The Red Flags rule was released by the Federal Trade Commission (FTC) and other government agencies to help prevent identity theft. The rule was passed in January 2008 and should have been effective by November 1, 2008, but the FTC delayed enforcement until December 31, 2010.
Also in December 2010, the Red Flag Program Clarification Act of 2010 was passed and signed into law by President Obama. This legislation seems to exclude many health care providers, including skilled nursing care centers and assisted living communities, from classification as creditors, and thus exempt from the mandated processes, procedures, and enforcement connected with that classification.
Although this position is supported by unofficial statements made by Congress, as well as an FAQ posted to the FTC's website in June of 2013, the FTC retains the ability to require compliance by any sort of business that maintains “accounts that are subject to a reasonably foreseeable risk of identity theft."