Specifically, this policy outlines how [physician practice name] will (1) identify, (2) detect and (3) respond to “red flags.” A “red flag” as defined by this policy includes a pattern, practice, or specific account or record activity that indicates possible identity theft.