 |
|
Matt Yanovitch |
On May 1, 2009, the Federal Trade Commission (FTC) will begin enforcing the "Red Flag" identity theft regulations. A "Red Flag" is defined as a "pattern, practice, or specific activity that indicates the possible existence of identity theft." The new regulations require financial institutions and "creditors" that offer or maintain "covered accounts" to implement a written program to identify, detect, and respond appropriately to Red Flags. A "covered account" is "(1) an account used primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions or (2) any other account for which there is a reasonably foreseeable risk to customers or the safety and soundness of the financial institution or creditor from identity theft."
The term "creditor" under the new regulations has the same definition as that given to the term by Congress in the Equal Credit Opportunity Act (ECOA), specifically, a business or person who "regularly arranges for the extension, renewal, or continuation of credit." The regulations specifically list banks, finance companies, automobile dealers, mortgage brokers, utility companies, and telecommunication companies as examples of creditors.
Though the regulations went into effect in 2008, the FTC has delayed its enforcement in response to a large amount of feedback from businesses that did not realize that they would be subject to the regulations as creditors. Several federal appellate courts have examined the definition of the term "creditor" under the ECOA. These courts have generally ruled that businesses that provide goods or services and bill their clients or customers after the delivery of the goods or services (such as law firms and home improvement contractors) are not "creditors" under the ECOA, even though payment is not made simultaneously for the goods or services. The courts' rationale has been that these transactions did not constitute credit transactions because the businesses were not offering a contractual right to defer payment at the customer's sole discretion.
In spite of these federal court opinions, the FTC has taken the position that if "payment is made after the product was sold or the service was rendered," this constitutes a deferred payment and thus a credit transaction. The FTC further stated in the same notice that health care providers (such as doctors, dentists, orthodontists, and even nursing homes) "are creditors if they bill consumers after their services are completed" and that "health care providers that accept insurance are considered creditors if the consumer ultimately is responsible for the medical fees."
If your business allows customers to pay after your goods or services are rendered, your business may be subject to "Red Flag" regulations. Contact Spotts Fain attorneys Steve Reardon or Matt Yanovitch for help in determining whether your business is subject to these regulations and for assistance in implementing an identity theft policy.
The author, Matt Yanovitch, is an associate in Spotts Fain's Business Section at the Richmond office. He provides general business advice to a broad range of small and mid-sized businesses, with a primary focus on the health care sector.
