Compliance Requirements
The Rule requires Creditors to develop and implement an Identity Theft Prevention Program ("Program") that identifies, detects, and responds to activities that could indicate identity theft. These Red Flag activities may include, for example, unusual account activity, fraud alerts on a consumer report, or attempted use of suspicious account application documents. The second element is the development and implementation of policies and procedures designed to detect Red Flags. The third element of the Rule requires the Program have appropriate responses to prevent and mitigate the crime. The fourth element is the development and implementation of policies and procedures to reassess and update the Program periodically. A Creditor should review the Program to determine if the list of Red Flags included in need to be amended as a result of changing risks of identity theft. Finally, the Program must be managed by a Creditor's board of directors or senior employee, include appropriate staff training, and provide for oversight of any service providers with whom the Creditor contracts.
Conclusion
Although compliance with the Rule was technically mandatory as of November 1, 2008, the FTC has granted entities subject to its jurisdiction a six-month forbearance period (ending on May 1, 2009) before it will begin enforcement of the Rule. The FTC also recently announced that effective February 9, 2009, its civil monetary penalties for violations of the FCRA, including the Rule, have increased to $3,500 per violation.
Diane Carter is Board Certified in Health Care Law by the Texas Board of Legal Specialization. Ms. Carter has over 17 years of legal experience representing a variety of clients transacting business in the health care industry. Ms. Carter's representation of these clients includes advising on transactional, regulatory, and compliance matters.
Daniel Sternthal practices in the Health Care group at Brown McCarroll. He represents health care providers across the continuum of care. Representation of these clients includes advising on corporate, business, licensing and regulatory matters.
*Note: A previous version of this article indicated an enforcement date of May 1, 2009. That has been delayed three months.Back to HCB News
