HC Reform Update from Mark Sanna: The Red Flags Rule requires creditors and certain businesses to develop and implement written identity theft prevention programs to help identify, detect and respond to patterns, practices or specific activities that could indicate identity theft. The applicability of the rule to health care providers has been debated over the past several months. On Tuesday, the Senate passed legislation that would exempt health care providers from the Red Flags Rule.