"Red Flag Rules" May Impose Additional Administrative Requirements on Hospices

In 2007, the Federal Trade Commission ("FTC") issued the Red Flag Rules, which require financial institutions and other "creditors" that maintain "covered accounts" to develop and implement Identity Theft Prevention Programs. These Red Flag Rules may apply to health care providers, including hospices. The original deadline for creditors to comply with the Red Flag Rules was November 1, 2008, but this deadline has been extended to May 1, 2009.

A creditor is any entity that regularly extends, renews or continues credit; any entity that regularly arranges for the extension, renewal or continuation of credit; or any assignee of an original creditor who is involved in the decision to extend, renew or continue credit. A covered account is an account used mostly for personal, family or household purposes, and that involves multiple payments or transactions. A covered account is also an account for which there is a foreseeable risk of identity theft. Although some issues surrounding the definition of a creditor are not yet resolved, the FTC has taken the position that a health care provider that bills for services after they are rendered or that accepts insurance but holds the customer ultimately responsible for payment is a creditor subject to the Red Flag Rules.

A Red Flag is a pattern, practice or specific activity that indicates the possible existence of identity theft. Examples of Red Flags include instances when:

• documents provided for identification appear to have been altered or forged;
• information on the identification provided by a person is not consistent with information provided by that person when making a credit application;
• an application appears to have been altered or forged or gives the appearance of having been destroyed and reassembled; and
• a person opening a credit account fails to provide all required personal identifying information.

The Red Flag Rules require a covered entity to develop and implement a written Identity Theft Prevention Program to detect, prevent and mitigate identity theft in connection with the opening of a covered account or any existing covered account. The Red Flag Rules are flexible and  allow the creditor to develop a program that is appropriate to the size and complexity of a company and its nature and the scope of its activities. The program must include reasonable policies and procedures to do the following.

• identify Red Flags;
• detect Red Flags;
• respond appropriately to any Red Flags that are detected to prevent and mitigate identity theft; and
• ensure that the program is updated periodically to reflect changes in risks to customers and the business from identity theft.

Hospices should begin preparing to comply with the Red Flag Rules by developing an Identity Theft Prevention Program in advance of the May 1, 2009, deadline. Given the stringent HIPAA privacy requirements that hospices must now comply with, hospices may already have systems in place that satisfy some of the Red Flag Rules. In developing the required program, hospices should consider Red Flags most likely to present themselves in the hospice industry, such as claims that services billed for were not actually provided, claims that services were billed under the wrong patient name and claims that the party billed has been a victim of identity theft. Hospices should also incorporate procedures into their programs for carefully verifying insurance coverage information and change of address requests.

Although the details of each hospice’s program will vary based on the particular nature of each business, these guidelines should provide a starting point for developing the required Identity Theft Prevention Program. Hospice administrators should monitor the status of the Red Flag Rules in advance of the May 1, 2009, effective date and ensure that they have a program in place if there are no further delays in the application of the rules.