Law Students

HITECH Act: Any role for the FTC & The Red Flags Rule?

Health care providers implicated in the FTC's Red Flags Rule. As the link indicates, enforcement of the Rule begins on August 1, 2009. In short, within five business days. Large numbers of health care providers fall under the Rule since they can be categorized as "creditors" (see the link for a good summary). Most providers are clearly not ready since they have not taken steps to implement a plan that would provide a "safe harbor." The Rule is designed to anticipate and prevent identity theft. According to this article, 10 million Americans a year have their identities stolen, of these the FTC estimates that as many as 5% have their medical identity stolen, not a small number.

Protecting agaisnt identity theft is all about  recognizing signs that it may occur (i.e. the "Red Flags") and subsequently having the right processes and precautions in place to protect the data at risk--personally identitifiable information (PII). OK, but what does all of this have to do with the HITECH Act? On its face, the short answer is nothing at all. But HITECH's Subtitle D already gives the FTC a role regarding personal health records (PHRs), now they will be keeping an eye on health care providers PII data protection activities as well. What are the odds that the FTC notifies HHS if they suspect not only PII is at risk  BUT also protected health information (PHI)? In short, protecting data is protecting data. If a provider has sloppy, or non-existent protection in one case, the probabilities are high that it does in most (if not all) cases. You can bet that the FTC, HHS, and CMS will be working closely together or these issues.

There is indeed a regulatory freight train coming unlike anything the health care industry has experienced in the past. If you would like more information sign up for our FREE HITECH/HIPAA Compliance Newsletter.

Full post as published by LawTechTV on July 26, 2009 (boomark / email).