The Federal Trade Commission will wait another three months to enforce the regulation known as the “red flags" rule—a second reprieve announced on the eve of today’s deadline, itself pushed back from Nov. 1, 2008.
The rule requires financial institutions and creditors to adopt written policies identifying what indicators in their operations might signal identity theft and policies and procedures to watch for and respond to them.
The original enforcement delay came in response to a number of sectors, particularly hospitals and physicians who didn’t realize or agree that they should be covered by the rule, which comes from the Fair and Accurate Credit Transactions Act of 2003. The FTC interpreted the law to cover hospitals because they allow patients to pay their bills on installment plans and both physicians and hospitals because they collect billing information and copayments when services are rendered, billing later for balances owed.
In an April 30 news release new FTC Chairman Jon Leibowitz acknowledged their argument, saying more time is warranted “given the ongoing debate about whether Congress wrote this provision too broadly.” Earlier in April, the FTC posted a Web site and how-to guide on the rule.
