Small Healthcare Entities Need Red Flags The Most

Small healthcare entities are more likely to have cases of identity theft. So why exclude them from complying with a mandatory identity theft prevention program?

Randy Berry, B.A., C.P.A., financial leader and Red Flags Rule compliance expert with Columbus Healthcare & Safety Consultants in Columbus, OH, asks that very question.

The House of Representatives unanimously passed a bill Tuesday, October 22, that would exempt a healthcare practice with 20 or fewer employees from the FTC's identity theft Red Flags Rule requirement. The bill now moves onto the Senate.

The Red Flags Rule, which will be enforced starting November 1, 2009, requires healthcare entities considered to be "creditors" to implement an identity theft prevention program.

"The biggest concern that I have is … the smaller the practice, the less internal controls they have and the more apt the smaller practices are to have identity theft," says Berry, author of the Red Flag Manual and Training CD Package. "The most critical thing is protecting patients' identity. It's not about the doctor. It's about the patients' financial identity. The lobbyists forgot that this is not about practices; it's about patients and their customer's financial information."