Draft Fair and Accurate Credit Transaction Act of 2003 FACTA Red Flags Rules Policy 04-21-2009-4n

Browse Search

2 • Case the risk assessment to select measures fired flags} that may be used to detect attempts to create fraudulent accounts. ® Identify procedures for employees to prevent the establishment of false accounts and procedures for employees to implement if existing accounts are being manipulated. ® obtain ro ram a royal of the program by the sC~CC or senior designated management p g pp by May ~, 2ag9~ • Train appropriate employees on the policies and procedures in the program. • Provide an annual report to the BGCC or designated senior management. The annual report should provide any material matters related to the effectiveness of the programs policies and procedures the oversight and effectiveness of any third party billing and account establishment entities, a summary of any identity theft incidents and the response to those incidents, and recommendations for any substantial changes to the program, ~ any. In February 24a9, department covered by the Red Flags Rule reviewed their accounts to determine whether or not they were covered by Red Flags Rule. A task force, made up of covered de artments, the staff attorney and Information Technology Department, was formed to P assess the risk and develop a policy that detected, mitigated and prevented identity theft. The task force conducted an initial risk assessment of covered accounts and found there was some risk of identity theft. The task force then identified red flags that could be used to detect attempts to create fraudulent accounts and identified procedures to prevent and mitigate incidents of identity theft. The proposed policy also provides for training of staff and an annual review of the policy by an Identity Theft Prevention Task Force. A draft policy was reviewed by the County Manager, .the County Attorney and staff covered by the Red Flags Rules. The attached recommended Identity Theft Prevention Program Policy complies with the Red Flags Rule. Some North Carolina Counties have enacted ordinances to comply with the FACTA's Red Flags Rule. FACTA, and its implementing regulations, are federal not state requirements. Since Counties in North Carolina have no inherent le islative power and possess only those powers conferred upon them by the General Assembly, staff ~s recommending the Red Flags Rules be implemented through an Identity Theft Prevention Program Policy instead of an ordinance. FINANCIAL IMPACT: There is no current financial impact. However, there may be some financial impact in the future. RECt]MMENDATI4]N~S}: The Manager recommends the Saard adopt the Identity Theft Prevention Program Policy. ~ See Five C's, inc. v. Pasgarotank, X72 S.E.2~ 737, 740 X2009}