I am amazed that medical practices still have the time to see and treat patients. Between complying with the HIPAA Privacy and Security Rules, implementing EMRs, working on stimulus reimbursements, checking for patient pre-authorization, battling insurance companies over reimbursement rates and the whole medical billing process; it is amazing that there is time left to treat patients. So with that said let’s look forward to June 1, 2010 when medical practices have to worry about the Federal Trade Commission’s (FTC) Red Flag Rule.
According to the American Medical Association (AMA) the Red Flag rule has been delayed many times before.
In Nov. 2007, the Federal Trade Commission (FTC) issued a set of regulations, known as the “Red Flags Rule,” requiring that certain entities develop and implement written identity theft prevention and detection programs to protect consumers from identity theft. Originally scheduled for a Nov. 1, 2008 compliance date, the FTC has now delayed the enforcement date of the Red Flags Rule until June 1, 2010. The new compliance date of June 1, 2010, which follows three earlier extensions to May 1, August 1 and then later to Nov. 1, is a result of continued advocacy by the AMA and others who continue to object to the applicability of this Rule to health care providers and other professionals.
In an AMA editorial on March 15, 2010 they argue that the FTC is improperly applying rules, that are normally enforced on the banking industry, to medical practices.
As of June 1, physician practices are supposed to have written identity-theft and detection programs in place to satisfy what is commonly known as the red flags rule. The FTC aimed the regulation at what it referred to as “creditors,” meaning, generally, banks and credit-card companies, to protect consumers’ account information from being misused.
Only months before the original Oct. 1, 2008, deadline for compliance, the FTC said physicians must comply with the red flags rule because, by virtue of billing and collecting payments only after services were completed, they also were “creditors.” This, despite the FTC’s final rule, in June 2008, making no mention of physicians, and only a single reference to medical identity theft.
The claims payment process is not a deferral process, a way to extend credit to patients. Instead, it simply reflects the realities under which doctors have legal, ethical and contractual obligations under federal and state laws that govern insurance relationships. Generally, a physician is barred from requiring that certain payment conditions be met upfront before treatment. So does the FTC think physicians can, and should, demand money upfront so they are no longer considered creditors?
It looks like the AMA will continue to push back on the FTC but for now June 1, 2010 is the date to start implementing procedures to comply with the Red Flag rule. The AMA has published a sample policy that can be customized to your practice. So add another policy, procedure and government regulation to the list of things to worry about.
