The Federal Trade Commission has broadened its interpretation of “providing credit”. The result is that most medical practices are now going to be subject to the Red Flags rules that were developed to combat identity theft in the financial services arena. Despite vigorous AMA dissent, the FTC has insisted that this regulatory burden be extended to medical providers.

The FTC now includes any medical practice that does not collect payment in full at the time of service ( i.e., if you bill an insurance carrier) among business entities that extend credit to the public. This interpretation means that medical practices must now develop written policies to prevent identity theft. They must also now contact patients if certain circumstances suggesting identity problems present themselves. They are supposed to train their staff members to recognize the “red flags” which suggest that a patient’s identity has been stolen or that an individual at the front desk might not be the person they purport to be.

The FTC’s May 1, 2009, enforcement date adds a third layer of privacy protection regulations that physicians and their staff members are expected to master. HIPAA, recently expanded as part of the stimulus package, and Tennessee’s privacy rules already addressed many of these issues.

No one favors careless use or disclosure of medical records. Everyone wants to do what they can to make identity theft more difficult. But you have to wonder if yet another, sometimes inconsistent, set of rules is the best way to accomplish the goal. Many physicians see this as just another distraction from patient care.

thoughts by:  Edward Carter 

Edward is a medical practice consultant with DVF Medical Practice Services.  He lives in Murfreesboro, Tennessee, with his wife and two children.