September 24, 2020

Volume X, Number 268

September 24, 2020

Subscribe to Latest Legal News and Analysis

September 23, 2020

Subscribe to Latest Legal News and Analysis

September 22, 2020

Subscribe to Latest Legal News and Analysis

"Red Flag Rules" May Impose Additional Administrative Requirements on Hospices

In 2007, the Federal Trade Commission ("FTC") issued the Red Flag Rules, which require financial institutions and other "creditors" that maintain "covered accounts" to develop and implement Identity Theft Prevention Programs. These Red Flag Rules may apply to health care providers, including hospices. The original deadline for creditors to comply with the Red Flag Rules was November 1, 2008, but this deadline has been extended to May 1, 2009.

A creditor is any entity that regularly extends, renews or continues credit; any entity that regularly arranges for the extension, renewal or continuation of credit; or any assignee of an original creditor who is involved in the decision to extend, renew or continue credit. A covered account is an account used mostly for personal, family or household purposes, and that involves multiple payments or transactions. A covered account is also an account for which there is a foreseeable risk of identity theft. Although some issues surrounding the definition of a creditor are not yet resolved, the FTC has taken the position that a health care provider that bills for services after they are rendered or that accepts insurance but holds the customer ultimately responsible for payment is a creditor subject to the Red Flag Rules.

A Red Flag is a pattern, practice or specific activity that indicates the possible existence of identity theft. Examples of Red Flags include instances when:

  • documents provided for identification appear to have been altered or forged;
  • information on the identification provided by a person is not consistent with information provided by that person when making a credit application;
  • an application appears to have been altered or forged or gives the appearance of having been destroyed and reassembled; and
  • a person opening a credit account fails to provide all required personal identifying information.

The Red Flag Rules require a covered entity to develop and implement a written Identity Theft Prevention Program to detect, prevent and mitigate identity theft in connection with the opening of a covered account or any existing covered account. The Red Flag Rules are flexible and  allow the creditor to develop a program that is appropriate to the size and complexity of a company and its nature and the scope of its activities. The program must include reasonable policies and procedures to do the following.

  • identify Red Flags;
  • detect Red Flags;
  • respond appropriately to any Red Flags that are detected to prevent and mitigate identity theft; and
  • ensure that the program is updated periodically to reflect changes in risks to customers and the business from identity theft.

Hospices should begin preparing to comply with the Red Flag Rules by developing an Identity Theft Prevention Program in advance of the May 1, 2009, deadline. Given the stringent HIPAA privacy requirements that hospices must now comply with, hospices may already have systems in place that satisfy some of the Red Flag Rules. In developing the required program, hospices should consider Red Flags most likely to present themselves in the hospice industry, such as claims that services billed for were not actually provided, claims that services were billed under the wrong patient name and claims that the party billed has been a victim of identity theft. Hospices should also incorporate procedures into their programs for carefully verifying insurance coverage information and change of address requests.

Although the details of each hospice’s program will vary based on the particular nature of each business, these guidelines should provide a starting point for developing the required Identity Theft Prevention Program. Hospice administrators should monitor the status of the Red Flag Rules in advance of the May 1, 2009, effective date and ensure that they have a program in place if there are no further delays in the application of the rules.

© 2020 Poyner Spruill LLP. All rights reserved.National Law Review, Volume , Number 225


About this Author

David L. Woodard, Employment Litigation Attorney, Poyner Spruill, Law firm

David practices in the area of employment litigation.  He regularly advises and defends clients in race, age, disability and sex discrimination and harassment cases; reviews handbooks and termination issues; and provides compliance advice on matters of employment law.

Representative Experience

McNeil v. Scotland County - Obtained summary judgment for employer where plaintiff alleged race discrimination and retaliation in violation of Title VII of the Civil Rights Act as well as violation of the Americans...

Kevin M. Ceglowski, Employment and Labor Lawyer, Poyner Spruill, Law Firm

Kevin represents employers in many areas of labor and employment law, including race, age, gender, religion, national original, and disability employment discrimination claims, wrongful discharge claims, and wage and hour claims. He defends clients before administrative agencies such as the Equal Employment Opportunity Commission, the Department of Labor, and the North Carolina Employment Security Commission, in state and federal courts, and in arbitrations. Kevin also provides guidance to management to ensure employment practices are in full compliance with all applicable statutes and regulations, including Title VII of the Civil Rights Act of 1964, the Americans with Disabilities Act, the Family and Medical Leave Act, the Age Discrimination in Employment Act, the Fair Labor Standards Act, and the Worker Adjustment and Retraining Notification Act.