The American Medical Association (AMA), American Osteopathic Association (AOA) and the Medical Society of the District of Columbia (MSDC) filed a suit in federal court on May 21, 2010, seeking to prevent the Federal Trade Commission (FTC) from extending identity theft regulations to physicians.
The complaint targets the “red flags rule,” which requires creditors to implement safeguards against identity theft. The medical societies charge that the FTC’s rule exceeds the powers delegated to it by Congress and that its application to physicians is “arbitrary, capricious and contrary to the law.”
The suit follows two years of communications to the FTC from the AMA and AOA regarding the unintended consequences of the red flags rule. On January 27, the AMA and AOA joined other groups to petition the FTC to exclude physicians from the red flags rule. The FTC responded on March 25 saying it could not accommodate the request.
The Rule was developed under the Fair and Accurate Credit Transactions Act, in which Congress directed the FTC and other agencies to develop regulations requiring “creditors” and “financial institutions” to address the risk of identity theft. The resulting Red Flags Rule requires all such entities that have “covered accounts” to develop and implement written identity theft prevention programs to help identify, detect, and respond to patterns, practices, or specific activities – known as “red flags” – that could indicate identity theft.
The Rule became effective on January 1, 2008, with full compliance for all covered entities originally required by November 1, 2008. The Commission has issued several Enforcement Policies delaying enforcement of the Rule. Most recently, the Commission announced in October 2009 that at the request of certain Members of Congress, it was delaying enforcement of the Rule until June 1, 2010, to allow Congress time to finalize legislation that would limit the scope of business covered by the Rule. Since then, the Commission has received another request from Members of Congress for another delay in enforcement of the Rule beyond June 1, 2010.
“Congress needs to fix the unintended consequences of the legislation establishing the Red Flags Rule – and to fix this problem quickly. We appreciate the efforts of Congressmen Barney Frank and John Adler for getting a clarifying measure passed in the House, and hope action in the Senate will be swift,” FTC Chairman Jon Leibowitz said in the FTC news release. “As an agency we’re charged with enforcing the law, and endless extensions delay enforcement.”
If Congress passes legislation limiting the scope of the Red Flags Rule with an effective date earlier than December 31, 2010, the Commission will begin enforcement as of that effective date.