Medicare Compliance & Reimbursement

May 1 has come and gone -- and some practices haven't yet prepared for the government's Red Flags Rule, which was due to go into effect by then. However, CMS offers a gift to those practices that procrastinated with a three-month extension, now making the Red Flags Rule effective on Aug. 1.

On April 30, the Federal Trade Commission, which oversees the government's implementation of the Red Flags Rule, announced the time extension, and also noted that "for entities that have a low risk of identity theft, such as businesses that know their customers personally, the Commission will soon release a template to help them comply with the law."

Background: Under the Red Flags Rule, certain businesses -- including healthcare practices that bill patients after their services are completed -- are required to spot and heed the red flags that can be the signs of identity theft, the FTC says.

The rule requires practices to develop a program that addresses identity theft prevention techniques, as well as tools to detect and deal with any identity theft incidents that may occur.

Many medical practices were unclear about how the rule affected them. Once they realized they fell under the rule's purview, many were slow to implement programs. The three-month extension allows those practices extra time to get their programs together.

"Given the ongoing debate about whether Congress wrote this provision too broadly, delaying enforcement of the Red Flags Rule will allow industries and associations to share guidance with their members, provide low-risk entities an opportunity to use the template in developing their programs, and give Congress time to consider the issue further," said FTC Chairman Jon Leibowitz in the April 30 statement.