[Federal Register: April 28, 2004 (Volume 69, Number 82)]
[Proposed Rules]               
[Page 23379-23407]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr28ap04-25]                         


[[Page 23379]]

  
  
  
  
  
  
-----------------------------------------------------------------------


Part V

Department of the Treasury



Office of the Comptroller of the Currency



12 CFR Part 41



Office of Thrift Supervision

12 CFR Part 571



-----------------------------------------------------------------------
Federal Reserve System

12 CFR Part 222



-----------------------------------------------------------------------
Federal Deposit Insurance Corporation

12 CFR Part 334



-----------------------------------------------------------------------
National Credit Union Administration

12 CFR Part 717



-----------------------------------------------------------------------



Fair Credit Reporting Medical Information Regulations; Proposed Rule


[[Page 23380]]


-----------------------------------------------------------------------

DEPARTMENT OF THE TREASURY

Office of the Comptroller of the Currency

12 CFR Part 41

[Docket No. 04-09]
RIN 1557-AC85

FEDERAL RESERVE SYSTEM

12 CFR Part 222

[Regulation V; Docket No. R-1188]

FEDERAL DEPOSIT INSURANCE CORPORATION

12 CFR Part 334

RIN 3064-AC81

DEPARTMENT OF THE TREASURY

Office of Thrift Supervision

12 CFR Part 571

[No. 2004-16]
RIN 1550-AB88

NATIONAL CREDIT UNION ADMINISTRATION

12 CFR Part 717

 
Fair Credit Reporting Medical Information Regulations

AGENCIES: Office of the Comptroller of the Currency, Treasury (OCC); 
Board of Governors of the Federal Reserve System (Board); Federal 
Deposit Insurance Corporation (FDIC); Office of Thrift Supervision, 
Treasury (OTS); National Credit Union Administration (NCUA).

ACTION: Notice of proposed rulemaking.

-----------------------------------------------------------------------

SUMMARY: The OCC, Board, FDIC, OTS, and NCUA (Agencies) are publishing 
for comment proposed regulations implementing section 411 of the Fair 
and Accurate Credit Transactions Act of 2003 (FACT Act). Public Law 
108-159, 117 Stat. 1952. The FACT Act substantially amends the Fair 
Credit Reporting Act (FCRA or Act), 15 U.S.C. 1681 et seq. Section 
411(a) of the FACT Act adds a new section 603(g)(1) to the FCRA to 
restrict the circumstances under which consumer reporting agencies may 
furnish consumer reports that contain medical information about 
consumers. Section 411(a) of the FACT Act also adds a new section 
604(g)(2) to the FCRA to prohibit creditors from obtaining or using 
medical information pertaining to a consumer in connection with any 
determination of the consumer's eligibility, or continued eligibility, 
for credit. The Agencies are required to prescribe regulations that 
permit creditors to obtain or use medical information for eligibility 
purposes where necessary and appropriate to protect legitimate 
operational, transactional, risk, consumer, and other needs, consistent 
with the Congressional intent to restrict the use of medical 
information for inappropriate purposes.
    In addition, section 411(b) of the FACT Act adds a new section 
603(d)(3) to the FCRA to restrict the sharing of medical information 
and related lists or descriptions with affiliates. Specifically, 
section 603(d)(3) provides that the standard exclusions from the 
definition of ``consumer report'' contained in section 603(d)(2)--such 
as sharing transaction or experience information about a consumer among 
affiliates or sharing other information among affiliates after 
providing the consumer notice and an opportunity to opt-out--do not 
apply if medical-related information is disclosed to an affiliate. 
Medical-related information includes medical information, an 
individualized list or description based on payment transactions for 
medical products or services, or an aggregate list of identified 
consumers based on payment transactions for medical products or 
services. The provisions of section 603(d)(3) do not apply if the 
sharing falls within certain exceptions, such as in connection with the 
business of insurance or annuities or for any purpose described in 
section 502(e) of the Gramm-Leach-Bliley Act (GLB Act), Public Law 106-
102. Section 411(b) authorizes the Agencies to promulgate additional 
exceptions by regulation or order, as determined by the Agencies to be 
appropriate or necessary.
    The Agencies generally provide a 60-day period for the public to 
comment on the burdens associated with proposed rules. In this case, 
however, the Agencies believe that a 30-day comment period is 
appropriate because the statute was enacted in December 2003 and 
imposes a statutory deadline for the final rule of June 4, 2004.

