If we use consumer reports in our hiring process, do we need to include the H/R department in our Identity Theft Prevention Program and Risk Assessment? Prudent business practice would tell me yes. However, potential / actual employment does not seem to meet the definition of "account" or "covered account."

I thought I had read something a few months ago that we shouldn't forget about our H/R department as we are going through the Red Flag stuff. I can't find that reference anymore so all I can rely on is the Federal Register info.

Thoughts?

I'm wondering about this as well. Like travelgirl I don't think that employment would be considered a "covered account". Anyone?

Employment is not a "covered account" and employee issues are not a specific requirement of the red flags regulation. But it certainly doesn't hurt to address such issues in the ITPP.

I believe the article that mentioned HR was in reference to the specific Address Discrepancy rule, not the IDTPP. One of the mandates of this round of FCRA rulemaking was to improve the accuracy of consumer reports, even in cases where an address discrepancy does not necessarily having anything to do with ID Theft. (Granted, an unresolved address discrepancy is also a ID Theft trigger.) It appears that the regulatory expectation is that anyone who pulls a credit report is covered for this part. So as a user of a consumer report, HR does seem to fall under the Address Discrepancy rule even if not covered by the IDTPP.

Our HR department also uses credit reports in the employment screening process, and this presents some challenges so I'm curious how others are viewing this aspect. HR does not report information to the consumer reporting agencies today, and we have no means to comply with the second requirement of the Address Discrepancy rule to provide the confirmed address to the consumer reporting agency. (This same issue exists in other areas that may pull a credit report on an ad hoc basis but don't report information to the credit bureaus, such as Commercial Lending.)

As far as HR, we feel we will need to have some procedures in place to meet the first requirement of the Address Discrpancy rule to form a reasonable belief that the applicant is the same person that we requested the credit report. This part applies regardless of whether or not an account is established, but should be easy enough to do in an employment screening setting. However, we hope to point to the fact the employment is not an account (as noted above) to avoid the trigger for the second requirement to update the confirmed addres with the credit bureau since there is really no feasible way to do it.

I agree that if you pull a credit report in an employment situation than you are subject to the address mismatch provisions of the regulation.

I am still confused on wether or not we need to report confirmed addresses for address discrpeancy notices received from a NCRA when pulling the credit report for hiring (HR) purposes. According to the interagency FAQs, the requirement is for USERS of consumer reports, so yes, HR fits that definition. It also states you are required to furnish the confirmed address if you "establish a coninuing relationship with the consumer", therefore, I am guessing employment is a continuing relationship, so again, I am thinking yes, in this scenario we would have to furnish the confirmed address, HOWEVER, you are only required to furnish the confirmed address if you regularly furnish information to a NCRA. For a business who is not furnishin any information to NCRAs, then that business does not have to furnish the confirmed address as a result of the HR hiring process. HOWEVER for a bank/lending business, yes, we do regularly furnish information to NCRAs for loans...therefore, does that mean we also now have to supply the confirmed addresses for our HR hiring process also since we do furnish information as part of our lending business? Any thoughts?

I honestly don't know how you're going to do that without a loan relationship as most of the reporting to CRAs is done out of the loan system since CRAs only accept consumer loan information.

I agree with you Georgia. I never would have thought that we should do it (furnish confirmed addresses from the HR hiring process credit reports) until I had seen some discussion and comments on it here and elsewhere. However, I wanted to know what other banks are doing and if they have received opinions maybe from their regulator.

Just an FYI - found this on OTS' CEO Letter 306 issued June 11, 2009 which announced the FAQs for the ID Theft Red Flags and Address Discrepancy Rules - http://files.ots.treas.gov/25306.pdf - please note this was not in the actual FAQs, only the CEO letter announcing the FAQs

“Reasonable Policies and Procedures for Furnishers of Information”
In addition to the interagency FAQs, we are providing the following guidance to OTS supervised institutions to explain how consumer report users can comply with the requirement to develop reasonable policies and procedures for furnishing confirmed addresses to nationwide consumer reporting agencies (NCRAs). Specifically, the Red Flag Rules/Guidelines require furnishers to develop and implement reasonable policies and procedures for furnishing confirmed addresses to NCRAs. We have become aware that some financial institutions are not able to use an automated process to provide confirmed addresses when these institutions do not regularly furnish information to NCRAs, such as in employment situations or for deposit accounts. In these circumstances, “reasonable” policies and procedures for furnishing confirmed addresses might include:
• furnishing confirmed addresses through a non-automated process; or
• notifying individuals who are the subject of an address discrepancy notice and either:
⎯ informing them how they may file a dispute with an NCRA to ensure that the correct address appears on consumer reports;3 or
⎯ offering to process the matter for such consumers as if it were a direct dispute.