FTC releases do-it-yourself “Red Flags” program for businesses at low risk of identity theft

The Federal Trade Commission (FTC) now offers an interactive document to help low-risk businesses comply with the Red Flags Rule, which requires creditors that maintain covered accounts to develop an identity theft prevention plan by Aug. 1. The FTC interprets the rule to apply to, among other entities, health care providers that bill a patient’s insurance before billing the patient or that allow patients to set up a payment plan.

The FTC directs businesses through an analysis to determine whether they are at low risk for identity theft. Factors to consider in the analysis include whether a business:

• Knows its clients personally;


• Provides services in customers’ homes;


• Has been in business for some time and has not had complaints of identity theft; and


• Operates a type of business in which identity theft is uncommon.

Businesses that determine they are at low risk for identity theft can use the FTC’s interactive tool to design their own identity theft prevention programs. http://www2.ftc.gov/bcp/edu/microsites/redflagsrule/get-started.shtm