DATES: Comments must be received by May 28, 2004.

ADDRESSES: Comments should be directed to:
    OCC: You should designate OCC in your comment and include Docket 
Number 04-09. Because paper mail in the Washington, DC, area and at the 
OCC may be subject to delays, please submit your comments by e-mail or 
fax whenever possible. You may submit comments by any of the following 
methods:
     Federal eRulemaking Portal: http://www.regulations.gov.
 Follow the instructions for submitting comments.

     OCC Web site: http://www.occ.treas.gov. Click on 

``Contact the OCC,'' scroll down and click on ``Comments on proposed 
regulations.''
     Fax: (202) 874-4448.
     Mail: Office of the Comptroller of the Currency, 
250 E Street, SW., Public Information Room, Mail Stop 1-5, Washington, 
DC 20219.
     Hand Delivery/Courier: 250 E Street, SW., Attn: 
Public Information Room, Mail Stop 1-5, Washington, DC 20219.
    Instructions: All submissions received must include the agency name 
(OCC) and docket number or Regulatory Information Number (RIN) for this 
notice of proposed rulemaking. In general, the OCC will enter all 
comments received into the docket without change, including any 
business or personal information that you provide.
     Docket: For access to the docket to read 
background documents or comments received you may:
     View docket information in person: You may 
personally inspect and photocopy docket information at the OCC's Public 
Information Room, 250 E Street, SW., Washington, DC. You can make an 
appointment to inspect the docket by calling (202) 874-5043.
     View docket information electronically: You may 
request that we send electronic copies of docket information to you via 
e-mail or mail you a CD-ROM containing electronic copies by contacting 
the OCC at regs.comments@occ.treas.gov.
     Request copies: You may request copies of docket 
information by fax at (202) 874-4448, mailing the OCC at 250 E Street, 
SW., Attn: Public Information Room, Mail Stop 1-5, Washington, DC 
20219, or by contacting us at (202) 874-5043.
    Board: You may submit comments, identified by Docket No. R-1188, by 
any of the following methods:
     Agency Web site: http://www.federalreserve.gov Follow the instructions for submitting comments at http://.

http://www.federalreserve.gov/generalinfo/foia/ProposedRegs.cfm.

     Federal eRulemaking Portal: http://www.regulations.gov.
 Follow the instructions for submitting comments.

     E-mail: regs.comments@federalreserve.gov. 
Include docket number in the subject line of the message.

[[Page 23381]]

     Fax: 202/452-3819 or 202/452-3102.
     Mail: Jennifer J. Johnson, Secretary, Board of 
Governors of the Federal Reserve System, 20th Street and Constitution 
Avenue, NW., Washington, DC 20551.
    All public comments are available from the Board's Web site at 
http://www.federalreserve.gov/generalinfo/foia/ProposedRegs.cfm as submitted, 

except as necessary for technical reasons. Accordingly, your comments 
will not be edited to remove any identifying or contact information. 
Public comments may also be viewed electronically or on paper in Room 
MP-500 of the Board's Martin Building (20th and C Streets, NW.) between 
9 a.m. and 5 p.m. on weekdays.
    FDIC: You may submit comments, identified by RIN number by any of 
the following methods:
     Agency Web site: http://www.fdic.gov/regulations/laws/federal/propose.html.
 Follow instructions for 

submitting comments on the Agency Web site.
     E-Mail: Comments@FDIC.gov. Include the RIN 
number in the subject line of the message.
     Mail: Robert E. Feldman, Executive Secretary, 
Attention: Comments, Federal Deposit Insurance Corporation, 550 17th 
Street, NW., Washington, DC 20429.
     Hand Delivery/Courier: Guard station at the rear 
of the 550 17th Street Building (located on F Street) on business days 
between 7 a.m. and 5 p.m.
     Instructions: All submissions received must 
include the agency name and RIN for this rulemaking. All comments 
received will be posted without change to http://www.fdic.gov/regulations/laws/federal/propose.html
 including any personal 

information provided.
    OTS: You may submit comments, identified by docket number 2004-16, 
by any of the following methods:
     Federal eRulemaking Portal: http://www.regulations.gov.
 Follow the instructions for submitting comments.

