Red Flags Rule Prevents Medical Identity Theft

Each year, an estimated half-million Americans become victims of medical identity theft, which occurs when a person seeks healthcare using someone else’s name or insurance information. Left undetected, medical identity theft may cause patient records to become inaccurate, a potentially life-threatening consequence of the crime, or result in fraudulent charges that may affect future health benefits or delay access to care. Effective August 1, 2009, the Federal Trade Commission (FTC) will begin enforcing the new Red Flags Rule, which requires healthcare providers to develop and implement a written program designed to identify and detect warning signs of identity theft and to mitigate any resulting damages. UCLA Health System launched its Red Flags program this May.

“The steps we have taken complement our established practices to protect the privacy of our patients, which include conducting daily audits of medical records and continually educating employees about when it is appropriate to access patient information,” says Carole A. Klove, chief compliance officer. “Our efforts have also focused on educating patients about medical identity theft and helping them to understand the controls we have put in place to protect not only their medical information but also their identities.”

As part of the program, employees within UCLA Health System who deal with patient medical and financial information have been trained to request appropriate identification and to detect and respond to “red flags” that point to possible identity theft. Red flags may include questionable documents, suspicious personal identifying information or unusual activity related to patient accounts. Red flags may also include alerts, warnings or notices from victims of identity theft, law enforcement officials, consumer reporting agencies and others. While all employees should be aware of the new Red Flags Rule, employees most affected are those with direct patient contact through operational and financial units, such as scheduling, registration, admitting and billing.

“Requiring all patients to present two valid identifiers each time they attempt to access our system in person or by phone is a key component of our Red Flags program,” explains Carole. “We have not only put processes in place to ensure this happens consistently, we have also focused on reminding patients through letters and signage about why providing this information is crucial to protecting their medical information.”