Is a written program required?

Many regulators and industry standards expect a written program when identity theft risk is material. Financial firms should review the FTC Red Flags Rule and GLBA guidance; healthcare organizations should align controls with HIPAA.

Can the program be signed electronically?

Yes. Electronic signatures are legally enforceable under the ESIGN Act (15 U.S.C. §7001) and by UETA in most states, provided the signature method meets intent, consent, attribution, and retention requirements.

Who should sign the program?

The designated responsible officer or senior executive with authority over compliance or operations should sign. The signature line should identify role and date to show accountability.

How often must it be updated?

Update at least annually and after material changes in operations, vendor relationships, or applicable laws; document each revision and retain prior signed versions.

What records must be retained?

Keep signed program versions, training logs, incident records, and verification evidence according to retention schedules; HIPAA records require 6 years (45 CFR §164.530(j)), federal tax records 3 years (IRC §6501(a)).

How to report identity theft incidents?

Follow the program’s incident response steps: contain the incident, preserve evidence, notify affected parties as required by law, and record remediation actions and timelines.

Electronic Signature
Templates
Miscellaneous
Identity Theft Prevention Program

Identity Theft Prevention Program

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

IDENTITY THEFT PREVENTION PROGRAM AGREEMENT

Parties and Effective Date

Effective Date

Effective Date:

Party A (Organization) Address for Notices - Party A Party B (Service Provider) Address for Notices - Party B

Recitals

WHEREAS, Party A seeks to implement and maintain a written Identity Theft Prevention Program designed to detect, prevent, and mitigate identity theft risks in connection with its covered accounts; and

WHEREAS, Party B represents that it has the expertise, personnel, and systems necessary to assist Party A in designing, implementing, monitoring, and revising such a program consistent with applicable risk and business considerations; and

NOW, THEREFORE, in consideration of the mutual covenants set forth herein, the parties agree as follows.

Scope of Work

Program Scope

Party B shall perform the services described in the Program Scope and shall, at a minimum, provide the following components. The parties may supplement the Scope of Work with written attachments that become part of this Agreement.

Program Components (select all that apply)

Risk Assessment and Inventory of Covered Accounts Identification of Red Flags Red Flag Detection Procedures

Response and Mitigation Procedures Training and Employee Awareness Periodic Program Review and Updates

Roles and Responsibilities

Designated Program Officer (Party A) Party B Responsibilities

Payment Terms

Total Fee Payment Schedule Late Payment Fee

All fees are payable in U.S. dollars unless otherwise agreed in writing. Party B may suspend services for unpaid amounts after providing ten (10) days' written notice and an opportunity to cure.

Term and Termination

This Agreement shall commence on and shall continue in effect until unless earlier terminated in accordance with this section.

Either party may terminate this Agreement for convenience upon days' prior written notice. Either party may terminate for material breach if the breaching party fails to cure within thirty (30) days after receipt of written notice specifying the breach.

Confidentiality and Data Security

Each party shall treat as confidential all nonpublic information obtained from the other party in connection with this Agreement, including consumer identifying information and account data. Party B shall implement and maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information to prevent unauthorized access, use, disclosure, alteration, or destruction.

In the event of an actual or reasonably suspected data breach or suspected identity theft involving Party A data, Party B shall notify Party A promptly and cooperate in any investigation, mitigation, notification, and remediation activities. Notification to Party A shall occur no later than forty-eight (48) hours after Party B reasonably determines a breach has occurred, unless a shorter period is required by law.

Compliance and Review

Party B shall conduct periodic reviews of the Program at least annually, or more frequently as required by changes in risk, technology, or regulatory expectations, and shall provide Party A with written findings and recommendations for corrective action where warranted.

Review Frequency and Notes

Governing Law; Remedies

This Agreement shall be governed by and construed in accordance with the laws of the state of , without regard to its conflict of laws principles. The parties agree that monetary damages may be inadequate to remedy certain breaches of confidentiality or misuse of personal information and that injunctive relief shall be available in addition to other remedies.

