May 1 is almost here, and when it arrives, emergency services agencies that bill for ambulance transport must have identity theft prevention programs in place or risk punishment by the Federal Trade Commission (FTC).

Like many other businesses that extend credit to consumers, fire and EMS agencies are subject to the FTC’s “red flag rules,” which require creditors to develop and implement written programs to detect, prevent and mitigate identity theft.

Last year, the National EMS Management Association, the American Ambulance Association and other groups representing emergency services argued that ambulance agencies should not be subject to red flag rules because they do not “regularly extend, renew or continue credit,” and that credit is extended only in conjunction with and for the purpose of patient billing. The FTC disagreed, leaving EMS agencies no choice but to comply with its red flag rules.

What does this mean for your organization? According to the law firm of Page, Wolfberg and Wirth (PWW), “Most ambulance services will meet the definition of a creditor under the red flag rules and are therefore required to be in compliance with the FTC’s regulations.” (See box for FTC definitions.)

As a result, ambulance services are required to establish reasonable processes and procedures to combat identity theft in connection with opening and maintaining the covered accounts, i.e., an identify theft prevention program. The rules state that the program must be written, and it must be appropriate to the size and complexity of the organization and the nature and scope of the organization’s activities.

The program must include reasonable policies and procedures to:

• identify relevant red flags and incorporate those red flags into the program;
• detect red flags that have been incorporated into the program;
• respond appropriately to red flags that are detected; and
• update the program periodically.

Program Administration
The written identity theft program established by an ambulance service must be formally approved by the service’s board of directors or an appropriate committee of the board, PWW said. The ambulance service must also involve the board or an appropriate committee or designated employee to oversee the development, implementation, and administration of the program. Administration of the program must include staff training to effectively implement the program and must also include oversight of relevant service provider arrangements.

An ambulance service must periodi-cally conduct risk assessments to determine whether it offers or maintains covered accounts. The risk assessment must take into consideration the methods that the service provides for opening accounts, the methods the service provides to access its accounts, and the service’s previous experiences with identity theft.

PWW attorneys note that ambulance services should be aware that the program can be flexible, and the FTC does not require any specific language, policies or procedures. Ambulance services need to comply with the basic requirements in the regulations, yet they have the ability to tailor the program appropriately to the size and complexity of the organization. “This means that while larger organizations may have to develop a distinct, comprehensive program in addition to other programs they have in place, smaller organizations may opt to incorporate the program into existing policies and procedures,” PWW states.

To assist with compliance, PWW is extending a discount to Best Practices subscribers who want to learn more about the red flag rule. PWW is offering $20 off of the $119 price of its Red Flag Rules Survival Kit for Ambulance Services or $20 off the price of its Red Flag Rules Bundle ($307.95), which includes the Survival Kit as well as a Webinar recording about the topic. The Survival Kit includes a customizable sample identity theft prevention policy, a list of red flag indicators for EMS, a sample notification letter for patients in the event that an incident of identity theft has or is suspected to have occurred, and a model resolution for a Board of Directors in adopting the organization’s identity theft prevention program. Order online at http://www.pwwemslaw.com/ or call 877-EMS-LAW1. Use Coupon Code RFBC2.