You have until the new year to get your identity theft plan in order. Your Red Flags Rule plan may be good for your patients, but it probably won't help your regulatory status for a while yet. That's because the Federal Trade Commission has delayed enforcement of the rule requiring creditors, including most health care providers, to have an identity theft prevention program in place. The delay until Dec. 31 comes on the heels of a lawsuit by the American Medical Association and other physician trade groups arguing the FTC is incorrectly applying the law to docs (see Eli's HCW, Vol. XIX, No. 20, p. 158). The FTC was originally supposed to enforce the Red Flags Rule starting Nov. 1, 2008. The FTC made the most recent delay at the request of members of Congress, who are preparing legislation to clear up who is subject to the regulation, the agency says. "Congress needs to fix the unintended consequences of the legislation establishing the Red Flags Rule -- and to fix this problem quickly," FTC Chairman Jon Leibowitz says in a release. "As an agency we're charged with enforcing the law, and endless extensions delay enforcement." The National Association for Home Care & Hospice "has sought an exemption from Red Flags Rule requirements for home health, hospice, and durable medical equipment suppliers that are small businesses," the trade group notes. NAHC has urged the FTC "to recognize these businesses as not meeting the definition of 'creditor' to whom Congress intended that the requirements apply," it says. More information about the rule is at www.ftc.gov/redflagsrule.