Health Information Compliance Alert

You now have until August 1 to prepare -- but you'll need all of that time if you haven't started yet.

May 1 has come and gone -- and some practices haven't yet prepared for the government's Red Flags Rule, which was due to go into effect by then. However, CMS offers a gift to those practices that procrastinated, with a three-month extension, now making the Red Flags Rule effective on Aug. 1.

On April 30, the Federal Trade Commission, which oversees the government's implementation of the Red Flags Rule, announced the time extension, and also noted that "for entities that have a low risk of identity theft, such as businesses that know their customers personally, the Commission will soon release a template to help them comply with the law."

Background: Under the Red Flags Rule, certain businesses -- including healthcare practices that bill patients after their services are completed -- are required to spot and heed the red flags that can be the signs of identity theft, the FTC says.

The rule requires practices to develop a program that addresses identity theft prevention techniques, as well as tools to detect and deal with any identity theft incidents that may occur.

Many medical practices were unclear about how the rule affected them, and once they realized they fell under the rule's purview, many were slow to implement programs.

The three-month extension allows those practices extra time to get their programs together.

"Given the ongoing debate about whether Congress wrote this provision too broadly, delaying enforcement of the Red Flags Rule will allow industries and associations to share guidance with their members, provide low-risk entities an opportunity to use the template in developing their programs, and give Congress time to consider the issue further," said FTC Chairman Jon Leibowitz in the April 30 statement.

Although the three-month extension is good news, if you are among the procrastinators, it's really time to get on board and begin developing your practice's plan.

"Considering that you have to write the plan, get it approved by your practice's board of directors, make potential edits, and then share it with your staff, August 1 is not that far away," advises says Allison Larro, Esq., an Atlanta attorney.

Resource: For more information about the FTC's time extension on the Red Flags Rule, visit www.ftc.gov/opa/2009/04/redflagsrule.shtm.