Attorneys receive Red Flags reprieve: FTC postpones enforcement of effort aimed at preventing identity theft.

The Federal Trade Commission has announced a three-month postponement before it begins enforcing its "Red Flags Rule" on small businesses and other entities--including lawyers and doctors.

In a July 29 press release, the agency said the new effective date of November 1 will "give creditors and financial institutions more time to review this guidance and develop and implant written Identity Theft Prevention Programs."

The FTC also promised to increase its efforts to educate those affected by the Fair and Accurate Credit Transactions Act of 2003 (FACTA).

According to the agency, "FACTA's definition of 'creditor' includes any entity that regularly extends or renews credit--or arranges for others to do so--and includes all entities that regularly permit deferred payments for goods or services."

The FTC, in its FACTA rules, has included both doctors' and lawyers' offices in that definition, which has sparked opposition both from the ABA and the American Medical Association. The ABA has argued that lawyer regulation is a matter for the states, that the FTC has been unable to find any instance of identity theft resulting from a law office accepting credit card payments, and that lawyers are not "creditors" because they are accepting payment for services rendered and not extending a loan.

At its meeting in July, The Florida Bar Board of Governors adopted as a Bar legislative position the ABA's position to oppose having lawyers and law offices covered under FACTA (see "Bar objects to including lawyers under FTC's new Red Flags Rule" in the August 1 News).

[ILLUSTRATION OMITTED]

Bar President Jesse Diner, who sent a letter to the FTC and Florida congressional delegation outlining the Bar's position, said the Bar is looking for more than just an enforcement delay.

"Basically, a postponement doesn't mean the decision is a positive one or will be a positive one," he said. "Certainly lawyers are not creditors within the meaning of the legislation and, quite frankly, should not come under the umbrella of the Red Flags Rule.

"The position I took in the correspondence sent to the FTC on behalf of The Florida Bar remains the same," Diner added. "Hopefully, after they review it over the next 90 days they will do the right thing."

Outgoing ABA President H. Thomas Wells, Jr., praised the FTC postponement, but said the action didn't go far enough because it didn't exempt lawyers from the law.

"This temporary reprieve is important to all in the legal profession," Wells said. "However, the FTC's continued assertion that it can, as it sees fit, regulate lawyers under the 'red flags' provisions is troubling, and unacceptable to the ABA. It undercuts an unbroken history of strong regulation by state bars and supreme courts. It threatens the independence of the profession from federal controls, independence that is fundamental to the lawyer's role as client confidante and advocate. And it is goes against Congress' intent when the law was passed.

"The ABA and its counterparts at the state and local levels will continue to work with Congress to clarify that this rule should not apply to lawyers. And if necessary, the ABA remains prepared to take the issue to the courts for a final resolution."

The AMA issued a press release after the FTC announcement of the enforcement delay, saying, "The new compliance date of November 1, 2009, which follows two earlier extensions to May 1 and then later to August 1, is a result of continued advocacy by the AMA and others who continue to object to the applicability of this rule to health care providers and other professionals.

"Since the rule was issued, the AMA has objected to the FTC's interpretation that physician practices are 'creditors' when they accept insurance and bill patients after services are provided or if they allow patients to set up payment plans after services have been provided."

For its part, the FTC said the three-month delay will be used to "redouble its efforts" to educate those affected about how to comply with the regulations.

According to the FTC, "The Red Flags Rule is an anti-fraud regulation, requiring 'creditors' and 'financial institutions' with covered accounts to implement programs to identify, detect, and respond to the warning signs, or 'red flags,' that could indicate identity theft. The financial regulatory agencies, including the FTC, developed the rule, which was mandated by the Fair and Accurate Credit Transactions Act of 2003. FACTA's definition of 'creditor' includes any entity that regularly extends or renews credit--or arranges for others to do so--and includes all entities that regularly permit deferred payments for goods or services. Accepting credit cards as a form of payment does not, by itself, make an entity a creditor. 'Financial institutions' include entities that offer accounts that enable consumers to write checks or make payments to third parties through other means, such as other negotiable instruments or telephone transfers."

The FTC said the three-month delay is "consistent with the House Appropriations Committee's recent request that the commission defer enforcement in conjunction with additional efforts to minimize the burdens of the rule on healthcare providers and small businesses with a low risk of identity theft problems."

Judith Equels, director of The Florida Bar's Law Office Management Assistance Service, said, in her conversations with FTC representatives, they were not able to provide her with any examples of procedural due diligence that a lawyer should implement to comply with the rule.

Nor, the ABA contends, has there been a demonstrable problem as the FTC has not been able to cite a single instance of identity theft arising from a law practice, and hence the regulation is an onerous burden to fix a nonexistent problem.

The agency offers more information about its proposed Red Flags Rule at its Web site, www.ftc.gov/redflagsrule and www.ftc.gov/bcp/edu/microsites/redflagsrule/faqs.shtm.

Gary Blankenship

Senior Editor