I understand that the Red Flag rules are for identity theft. If a debit card is compromised and we received notification from Visa or MasterCard, is this a reason to fill out a Red Flag form? The card is shut off at that point.

This sounds like an internal tracking form for ID theft cases. Your institution's ID Theft procedures should specify what forms (if any) need to be completed in response to notification of potential identity theft.