Ask your doctor for some photo ID and a certified copy of his/her practising certficate or medical board membership (or whatever is appropriate to your jurisidcition, in the UK this would be membership of the GMC).

Surprise them further by getting your laptop and portable scanner out of your backpack – just to make a copy “for your records”.

How about producing some joke ID, such as membership of the KKK (photo taken with hood on, of course) or the National Hairdressers Association (picture of top of head), or International Clown Institute (in full makeup and wig).
Maybe you’re a member of the Porn Actor’s Guild, with appropriate photo to match. Offer to prove it really is you…

This whole thing makes about as much sense as carding senior citizens before selling them beer or cigarettes. They have started doing that, too. I am 67, and have been carded at the store for beer more times in the past 5 years than I ever was when I was young enough to be mistaken for someone under age.

Doctors are NOT creditors under certain circumstances

“On the other hand, health care providers who require payment before or at the time of service are not creditors under the Red Flags Rule. In addition, if you accept only direct payment from Medicaid or similar programs where the patient has no responsibility for the fees, you are not a creditor. Simply accepting credit cards as a form of payment at the time of service does not make you a creditor under the Rule.” (http://www.ftc.gov/bcp/edu/pubs/articles/art11.shtm)

The following is a direct quote from the FTC’s FAQ on the RFR: (http://www.ftc.gov/bcp/edu/microsites/redflagsrule/faqs.shtm#D)

# Does the Rule require that I have specific practices or procedures in my Program – like identifying a particular red flag or reporting suspected identity theft?

The Rule doesn’t require any specific practice or procedures. It gives you the flexibility to tailor your Program to the nature of your business and the risks it faces. The FTC will assess compliance based on the reasonableness of a company’s policies and procedures. Businesses with a high risk for identity theft may need more robust procedures – like using other information sources to confirm the identity of new customers or incorporating fraud detection software. Groups with a low risk for identity theft may have a more streamlined Program – for example, simply having a plan for how they’ll respond if they find out there has been an incident of identity theft involving their business…

# Does the Red Flags Rule require me to check photo IDs of my customers? If I check photo IDs, should I keep copies?

The Rule doesn’t specifically require you to check customers’ photo IDs. Of course, for some businesses, checking photo IDs is one way to verify that customers are who they claim to be. But if you decide to ask for a photo ID, keeping a copy often is unnecessary and can raise privacy and data security concerns, especially if you’re collecting other personal information like date of birth, address, or Social Security number.

I do NOT allow Dr’s offices to bully me or intimidate me unless they can provide PROOF in writing that they need this information. Then I will submit it to the Inspection office who will then contact them regarding the need for such information.

I go to Doctors offices, Dentist offices and hospitals regularly with the wife & the kids. Not one employye has ever challenged me when I refuse to give them a copy of my ID for the purpose of copying it. They may peruse it , they can take a picture of me when I am in their offices. They can photo copy my Insurance card . But thats where the line is drawn. I have NEVER been refused service or refused treatment by ANY office when I have adhered to this guideline.

If you want to guarantee your privacy and your safety; you had better learn when to draw the line also.

I just went to the Doctor yesterday with my Mother and we both we ask to show our driver’s license and they did scan it and jokingly the receptionist stated “just like going to the bar, you’ll get ask for your ID and now we will know what favorite drinking places you go to and how much you drink” – so be careful.

I did not appreciate her sense of humor.

I work in the medical field. We are not required to scan licenses into our computer systems. In fact there is no law that says we have to. But we do have to comply with the regulation, which means checking a photo ID at time of visit to make sure you are the patient, or taking your picuture so we always have it on file and can identify you in the future. If your docotor says it is the law for them to scan your drivers license, it is not. It may be their policy which they can do. I recomend if you find that this is their policy leaving that practice and finding another doctor who does not have this type of policy.

I have a friend who took her kid to the Dr and he scanned his hand and took a picture! OMG I almost died when she said she allowed them to do that.

Thanks for your input. The “Red Flags” Rule definitely does NOT require that IDs be copied or scanned at all. It is frequently implemented that way because it’s an easy way to appear compliant (without actually solving the underlying problems).

The Rule itself is actually fairly general. According to the FTC:

If you’re covered by the Rule, your program must:
1. Identify the kinds of red flags that are relevant to your practice;
2. Explain your process for detecting them;
3. Describe how you’ll respond to red flags to prevent and mitigate identity theft; and
4. Spell out how you’ll keep your program current.

That’s basically it. The specifics are determined by your organization.

There are certainly alternatives to checking ID. For example, patients are often asked to sign forms when they arrive at the doctor’s office. Signature checking is an effective means of verifying a person’s identity, which has worked for the banking industry for decades. Rather than regularly asking for an updated copy of the patient’s photo ID, office staff could simply check that the current signature matches the one already on file from previous visits. If not, that would be considered a red flag, and then staff could potentially ask for further verification (depending on the organization’s response policy).

You might want to check out the AMA’s formal objection to the Red Flag Rules here.

As described in World Privacy Forum’s 2008 report, “Patient identity proofing, particularly in some implementations, can expose patients to increased risk of medical and other forms of identity theft…Depending on the implementation, it can potentially increase the liability of a health care provider.

“When patients are, for example, asked for a drivers’ license when checking in to hospitals for surgery, the license itself may be copied or scanned and added into the actual patient file. This can give hospital insiders with criminal tendencies access to a treasure trove of photographic, biometric, and other information that may have been unavailable to them before. The result can be more identity theft (medical and otherwise).”

Hope that helps,

Sherri