     E-mail address: regs.comments@ots.treas.gov. 
Please include docket number 2004-16 in the subject line of the message 
and include your name and telephone number in the message.
     Fax: (202) 906-6518.
     Mail: Regulation Comments, Chief Counsel's 
Office, Office of Thrift Supervision, 1700 G Street, NW., Washington, 
DC 20552, Attention: No. 2004-xx.
     Hand Delivery/Courier: Guard's Desk, East Lobby 
Entrance, 1700 G Street, NW., from 9 a.m. to 4 p.m. on business days, 
Attention: Regulation Comments, Chief Counsel's Office, Attention: No. 
2004-xx.
    Instructions: All submissions received must include the agency name 
and docket number or Regulatory Information Number (RIN) for this 
rulemaking. All comments received will be posted without change to the 
OTS Internet site at http://www.ots.treas.gov, including any personal 

information provided.
    Docket: For access to the docket to read background documents or 
comments received, go to http://www.ots.treas.gov/pagehtml.cfm?catNumber=67&an=1.
 In addition, you may inspect comments 

at the Public Reading Room, 1700 G Street, NW., by appointment. To make 
an appointment for access, call (202) 906-5922, send an e-mail to 
public.info@ots.treas.gov, or send a facsimile transmission to (202) 

906-7755. (Prior notice identifying the materials you will be 
requesting will assist us in serving you.) We schedule appointments on 
business days between 10 a.m. and 4 p.m. In most cases, appointments 
will be available the next business day following the date we receive a 
request.
    NCUA: You may submit comments by any of the following methods 
(Please send comments by one method only):
     Federal eRulemaking Portal: http://www.regulations.gov.
 Follow the instructions for submitting comments.

     NCUA Web site: http://www.ncua.gov/news/proposed_regs/proposed_regs.html.
 Follow the instructions for 

submitting comments.
     E-mail: Address to regcomments@ncua.gov. Include 
``[Your name] Comments on Proposed Rule Part 717, Fair Credit 
Reporting--Medical Information'' in the e-mail subject line.
     Fax: (703) 518-6319. Use the subject line 
described above for e-mail.
     Mail: Address to Becky Baker, Secretary of the 
Board, National Credit Union Administration, 1775 Duke Street, 
Alexandria, Virginia 22314-3428.
     Hand Delivery/Courier: Becky Baker, Secretary of 
the Board, National Credit Union Administration, 1775 Duke Street, 
Alexandria, Virginia 22314-3428.

FOR FURTHER INFORMATION CONTACT:
    OCC: Amy Friend, Assistant Chief Counsel, (202) 874-5200; Michael 
Bylsma, Director, or Stephen Van Meter, Assistant Director, Community 
and Consumer Law, (202) 874-5750; Patrick T. Tierney, Attorney, 
Legislative and Regulatory Activities Division, (202) 874-5090; or 
Carol Turner, Compliance Specialist, Compliance Department, (202) 874-
4858, Office of the Comptroller of the Currency, 250 E Street, SW., 
Washington, DC 20219.
    Board: David A. Stein, Counsel; Minh-Duc T. Le, Ky Tran-Trong, or 
Krista P. DeLargy, Senior Attorneys, Division of Consumer and Community 
Affairs, (202) 452-3667 or (202) 452-2412; or Andrew Miller, Counsel, 
Legal Division, (202) 452-3428, Board of Governors of the Federal 
Reserve System, 20th and C Streets, NW., Washington, DC 20551.
    FDIC: Robert A. Patrick, Counsel, (202) 898-3757, or Richard M. 
Schwartz, Counsel, Legal Division, (202) 898-7424; David LaFleur, 
Policy Analyst, (202) 898-6569, or Patricia Cashman, Senior Policy 
Analyst, Division of Supervision and Consumer Protection, (202) 898-
6534, Federal Deposit Insurance Corporation, 550 17th Street, NW., 
Washington, DC 20429.
    OTS: Elizabeth Baltierra, Program Analyst (Compliance), Compliance 
Policy, (202) 906-6540; Richard Bennett, Counsel (Banking and Finance), 
(202) 906-7409; or Paul Robin, Special Counsel, Regulations and 
Legislation Division, (202) 906-6648, Office of Thrift Supervision, 
1700 G Street, NW., Washington, DC 20552.
    NCUA: Regina M. Metz, Staff Attorney, Office of General Counsel, 
(703) 518-6540, National Credit Union Administration, 1775 Duke Street, 
Alexandria, VA 22314-3428.

