House passes Red Flags Rule exemption for small businesses

On Oct. 22, 2009, the U.S. House of Representatives unanimously passed H.R.3763, a bill that would exempt a health care practice with 20 or fewer employees from the requirements of the Federal Trade Commission (FTC) “Red Flags” rule on identity theft.

In addition, the bill would allow any business, regardless of size, to obtain an exemption from the rule if the FTC determines that the business knows its customers or clients individually, only performs services in or around the residences of its customers or has not experienced incidents of identity theft and is part of an industry that rarely experiences identity theft.

The Red Flags Rule, which is now delayed (again) until June 1, 2010, is an anti-fraud regulation, requiring “creditors” with covered accounts to implement programs to identify, detect, and respond to the warning signs, or “red flags,” that could indicate identity theft.

The FTC notes that although many covered entities have already developed and implemented appropriate, risk-based programs, some – particularly small businesses and entities with a low risk of identity theft, such as aging services providers – remain uncertain about their obligations.

The House bill was introduced by John Herbert Adler (D-N.J.), Paul Collins Broun, Jr. (R-Ga.), and Mike Simpson (R-Idaho). It now moves to the Senate.