Optometry Coding & Billing Alert

Get to know new identity theft rules that many optometry practices overlook.

Your optometry practice follows all the HIPAA regulations, so youre doing all you need to do to protect your patients, right? Not so fast. Starting May 1, youll need to have a concrete plan in place to identify stolen information. Heres what you need to know.

Understand What the Red Flags Rule Is

On May 1, the Federal Trade Commission will begin enforcing its Red Flags Rule for ensuring that businesses crack down on identity theft. Under the Red Flags Rule, certain businesses and organizations -- including many doctors offices, hospitals, and other health care providers -- are required to spot and heed the red flags that often can be the telltale signs of identity theft, according to an article on the Federal Trade Commissions Web site. To comply with the new Red Flags Rule ... you may need to develop a written red flags program to prevent, detect, and minimize the damagefrom identity theft.

The regulation focuses on requiring all employers ...to make a good faith effort to thwart identity theft of employees, customers, and anyone they involve in business transactions, explains Ester Horowitz, MBA, owner/certified management counselor and practice marketing advisor with M2Power, Inc. in Merrick, N.Y.

Your Practice May Meet Creditor Criteria

According to the FTC, the rule applies to businesses that qualify as creditors or financial institutions. But that doesnt mean you can scratch the Red Flags Rule off your list of things to learn.

Health care providers are creditors if they bill consumers after their services are completed, the FTC Web site says. Health care providers that accept insurance are considered creditors if the consumer ultimately is responsible for the medical fees. However, simply accepting credit cards as a form of payment does not make you a creditor under the rule.

Where do you fit? Medical organizations are considered a creditor, Horowitz says. The word creditor has a broad meaning. Any health enterprise that maintains or otherwise possesses consumer information for a business purpose is required to follow the Red Flags Rule. When a patient doesnt pay you in full at the time of service and your practice waits for payment from a third-party payer, youre extending credit to the patient until the third-party payer processes the claim. Your practice is, therefore, a creditor.

Identify Risk Areas and Set Up a Solid Program

Now that you know your practice needs to follow the Red Flags Rule, how can you prepare? You should institute a Red Flag program in your practice, which youll need to revisit at least annually and more often as needed, advises Rebecca L.Williams, RN, JD, with Davis Wright Tremaine in Seattle.

The rule requires you to develop a report that youll submit to the board of directors (or to senior management), Williams says. This report should include addressing the effectiveness of the program as well as significant incidents and responses of the organization.

Bottom line: You should identify which areas fall within the identity theft recognition programs, meaning all departments, multiple sites, etc., and ensure that when youre developing your program, that it is designed to detect, react to, and mitigate identity theft.

How: Follow the federal sentencing guidelines, Horowitz advises. Teach your staff what identity theft is, she adds. We may not be able to stop it, but we can certainly make it tougher for it to occur. Provide employees with an employee benefit that offers monitoring, restoring, and legal support to further protect them. It doesnt require that the organization subsidize it. But by offering such a benefit, allowing your employees to make the decision to participate, and documenting that decision, your practice protects itself from litigation that might be brought against the practice as a result of identity theft in the future. Make patients aware of identity theft protection options available to them, if possible, as well, Horowitz adds.

Consequences: If your practice fails to meet the Red Flags Rule, youll potentially face federal and state fines of $2,500 per occurrence, civil liability of $1,000 per occurrence, class action lawsuits with no statutory limitation, and settlements making your practice responsible for actual losses of the individual identity theft victim.

While the fines pale in comparison to other regulations, the lawsuits with no statutory limitations and responsibility for loss get my attention, says Horowitz.

Monitor and Update Your Program

Once you have an identity theft program in place, review the program and its effectiveness regularly. In simplest terms, keep vigilant, Horowitz says.

If a report indicates that a program has serious flaws, it seems that the program should be revised to reduce risks of identity theft, Williams says. If the report indicates that all is well, then there may not need to be any updates at that time.

You dont necessarily have to revise your program each time you revisit it, but it seems likely that there will be some tweaks needed for any new program, Williams says. And a program will not be effective unless it is updated to keep up with internal and external developments.

Learn more: To read the FTCs advice about the rule, visit  www.ftc.gov/bcp/edu/pubs/articles/art11.shtm.