Safeguarding client data is not optional. It’s the law.

[kcjenkins]

http://www.cpai.com/show-article?id=233

It's written so broadly that it includes anybody they say it does. If you have any individual clients who pay you over time (where multiple payments would be permissible), you probably need to have a written "Program" regarding identity theft in place by August 1.

"The FTC staff believes that for entities subject to a low risk of identity theft, but having consumer accounts that will require them to have a written Program, it will take such entities 1 hour to review the final regulations and create a streamlined Program." Note that the document which contains the final regs is 59 pages long, and I am a fast reader, but I could not read through this governmental crap in an hour, much less read AND then create the Program. Although they do have a pre-packaged Program you can adopt.

Said document here:

http://www1.ftc.gov/os/fedreg/2007/novembe...109redflags.pdf

The FTC has a guide and a fill-in-the-blank program at this site:

http://www2.ftc.gov/bcp/edu/microsites/red...ule/index.shtml