SUPPLEMENTARY INFORMATION:

I. Background

    On December 4, 2003, the President signed into law the FACT Act, 
which amends the FCRA. Public Law 108-159, 117 Stat. 1952. In general, 
the FACT Act contains provisions designed to enhance the ability of 
consumers to combat identity theft, increase the accuracy of consumer 
reports, and allow consumers to exercise greater control regarding the 
type and amount of marketing solicitations they receive. Section 411 of 
the FACT Act limits the ability of creditors to obtain or use, of 
consumer reporting agencies to disclose, and of affiliates to share 
medical information.
    Section 411(a) of the FACT Act adds a new section 604(g)(1) to the 
FCRA to restrict the circumstances under which consumer reporting 
agencies may furnish consumer reports that contain medical information 
about consumers. Specifically, under new section 604(g)(1), a consumer 
reporting agency may not furnish a consumer report that contains 
medical information about a consumer unless:
    (1) The report is furnished in connection with an insurance 
transaction, and the consumer

[[Page 23382]]

affirmatively consents to the furnishing of the report;
    (2) The report is furnished for employment purposes or in 
connection with a credit transaction, the information to be furnished 
is relevant to process or effect the employment or credit transaction, 
and the consumer provides specific written consent for the furnishing 
of the report that describes in clear and conspicuous language the use 
for which the information will be furnished; or
    (3) The information to be furnished pertains solely to 
transactions, accounts, or balances relating to debts arising from the 
receipt of medical services, products, or devices, where such 
information, other than account status or amounts, is restricted or 
reported using codes that do not identify, or do not provide 
information sufficient to infer, the specific provider or the nature of 
such services, products, or devices.
    Section 411(c) of the FACT Act revises the definition of ``medical 
information'' in section 603(i) to mean information or data, whether 
oral or recorded, in any form or medium, created by or derived from a 
health care provider or the consumer, that relates to the past, 
present, or future physical, mental, or behavioral health or condition 
of an individual, the provision of health care to an individual, or the 
payment for the provision of health care to an individual. The 
definition further provides that the term ``medical information'' does 
not include the age or gender of a consumer, demographic information 
about the consumer, including a consumer's residence address or e-mail 
address, or any other information about a consumer that does not relate 
to the physical, mental, or behavioral health or condition of a 
consumer, including the existence or value of any insurance policy.
    Section 411(a) also amends the FCRA by adding new section 604(g)(2) 
to prohibit creditors from obtaining or using medical information 
pertaining to a consumer in connection with any determination of the 
consumer's eligibility, or continued eligibility, for credit. Section 
604(g)(2) contains two independent prohibitions--a prohibition on 
obtaining medical information and a prohibition on using medical 
information. The statute contains no prohibition, however, on obtaining 
or using medical information other than in connection with a 
determination of the consumer's eligibility, or continued eligibility, 
for credit. Thus, section 604(g)(2) does not prohibit a creditor from 
obtaining medical information for employment purposes, in connection 
with a determination of a consumer's eligibility for an insurance 
product or through processing payments for a consumer, maintaining a 
consumer's account, or performing similar functions. Nevertheless, a 
creditor that obtains medical information in these circumstances may 
not use that information in connection with a determination of the 
consumer's eligibility, or continued eligibility, for credit. For 
example, medical information about a consumer obtained and used by a 
creditor for employment purposes may not subsequently be used in 
connection with any determination of the consumer's eligibility, or 
continued eligibility, for credit. New section 604(g)(5)(A) requires 
the Agencies to prescribe regulations that permit transactions that are 
determined to be necessary and appropriate to protect legitimate 
