The answer is "probably."
In November 2007, the Federal Trade Commission issued a set of regulations known as the "Red Flags Rule" requiring certain entities implement written identity theft prevention and detection programs. The Rule was supposed to go into effect in November 2008, but thanks to outcry from business trade groups like the American Medical Association and the American Institute of Certified Public Accountants, the effective date has been delayed several times. The Rule now goes into effect June 1, 2010.