Entire Agreement and Modification

This Agreement, including any attachments or amendments executed in writing by both parties, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, proposals, and communications. No modification of this Agreement shall be effective unless in writing and signed by authorized representatives of both parties.

Notices

Notice Address for Party A Notice Address for Party B

Certifications

Each party certifies that it has the authority to enter into this Agreement and that its performance hereunder will comply with applicable laws and regulations governing identity protection and privacy. Party B certifies that it will not knowingly use or disclose covered account data for any purpose not authorized by Party A and will limit internal access to such data on a need-to-know basis.

Party A:

By:

Date:

Party B:

By:

Date:

What the Identity Theft Prevention Program is and why it matters

An Identity Theft Prevention Program is an organized set of written policies and procedures designed to detect, prevent, and respond to identity theft risks that affect an organization’s customers, employees, or accounts. It typically documents covered accounts, methods for verifying identity, red-flag indicators, incident response steps, vendor oversight, and training requirements. The program serves as both a practical operations manual and a compliance record showing the steps taken to safeguard personal data and account integrity.

Primary reasons to adopt a formal program

A documented Identity Theft Prevention Program reduces fraud exposure, standardizes verification practices, and helps demonstrate due diligence to regulators, customers, and business partners. It clarifies roles, preserves evidence of training, and centralizes incident response procedures.

Organizations and roles that commonly maintain these programs

Typical owners include compliance officers, data protection leads, and security teams responsible for customer or employee account integrity.

Financial institutions and lenders who manage consumer and commercial accounts subject to identity-based fraud risk.
Healthcare providers and billing offices that verify patient identity and protect protected health information (PHI).
Human resources and payroll teams that must confirm worker identity and maintain employment records.

Smaller businesses may assign program responsibilities to an operations manager or outsource specific tasks to compliance vendors, but the written program should always identify a responsible party.

Core components of a professional Identity Theft Prevention Program

A complete program combines preventive controls, detection processes, and documented response actions so the organization can both reduce risk and show regulatory compliance.

Risk Assessment

Periodic inventory and risk scoring for covered accounts, data flows, and third-party dependencies to prioritize controls and monitoring.

Identity Verification

Defined methods (ID document checks, knowledge-based verification, multi-factor authentication) and required evidence for new and changing accounts.

Red-Flag Detection

A catalog of indicators (suspicious documents, account changes, inconsistent data) and automated or manual monitoring procedures.

Response Procedures

Step-by-step incident handling, containment, consumer notification, and remediation workflows tied to escalation matrices and timelines.

Training

Regular staff training and competency checks that cover detection, reporting obligations, and use of verification tools.

Vendor Oversight

Contractual requirements, due diligence, and periodic audits for third parties that access or process identity data.

Essential information the program must document

Personal identifiers: Names, SSNs, DOBs

Account data: Account numbers, credentials

Authentication logs: Access timestamps, IPs

Incident records: Incident summaries

Third-party details: Vendor names, access scope

Retention dates: Retention schedule entries

Step-by-step: creating or updating your program

Follow this sequence to assemble a usable program document that operational teams can apply consistently.

01

Inventory accounts: List account types and associated identity risks.
02

Select controls: Choose verification and monitoring methods per account.
03

Document procedures: Write red-flag checks and incident steps clearly.
04

Train and test: Run tabletop exercises and update as needed.

Configuring the document workflow for online completion

Map each program step to an electronic workflow so reviewers, approvers, and auditors follow the same sequence.

Field	Configuration
Program Title	Required text field, single-line
Approval Routing	Role-based sequential routing
Signature Method	eSignature with audit trail
Retention Policy	Auto-archive per schedule

Where to file, submit, and distribute the program

Decide central storage, distribution lists, and required recipients so every change is tracked and accessible to stakeholders.

Central Repository: Store approved program version in a secure document management system.
Distribution List: Notify compliance, legal, HR, and affected business units.
Regulatory Filing: Submit copies to regulators only where statutorily required.
Internal Posting: Publish summary and training materials on intranet.

Digital signing and technical requirements for e-submission

Use an eSignature platform that provides tamper-evident audit trails, configurable authentication, and secure storage for program records.

