Red Flag Rules and the Practice of Medicine
Red Flags Rules require financial institutions and businesses that give credit to consumers to establish some sort of program or procedure to identify customers who may be involved in identity theft. Since most medical providers provide medical services and allow the patient to pay their bill at a later time, and in concert with insurance benefits, the FTC intends to treat medical practice as a “creditor” and thus come within the scope of Red Flag rules. “Creditor” is defined by this law as any business or organization that defers payments for goods or services.”

On May 21, 2010 the American Medical Association (AMA) filed suit against the Federal Trade Commission (FTC) to exclude medical practices from red flag - identify-theft - regulations.
The AMA argues that physicians are forced by the realities of practicing medicine to defer payment for medical services rendered and that it “would violate the norms of human decency, not to mention principles of ethical conduct...for a physician to demand payment at the time of service in such situations." This argument will not fly too far. The FTC is not forcing physicians to cease the custom of deferring payment, only that reasonable procedures be established to “red flag” potential or suspicious patients who may be involved in committing identity theft. The FTC says red flags rules are needed to prevent “medical” identity theft.
At this point, we must determine what would have to be done in order to identify or red flag a suspicious patient and whether or not it would interfere with a practice of medicine. The ethical problem in imposing red flag obligations on physicians is that it may set up an adversarial relationship between patient and physician. Questions would have to be asked by physicians or office staff to investigate suspicious account activities, suspicious identification, and so on. If some suspicion is aroused the medical office would arguably be required to contact some law enforcement entity or FTC or the like, to report concerns.
All of these questions raise significant concern as to the effect it may have on marginalized populations. The difficulty may not be, so much, in obtaining general information by medical office staff, but the inhibition or intimidating chilling effect it may have on patients seeking medical care to be asked for various forms of identification, proof of residence (telephone bills, gas company bills, canceled check for rent and the like). Also, Red flag rules imposed on medical practice may be used to uncover immigration status. We must keep in mind that it is not the finding of actual identity theft that is the problem but the investigatory process required by red flag laws that will intimidate and frighten patients (children included) from obtaining medical care.
Uncovering identity theft, as well as immigration status are of great importance to the safety of our economy and to prevent economic hardship or devastation. But, it should not be the job of the medical profession to participate in non-medical investigatory inquires. Strict rules applicable to the privacy of medical records are in place under HIPAA.
Similarly, if a physician or physicians group is put on notice by some law enforcement agency, of potential perpetrator - whose names may be the same or similar to a patient - of Identity theft such will require the physician to pursue some investigation and report back to the agency with his or her findings. The need for medical care should not be thwarted by fear.
There are significant incentives for physicians to establish some procedure for red flagging patients. The Federal Trade Commission penalties for red flag rule of violators range from $2500 to $3500 per violation.
The issue here is not the good that can result from imposing these otherwise important laws to protect against identity theft, but what bad can result from foisting non-medical responsibilities upon the practice of medicine. It will result in damage to the profession of medicine, the sanctity of the doctor - patient relationship and public health.
There has been ongoing controversy over these laws. On May 28, 2010, the FTC again delayed the implementation of the law until December 31, 2010. The lack of clear definitions as to who is and is not required to pursue some red flag program is the primary reason for the delay.
Bernard W. Freedman, JD, MPH