red flag is triggered, the creditor must take steps to notify the consumer and correct any inappropriate information included the creditor's records.
As you probably already know, the FTC is extending its reach with this rule (among others) into the health care sector. (Cf. the FTC's role in enforcing certain Son of HIPAA provisions.) The AMA has all but dropped a draft complaint on the FTC's desk, citing assorted legal precedents in its correspondence with the FTC arguing that the Red Flags Rule should not apply to physician practices. The FTC is unmoved -- except to the extent that it has been willing to delay the effective date twice (from November 2008 to May 2009 to August 2009).
At any rate, the August 1 effective date is around the corner, and affected health care entities need to develop and implement compliance plans now, if they haven't already. (Even the AMA says so, and has published guidance and a sample policy for members.)
A few more general comments before stepping back and examining the language of the rule and its applicability to health care providers.
The federales are taking something of a common-sense approach here, recognizing that a compliance plan needs to be tailored to the specific entity, the nature of its "covered accounts" and its operations. Bank of America, N.A. and Springfield Medical Associates, P.C. will have very different compliance plans, because their potential red flags and the potential risks are vastly different.
Affected health care providers need to understand that the Red Flag Rule requirements overlap with HIPAA and state privacy law requirements (and looming Son of HIPAA requirements in ARRA), but will not be satisfied by implementation of existing privacy policies and compliance plans. Review of the intersection of existing policies and procedures with the new rule's requirements is the first order of business.
As with any other new regulatory scheme, preparing a compliance plan and putting it on the shelf won't cut it. The rule calls for regular monitoring of the plan and issues that arise by a senior manager. Furthermore, best practices would dictate the training of staff to deal with individual issues and, most importantly, with the affected consumers.
Even if not clearly subject to the Red Flags Rule, providers should undertake to comply, for a couple of interrelated reasons:
- Good patient PR. Data security is top of mind these days. Much of the effort required under the rule should be expended anyway simply to respond to market pressures calling for improved data security.
- Potential liability. The creative trial attorney will seek to use the Red Flags Rule as establishing a standard of care for the stewardship of personal information. The incensed jury will go along. The health care provider caught in the middle between thieves and victims may be the only perceived deep pocket available.
OK, so what is a "creditor" and what is a "covered account?"
Any entity that accepts payment other than payment in full at the time of service is a creditor. Health care providers that go the cash-on-the-barrelhead route aren't creditors; all others are creditors.
The FTC Guide defines covered accounts as follows: either
- a consumer account you offer your customers that’s primarily for personal, family, or household purposes that involves or is designed to permit multiple payments or transactions; or
- any other account that a financial institution or creditor offers or maintains for which there is a reasonably foreseeable risk to customers or to the safety and soundness of the financial institution or creditor from identity theft, including financial, operational, compliance, reputation, or litigation risks.” Examples include small business accounts, sole proprietorship accounts, or single transaction consumer accounts that may be vulnerable to identity theft. Unlike consumer accounts designed to permit multiple payments or transactions – they always are “covered accounts” under the Rule – other types of accounts are “covered accounts” only if the risk of identity theft is reasonably foreseeable.
Any creditor with covered accounts must have a red flags rule compliance plan in place with policies and procedures for dealing with "red flags" -- i.e., signs that personal information may have been compromised. The World Privacy Forum suggests that the following red flags are the ones most applicable in the health care context:
o a bill for another individual
o a bill for a product or service that the patient denies receiving
o a bill from a health care provider that the patient never patronized or
o a notice of insurance benefits (or Explanation of Benefits) for health services never received.
• Records showing medical treatment that is inconsistent with a physical examination or with a medical history as reported by the patient.
• A complaint or question from a patient about the receipt of a collection notice from a bill collector.
• A patient or insurance company report that coverage for legitimate hospital stays is denied because insurance benefits have been depleted or a lifetime cap has been reached.
• A complaint or question from a patient about information added to a credit report by a health care provider or insurer.
• A dispute of a bill by a patient who claims to be the victim of any type of identity theft.
• A patient who has an insurance number but never produces an insurance card or other physical documentation of insurance.
• A notice or inquiry from an insurance fraud investigator for a private insurance company or a law enforcement agency.
If a situation is flagged, a creditor must take steps to mitigate the risk of identity theft or continued identity theft. Again, the World Privacy Forum notes:
There need to be uniform but appropriately flexible answers to these questions:
- What do we do when a patient claims fraud is in their files?
- What do we do when a patient says the bills are for services she did not receive?
- What do we do for patients and other impacted victims when we uncover a fraudulent operation?
- When we have a real case of medical identity theft, how can we work with patients to fix the records and limit future damages?
- What do we do when a provider has altered the patient records?
- How do we handle police reports and requests for investigation from victims?
The answers to these questions need to viewed not just from the provider’s perspective, but also from the victim’s perspective, which can differ substantially.
There are a number of useful resources available for health care providers seeking to take stock of their situation, establish Red Flags Rule compliance policies and procedures, and undertake staff training on the subject. For example, the FTC, the AMA and the World Privacy Forum have all released valuable guidance documents (all linked to above) that would assist any organization with coming into compliance.
As with any effort of this sort, it is often valuable to have someone outside the organization come in to review existing policies, procedures and workflow in order to highlight potential risks and opportunities for improvement. The HealthBlawger and members of the HealthBlawger's virtual consulting network are available to come in and assess, plan and help implement compliance strategies for organizations large and small touched by the Red Flags Rule.
Whatever the size or nature of your business, please take a moment to consider how the Red Flags Rule may apply to its operations, and how it may relate to other regulatory schemes such as HIPAA and state laws.
David Harlow
The Harlow Group LLC
Health Care Law and Consulting
