In this article, you will find the basic information you need to know about the “Red Flags” Rule and resources that will help you efficiently implement an appropriate compliance plan.

The Basics

According to the FTC’s publication, “Fighting Fraud with the Red Flags Rule: A How-To Guide for Business,” the “Red Flags” Rule, in effect since January 2008, “requires many businesses and organizations to implement a written Identity Theft Prevention Program designed to detect the warning signs – or “red flags” – of identity theft in their day-to-day operations, take steps to prevent crime, and mitigate the damage it inflicts. By identifying red flags in advance, they will be better equipped to spot suspicious patterns when they arise and take steps to prevent a red flag from escalating into a costly episode of identity theft.”

From a healthcare perspective, medical identity theft happens when a person seeks health care using someone else’s name or insurance information. According to the FTC, almost 5 percent of identity theft victims have experienced some sort of medical identity theft resulting in significant costs to both the patient and the providers.

Are you a “Creditor?”

The “Red Flags” Rule only applies to you if you meet the criteria for being a creditor. According to Steven Toporoff, an attorney with the FTC’s Division of Privacy and Identity Protection, the law defines “creditor” as any entity that regularly defers payments for goods or services or arranges for the extension of credit. In a May article on the FTC website (http://www.ftc.gov/bcp/edu/pubs/articles/art11.shtm ) Toporoff states:

You are a creditor if you regularly bill patients after the completion of services including the remainder of medical fees not reimbursed by insurance; Health care providers who regularly allow patients to set up payment plans after services have been rendered are considered to be creditors; Healthcare providers are considered creditors if they help patients get credit from other sources (i.e. distribute and process applications for credit accounts tailored to the healthcare industry); Healthcare providers who require payment before or at the time of service are not creditors; If you accept only direct payment from Medicaid or similar programs where the patient has no responsibility for the fees, you are not considered to be a creditor.

Another term in addition to creditor that you must consider is “covered account.” The FTC defines a “covered account” as a consumer account that allows multiple payments or transactions or any other account with a reasonably foreseeable risk of identity theft. With that definition in mind, the accounts you establish for your patients are generally considered to be “covered accounts.”

Therefore, if you meet the criteria for a “creditor” and your patients have what are considered to be “covered accounts,” you must develop a written Identity Theft Prevention Program.

Fortunately, the AMA and several other healthcare organizations have done most of the work for you by creating template-based compliance guidelines/programs. Here are some links to these resources. Use them to efficiently, effectively and easily comply with the “Red Flags” Rule.

Go to the Resource page on the Efficiency in Practice website for:

AMA Red Flags Rule Guidance Document:

AMA: Sample Policy

(Note: AMA member’s can access the Word version of the Sample Policy (Word) and adapt it to their individual practice.)

The MGMA has many “Red Flags” resources available (some only to MGMA members including a 30-minute Red Flags Rule Webinar).

Additionally, if you have a specific question about the “Red Flags” Rule, you can email redflags@ftc.gov.

© 2009 Efficiency in Practice

Duane Abbey, whose recent audio conference, “Achieve Red Flag Compliance,” gave medical professionals a hold on this new federal compliance requirement said, “To do this, use a risk assessment process, review prior experiences, and investigate the Federal Register.

First, assess these common risk factors of health care for identity theft: the types of accounts that have been established by the patients with you; verification of patient’s identity by the insurance company; and the steps you take when opening an account for a patient.

Review prior experiences that your facility or practice might have had regarding identity theft issues. Look at the details whether you got paid or not, or if you had to make any adjustments in medical records regarding such issues.

Abbey cited few examples related to issues that could be red flags for identity thefts, from the Federal Register Supplement A to Appendix J:

Alerts, warnings or notifications from a consumer reporting agency
Suspicious personal identifying information and documents
Suspicious activity related to, the covered account
Notice from customers, law enforcement authorities, victims of identity theft or others.
Mail sent to your patient is returned repeatedly as undeliverable, even though transactions continue to take place on his or her accountAbbey also provided some examples of red flags specific to healthcare providers:
Thoroughly check insurance documents compared to drivers licenses and your records for address differences
Check for mismatch between the individual and his photograph.
Ensure that the address mentioned is true and it exists.
Make sure you have a working and existing telephone number for patients.
Check for medical record inconsistencies: sometimes there may be differences between the records you maintained and what the patients reports.
Make sure that the patients have a legitimate insurance card.
If your patient claims that he received a notice of an insurance payment for services that were not provided to him. Pay attention to it.