Medical practices and hospitals have a Nov. 1, 2009 deadline to implement a written "identity theft protection plan," also known as "red flag" rules. Despite objections from the AMA, the FTC has confirmend that even small practices must implement a plan. More information on the red flag rules is provided in an article by healthcare attorney Pat King, JD.