On December 8, 2010, the U.S. House of Representatives passed the Red Flag Program Clarification Act of 2010 (RFPCA), clarifying the scope of the FTC's Red Flags Rule. The amendment has the effect of excluding professionals such as doctors, lawyers, and accountants from the Red Flags Rule. The bill also has been approved by the Senate, and awaits signature by President Obama, which is likely to occur.
The RFPCA clarifies the meaning of the term "creditor" for purposes of the Red Flags Rule. The Red Flags Rule is designed to protect consumers from identity theft by requiring "creditors" covered under the Rule to establish written policies and procedures to identify risks of identity theft to their customers. Previously, the FTC has broadly interpreted who is covered by the Rule, bringing professionals such as lawyers, doctors, accountants, and others under the Rule because they bill for services after the services have been performed. A number of professional organizations, including the American Bar Association and American Medical Association, challenged the FTC's interpretation. The FTC delayed enforcement of the Rule several times, with the latest enforcement deadline being December 31, 2010.
The amended definition of "creditor" makes the Rule applicable only to those who (1) regularly and in the ordinary course of business obtain or use consumer reports in connection with a credit transaction; (2) furnish information to consumer reporting agencies in connection with a credit transaction; or (3) advance funds to or on behalf of a person, based on an obligation of the person to repay the funds. Further, the RFPCA now exempts creditors that advance funds on behalf of a person for expenses incidental to a service provided by the creditor to that person. This exemption applies to doctors, lawyers, and other professionals, except to the extent that they furnish information to consumer reporting agencies in connection with a credit transaction. It is unclear how this exemption applies to other health care providers, such as hospitals. Finally, the RFPCA allows the FTC to determine in the future whether there are certain types of creditors that offer or maintain accounts subject to a reasonably foreseeable risk of identify theft, thereby requiring those types of creditors to comply with the Red Flags Rule.
In passing the RFPCA, Congress desired to exempt professionals and small businesses that provide products and services in advance and require payment from the customer at a later time. While technically this type of business becomes a "creditor" as that term is generally used, with passage of the RFPCA, Congress clarified that those types of creditors do not need to comply with the Red Flags Rule, and therefore do not need to implement an identify theft program, which could be costly and burdensome. In statements supporting passage of the RFPCA, Senator Christopher Dodd (D.-Conn.) and Senator Mark Begich, (D.-Alaska) stated the RFPCA clarifies that attorneys, doctors, accountants, and other professionals and small businesses, will not be classified as creditors covered under the Rule merely because they provide services and bill clients, patients, and customers for payment at a later time.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.