A bill that would exempt most physician practices from the scope of the Federal Trade Commissions "Red Flag" Rules regarding identity theft was passed earlier this week in the US House of Representatives and is now working its way through the Senate. As passed in the House, the bill would automatically exempt health care practices with 20 or fewer employees, and it would allow larger businesses to apply to the FTC for an exemption where the business either knows all of its customers or patients individually or where the business has not experienced incidents of identity theft and for which identity theft is rare among similar businesses. After several delays, the enforcement date for the Red Flag rules is set for November 1. However, if enacted into law, the pending legislation would exempt smaller health care practices entirely, and it may result in a further delay in enforcement as to larger businesses until the FTC issues regulations regarding application for exemption by such larger businesses. We will keep you up to date regarding further developments. In the mean time, though, please contact us with any questions you may have regarding the Red Flag Rules and their applicability to your business.