Practices with 20 or fewer physicians may be exempt from the "Red Flags" rule, which requires physicians' practices and other businesses to spot and report identity theft, according to a bill unanimously passed in October by the U.S. House of Representatives.
