Congress exempts pharmacies from ‘red flags’ rule