Authentication: Email, SMS OTP, or stronger MFA
Audit Trail: Timestamps, IP, signer attribution
Integrations: CRM, cloud storage, and SSO

Ensure the chosen platform supports HIPAA/BAA where applicable, retains an immutable audit log for the required retention period, and can export signed records in PDF or archival formats for regulatory review.

Key timelines, review cycles, and processing expectations

Define fixed review dates, periodic testing intervals, and expected response SLAs so stakeholders understand timing obligations.

Initial Implementation:

Complete program rollout within 90 days of approval.

Annual Review:

Reassess risk, controls, and covered accounts once per year.

Training Frequency:

Provide staff training at least annually or after major changes.

Incident Acknowledgement:

Acknowledge reported red-flag incidents within 48 hours.

Regulator Responses:

Compile requested records within regulator SLA, typically 30 days.

Consequences of an incomplete or poorly executed program

Regulatory fines: Civil penalties and enforcement actions

Breach costs: Notification and remediation expenses

Legal exposure: Litigation and class-action risk

Operational impact: Service disruption and remediation burden

Reputational harm: Lost customer trust

Credit consequences: Fraud on accounts and remediation costs

Practical scenarios that illustrate common program uses

These concise examples show how different organizations apply program elements to reduce identity risk and document compliance.

Case: Community Bank

A regional bank standardized identity checks for new accounts

Automated KBA and ID verification for remote applicants reduced onboarding risk
The bank documented workflows, trained branch staff, and retained signed policies for examiner review.

Case: Medical Group

A multisite clinic added identity verification to patient portal enrollment

Staff use photographed ID plus record matching for new accounts
The program includes vendor BAAs, incident procedures, and annual staff retraining.

Common mistakes to avoid when preparing the program

Vague scope that fails to list covered account types and triggers for identity checks, creating inconsistent application.
Missing responsible owner or contact information, which delays incident response and regulatory reporting.
Overreliance on single controls such as passwords without multi-factor options for remote transactions.
Failure to document vendor access and oversight, leaving third-party risk unmanaged and unprovable.

Practical tips for accurate and efficient completion

Use clear language, consistent naming, and version control to make the program easy to apply and audit.

Standardize verification processes

Define one approved method per account type and record required evidence to avoid ad hoc decisions and inconsistent treatment by staff.

Assign clear ownership

Name a responsible officer with contact details and document their authority to approve changes and coordinate incident responses.

Automate where appropriate

Use scripted checks and digital audit trails for high-volume verification tasks to reduce manual error and preserve evidence.

Test and train regularly

Conduct tabletop exercises and refresher training annually or after material process changes to maintain readiness.

eSignature vendor comparison for signing and distributing the program

A neutral comparison of typical plan features and pricing for electronic signature vendors; signNow is listed first per table conventions.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No
Envelope Cap	No cap	100 envelopes/user/year	Varies	Varies	Varies

FAQs about the Identity Theft Prevention Program

Answers to common questions about requirements, e-signing, retention, and authority to help clarify next steps and compliance expectations.

Need help? Contact support

Is a written program required?
Many regulators and industry standards expect a written program when identity theft risk is material. Financial firms should review the FTC Red Flags Rule and GLBA guidance; healthcare organizations should align controls with HIPAA.
Can the program be signed electronically?
Yes. Electronic signatures are legally enforceable under the ESIGN Act (15 U.S.C. §7001) and by UETA in most states, provided the signature method meets intent, consent, attribution, and retention requirements.
Who should sign the program?
The designated responsible officer or senior executive with authority over compliance or operations should sign. The signature line should identify role and date to show accountability.
How often must it be updated?
Update at least annually and after material changes in operations, vendor relationships, or applicable laws; document each revision and retain prior signed versions.
What records must be retained?
Keep signed program versions, training logs, incident records, and verification evidence according to retention schedules; HIPAA records require 6 years (45 CFR §164.530(j)), federal tax records 3 years (IRC §6501(a)).
How to report identity theft incidents?
Follow the program’s incident response steps: contain the incident, preserve evidence, notify affected parties as required by law, and record remediation actions and timelines.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now