The FTC has a great website that it explains it all in detail.
the FTC requires most clinical offices, hospitals, and other health
care providers to develop a written program to spot the warning signs
of identity theft – “red flags” If a patient’s name on a photo ID and on their insurance card do not match, that’s a red flag. If a patient visited last week as John Smith but today is Fred Jones, that’s a red flag. If patient seems to travel from provider to provider seeking numerous expensive treatments, that’s a red flag.
law was initially designed to cover creditors and it seems odd for
healthcare providers to be considered creditors. The FTC defines a
creditor as anyone who enables the customer to carry a balance after
services are rendered. Unless a clinician asks for payment upfront (all
balances not covered by insurance), the clinician is a creditor.