Advanced Search

Home Health & Hospice Week

Patient Rights:

PREPARE FOR RED FLAGS RULE BY HEADING OFF IDENTITY THEFT

Published on Mon Feb 09, 2009

Most home care providers must comply with this surprising requirement by May 1.

On May 1, the Federal Trade Commission will begin enforcing its "Red Flags Rules" to ensure that businesses crack down on identity theft. Although many home care providers don't feel that these rules apply to them, the feds will likely feel otherwise.

Under the Red Flags Rule, "certain businesses and organizations -- including many doctor's offices, hospitals, and other health care providers -- are required to spot and heed the red flags that often can be the telltale signs of identity theft," according to an article on FTC's Web site (see Eli's HCW, Vol.XVIII, No. 1, p. 3). "To comply with the new RedFlags Rule ... you may need to develop a written 'red flags program' to prevent, detect, and minimize the damage from identity theft."

Entities found in violation of the rule may face up to $2,500 per violation, the FTC says. The Commission pushed back the compliance date for health care providers six months from the original Nov. 1, 2008 deadline.

Are you affected? According to the FTC, the rule applies to businesses that qualify as "creditors" or "financial institutions." But don't heave a sigh of relief just yet -- there's a good chance the rule applies to you.

"Health care providers are creditors if they bill consumers after their services are completed," the FTC Web site says. "Health care providers that accept insurance are considered creditors if the consumer ultimately is responsible for the medical fees.However, simply accepting credit cards as a form of payment does not make you a creditor under the rule."

Start preparing: You should institute a red flags program in your organization, which you'll need to revisit at least annually and more often as needed, advises attorney Rebecca L. Williams with Davis Wright Tremaine in Seattle.

The rule requires you to develop a report that you'll submit to the board of directors or to senior management, Williams says. "This report should include addressing the effectiveness of the program as well as significant incidents and responses of the organization."

Bottom line: You should identify which areas fall within the identity theft prevention programs, meaning all departments, multiple sites, etc.,and ensure that when you're developing your program,that it is designed to detect, prevent, and mitigate identity theft, says Barbara Colburn, director of operations for a billing service in Wisconsin, and president of Total Health Care Solutions, a healthcare consulting firm in Wisconsin.

Updates: "If a report indicates that a program has serious flaws ... the program should be revised to reduce risks of identity theft," Williams says. "If the report indicates that all is well, then there may not need to be any updates at that time."

You don't necessarily have to revise your program each time you revisit it, but "it seems likely that there will be some tweaks needed for any new program," Williams says. "And, a program will not be effective unless it is updated to keep up with internal and external developments."

Other Articles in this issue of

Home Health & Hospice Week

View All