Oh what fun, lawyers (and their clients) have new regs to comply with and new exposure if they don't. Civil damages, administrative penalties, and even criminal charges are possible under these new rules. But this emerging field also provides new marketing opportunities. You can advise (and bill), you can represent damaged parties, and you can defend parties charged with failure to comply. And, if you practice in any related field, you can attract new business by speaking and writing about these new regulations. You can also earn profits beyond your legal fees by offering non-legal identity theft protection to your clients and their employees. I work with many attorneys who do this and the income is not only substantial, it is residual. If you're interested in learning more, send me a personal message. dw
—
By Susan D. Oja and Alex De Grand
April 1, 2009 — Lawyers who bill their clients after services have been rendered are expected to implement a written program guarding against the theft of their employees' and clients' personal information under a new federal law.
The Federal Trade Commission will begin enforcement of the "red flags rule" on May 1. The rule is part of the Fair and Accurate Credit Transactions Act of 2003 (FACTA), a congressional response to spikes in reported identity theft. Identity thieves assume a person's entire identity or synthesize one from parts of various victims. Because more than half of identity thefts occur in the workplace, businesses are required to implement safeguards.
Those subject to the rule are "creditors" and financial institutions who maintain consumer-type accounts or other accounts at reasonable risk of identity theft. The FTC noted that identity thieves look for opportunities to obtain products or services that do not require payment up-front.
As interpreted by the FTC, "creditors" has a broad definition, encompassing professionals such as lawyers and doctors who defer payment of a client's bill. The American Medical Association protested that other federal laws and professional ethical duties to maintain patient confidentiality precluded the new rule. But the FTC held in a letter that the statute borrows the sweeping definition of "creditor" from the Equal Credit Opportunity Act (ECOA). Agency interpretation of the ECOA specifically includes doctors and lawyers within the meaning of "creditor."
What is expected
Under the new rule, lawyers must implement a written policy specifying how they will watch for the warning signs — the "red flags" — that indicate an identity theft may be occurring and how they will respond to prevent or mitigate the crime if uncovered.
Policies are supposed to be tailored to the amount of risk. The FTC acknowledges there is no bright-line rule to distinguish between high and low-risk. But the rule suggests a lawyer consider such factors as how easily an account is opened or accessed and previous experience with identity theft.
If a lawyer finds there is little risk, an appropriate program might comprise no more than checking photo id at the time services are sought and a policy against collecting from an identity theft victim or reporting it on the victim's credit report.
In its letter to the AMA, the FTC stated that it does not foresee the new rule imposing a great burden. "For example, a small medical practice with a well-known, limited patient base might have a lower risk of identity theft, and thus might adopt a more limited Program than a clinic in a large metropolitan setting that sees a high volume of patients," the letter read.
What to watch for
The Appendix of the "red flags rule" provides examples of incidents putting a creditor lawyer on notice of potential identity theft. In addition to fraud alerts from consumer credit agencies or the client's complaint, this list includes suspicious documents, perhaps altered or forged. A creditor lawyer may receive fishy personal information such as an unexpected change of address. Creditor lawyers are also directed to look for unusual use of an account.
A creditor lawyer's policy should address the detection of "red flags" at the time an account is opened by obtaining identifying information about the new client and verifying it, the rule instructs.
What to do
Responses to "red flags" should be in proportion to the risk posed and a creditor lawyer is advised to consider any "aggravating factors" such as a data security breach that may exacerbate the threat. The rule Appendix suggests appropriate responses could be alerting law enforcement, monitoring the account for evidence of identity theft, changing passwords or other security devices controlling account access, reopening an account with a new account number, or closing an account. Under certain circumstances, the rule states that a creditor lawyer may determine no response is necessary.
These written policies should be updated periodically to account for changes in risks to clients' information or innovations in detection of identity theft. A subsequent merger, acquisition, joint venture, or service provider arrangement may also prompt the need for an updated written policy.
The rule also requires appointing a senior management person to implement the program; appropriately educating employees; and overseeing any service provider arrangements. Liability follows a creditor lawyer's data, so due diligence is necessary to confirm vendor compliance before outsourcing payroll or hiring an office cleaning company.
More information from the FTC: The Red Flags Rules: Are you complying with new requirements for fighting identity theft?
Susan D. Oja, a solo practitioner in Middleton, is a certified identity theft risk management specialist through the Institute of Fraud Risk Management. Alex De Grand is a legal writer for the State Bar of Wisconsin.
In "The Slight Edge," Jeff Olson talks about the power of doing "the little things" over and over again, consistently, over time, until the compounded effect of those small efforts produces dramatic change. Brian Tracy, in "Create Your Own Future: How to Master the 12 Critical Factors of Unlimited Success," calls this same phenomenon, "the principle of accelerating acceleration."
Tracy, who sees the principle as a corollary of "law of attraction, says, [page 48], "Whatever you are moving toward [i.e., a goal] begins moving toward you as well." His characterization of how the principle operates should be given to every attorney who is about to start their own practice:
"When you first set a new, big goal and begin moving toward it, your progress will often be quite slow. You may be frustrated and think of giving up. The bigger your goal, the further away it will seem. You may have to work on it for a long time before you see any progress at all. But this is all part of the process of goal attainment."
"The 20/80 rule helps to explain the principle. . . . For the first 80 percent of the time that you are working toward your goal, you will only cover about 20 percent of the distance. However, if you persist and refuse to give up, you will accomplish the final 80 percent of your goal in the last 20 percent of the time that you spend working on it.
"Many people work for weeks, months, and even years toward a big goal and see little progress. They often lose heart and give up. But what they didn't realize is that they had laid all of the groundwork necessary and were almost at the take-off point. They were just about to start accelerating toward their goal, and their goal was about to start moving at a great speed toward them.
"This principle of accelerating acceleration seems to apply to almost every big goal that you set for yourself. You must therefore decide in advance that you will never give up."
So, as you contemplate how you might create your own future in the new year, start with your long-term, visionary goals. Decide now that they are worth the effort you are about to make. Get used to the idea that you probably won't see most of the results you seek for a long time. And then, and only then, when you tell yourself (and anyone else who will listen) that you won't give up until you get what you want, you might actually believe it.
Filed under Career satisfaction, Goal Setting by
