Identity theft rule delayed to Aug. 1

The Federal Trade Commission has delayed enforcement of the “red flag” rule that requires certain businesses – including physicians’ practices – to implement identity-theft policies to Aug. 1.

The rule has slipped under the radar because many affected businesses are still unaware that they are likely to fall under the rule’s broad definition of “creditor.”

The three-month extension will give businesses more time to comply and make use of a model policy from the agency, said Betsy Broder, Assistant Director of the FTC’s Division of Privacy and Identity Protection.

“We realize a lot of companies are not in compliance, and we want to work with them to get them where they need to be by providing the resources and time,” said Broder.

She said that the model policy will allow entities at low risk of identity theft to “fill in the blanks” on the template in order to comply with the rule.

Experts warn that many businesses are still unprepared.

“Quite frankly, a lot of businesses are still just now realizing it applies to them because of the expansive definition of creditor. Retailers, health care providers and even law firms have been caught off-guard,” said Misty Speake of Atlanta, an associate involved with King & Spaulding LLP’s privacy initiative.

The American Medical Association argued that physicians should not be covered by the rule because they are already covered by HIPAA, but the FTC rejected that argument.
The FTC has created a website where it has published a how-to guidance on the rule.

This is the second time enforcement has been delayed in order to give businesses more time to comply. The original deadline was November 2008.