Measure requiring identity theft prevention programs delayed for fifth time; new deadline is Dec. 31

For the fifth time, the Federal Trade Commission (FTC) last week again extended its enforcement deadline for a regulation that requires creditors - such as hospitals - to implement written identity theft prevention policies.

The new "red flags rule" enforcement deadline is Dec. 31, 2010, instead of June 1, 2010.

Under the rule, organizations that extend credit and have certain types of "accounts" must implement practices to detect and respond to "red flags" that might indicate identity theft has occurred. A red flag, for example, could be a debtor who presents identification documents that appear to have been altered or debtor photographs that are not consistent with the debtor's appearance.

The original deadline for the measure was Nov. 1, 2008. As in the past, the FTC said the latest extension was requested by members of Congress.

The delay will allow Congress time to consider legislation that would affect the scope of entities covered by the rule. Some congressional leaders have said that the FTC was interpreting the rule as applying to organizations it was not meant to, such as health care providers.

A Minnesota Hospital Association (MHA) template policy for members to use to draft their own identity theft prevention policies is available here: DOC.

Also, the FTC has provided guidance through materials posted on www.ftc.gov/redflagsrule and in speeches and seminars.

For more information, contact Matt Anderson, MHA vice president regulatory and strategic affairs, at (651) 659-1421.