The Federal Trade Commission (FTC) has announced that it will delay enforcement of the Red Flags Rule until June 1, 2010. This extension of the enforcement deadline, which came at the request of several Congress members, is the fourth such delay. The Rule was originally to be enforced starting on November 1, 2008. The Red Flags Rule requires “creditors” and financial institutions to develop and implement written identity theft prevention programs. Its application to certain professionals and small businesses has proven controversial.

The Red Flags Rule provides that identity theft prevention programs must be designed to help identify, detect and respond to patterns, practices or specific activities, known as “red flags,” that could signal an incident of identity theft. For purposes of the Rule, a “creditor” is any person who regularly extends, renews or continues credit, or who regularly arranges for the extension, renewal or continuation of credit. This includes all entities that regularly permit deferred payments for goods or services.

The breadth of this definition, and the scope of entities and industries therefore required to develop and implement written identity theft prevention programs, has been a source of ongoing debate. For example, on October 20, 2009, the U.S. House of Representatives passed H.R. 3763, which would exclude from the definition of “creditor”: (1) a health care, accounting, or legal practice with 20 or fewer employees, or (2) any other business that the FTC determines knows all of its customers or clients individually, only performs services in or around the residences of its customers, or has not experienced incidents of identity theft, and for which type of business identity theft is rare. The bill has been received by the U.S. Senate and referred to its Committee on Banking, Housing, and Urban Affairs. Also, on October 30, 2009, the U.S. District Court for the District of Columbia ruled that the FTC could not enforce the Red Flags Rule against attorneys, who regularly provide services prior to requiring payment.

It is important to note that this delay in enforcement, like the previous ones, applies only to the Red Flags Rule requiring the development and implementation of written identity theft prevention programs. It does not apply to related rules applicable to users of consumer reports and to credit and debit card issuers requiring certain responses to changes of address and address discrepancies. Similarly, the delay in enforcement only applies to entities subject to the FTC’s jurisdiction; it does not affect institutions subject to the oversight of the federal bank regulatory agencies or the National Credit Union Administration.

For further information, please contact Michael P. Davidson or your regular Hinshaw attorney.

This alert has been prepared by Hinshaw & Culbertson LLP to provide information on recent legal developments of interest to our readers. It is not intended to provide legal advice for a specific situation or to create an attorney-client relationship.

Hinshaw & Culbertson LLP is Pleased to Announce its 2009 Health Care Conference

Friday, November 13, 2009
9:00 a.m. to 4:00 p.m.

Hilton Lisle/Naperville
3003 Corporate West Drive
Lisle, Illinois

Now in its fifth year, the conference will offer both plenary and breakout sessions. Join Senior Management, Board Members and In-House Counsel of Hospitals and Health Systems as our presenters examine and analyze current issues and strategies affecting the health care industry.

Plenary Sessions

• Health Care Reform
• Self-Disclosure

Breakout Sessions

• The Impact of Stark on Hospital/Physician Relations
• Managed Care Law
• The Medicare Provider-Based Rules and the Illinois Medicaid Dilemma
• Electronic Medical Record Stimulus Opportunities
• Updating Hospital and Physician Compliance Plans
• Hot Topics

Hinshaw & Culbertson LLP is an accredited CLE provider in Illinois. Illinois attorneys can earn 4.25 general CLE credit hours for attending the conference.

There will be a $95 non-refundable fee to attend this conference.

Register online by clicking on the following link: https://www.regonline.com/hinshawhcconference

For more information, contact Katherine McCormack at 312-704-3329.