Medicare Compliance & Reimbursement

On May 1, the Federal Trade Commission will begin enforcing its "Red Flags Rules" to ensure that businesses crack down on identity theft. Although many home care providers don't feel that these rules apply to them, the feds will likely feel otherwise.

Under the Red Flags Rule, "certain businesses and organizations -- including many doctor's offices, hospitals, and other health care providers -- are required to spot and heed the red flags that often can be the telltale signs of identity theft," according to the FTC's Web site. "To comply with the new Red Flags Rule ... you may need to develop a written 'red flags program' to prevent, detect, and minimize the damage from identity theft."

Entities found in violation of the rule may face up to $2,500 per violation, the FTC says. The Commission pushed back the compliance date for health care providers six months from the original Nov. 1, 2008 deadline.

Are you affected? According to the FTC, the rule applies to businesses that qualify as "creditors" or "financial institutions." But don't heave a sigh of relief just yet -- there's a good chance the rule applies to you.

"Health care providers are creditors if they bill consumers after their services are completed," the FTC Web site says. "Health care providers that accept insurance are considered creditors if the consumer ultimately is responsible for the medical fees. However, simply accepting credit cards as a form of payment does not make you a creditor under the rule."

Get started: You should institute a red flags program in your organization, which you'll need to revisit at least annually and more often as needed, advises attorney Rebecca Williams with DavisWright Tremaine in Seattle.

The rule requires you to develop a report that you'll submit to the board of directors or to senior management, Williams says. "This report should include addressing the effectiveness of the program as well as significant incidents and responses of the organization."

Bottom line: You should identify which areas fall within the identity theft prevention programs, meaning all departments, multiple sites, etc., and ensure that when you're developing your program, it is designed to detect, prevent, and mitigate identity theft, says Barbara Colburn, director of operations for a billing service in Wisconsin, and president of Total Health Care Solutions, a healthcare consulting firm in Wisconsin.

Updates: "If a report indicates that a program has serious flaws ... the program should be revised to reduce risks of identity theft," Williams says. "If the report indicates that all is well, then there may not need to be any updates at that time."