operational, transactional, risk, consumer, and other needs (including 
administrative verification purposes), consistent with congressional 
intent to restrict the use of medical information for inappropriate 
purposes.
    Section 411(b) of the FACT Act adds a new section 603(d)(3) to the 
FCRA to restrict the sharing of medical-related information with 
affiliates if that information meets the definition of ``consumer 
report'' in section 603(d)(1) of the FCRA. Specifically, section 
603(d)(3) provides that the standard exclusions from the definition of 
``consumer report'' contained in section 603(d)(2)--such as sharing 
transaction or experience information among affiliates or sharing other 
eligibility information among affiliates after notice and an 
opportunity to opt-out--do not apply if medical-related information is 
disclosed to an affiliate. Medical-related information includes medical 
information, as described above, as well as an individualized list or 
description based on payment transactions for medical products or 
services, and an aggregate list of identified consumers based on 
payment transactions for medical products or services.
    New section 604(g)(3) provides several exceptions that allow 
creditors to disclose medical information to affiliates according to 
the same rules that apply to other non-medical information. In 
particular, section 604(g)(3) provides that medical-related information 
that is transaction or experience information or that is subject to the 
FCRA affiliate sharing opt-out provisions or other standard exclusions 
in section 603(d)(2) may be shared with an affiliate of the creditor if 
the information is disclosed to an affiliate:
    (1) In connection with the business of insurance or annuities 
(including the activities described in section 18B of the model Privacy 
of Consumer Financial and Health Information Regulation issued by the 
National Association of Insurance Commissioners, as in effect on 
January 1, 2003);
    (2) For any purpose permitted without authorization under the 
Standards for Individually Identifiable Health Information promulgated 
by the Department of Health and Human Services (HHS) pursuant to the 
Health Insurance Portability and Accountability Act of 1996 (HIPAA);
    (3) For any purpose referred to under section 1179 of HIPAA;
    (4) For any purpose described in section 502(e) of the Gramm-Leach-
Bliley Act; or
    (5) As otherwise determined to be necessary and appropriate, by 
regulation or order, by the Federal Trade Commission (FTC), the 
Agencies, or an applicable State insurance authority.
    Section 604(g)(4), as added by section 411(a)(4) of the FACT Act, 
also provides that any person that receives medical information from an 
affiliate pursuant to an exception in section 604(g)(3) or from a 
consumer reporting agency under section 604(g)(1) must not disclose 
such information to any other person, except as necessary to carry out 
the purpose for which the information was initially disclosed, or as 
otherwise permitted by statute, regulation, or order.

II. Proposed Rule

    The rule proposed by the Agencies would do two things. First, the 
proposed regulations would create exceptions to the general prohibition 
against obtaining or using medical information in connection with 
credit eligibility determinations, as required by section 604(g)(5)(A). 
The Agencies believe the proposed exceptions are necessary and 
appropriate to protect legitimate operational, transactional, risk, 
consumer, and other needs (including administrative verification 
purposes), and are consistent with the congressional intent to restrict 
the use of medical information for inappropriate purposes. Second, the 
proposed regulations would, as permitted by section 604(g)(3)(C), 
create additional exceptions to the special restrictions in section 
603(d)(3) on sharing medical-related information with affiliates that 
the Agencies believe are necessary and appropriate. The proposed 
regulations are discussed in more detail in the Section-by-Section 
Analysis below. The Agencies invite comment on all aspects of the 
proposal.

[[Page 23383]]

III. Section-by-Section Analysis

Section ----.1 Purpose, Scope, and Effective Dates

    Proposed Sec.  ----.1(b)(2) describes the institutions covered by 
the provisions of the regulations of each of the respective Agencies.

Section ----.2 Examples

    Proposed Sec.  ----.2 Discusses the Scope and Effect of the 
Examples Included in the Proposed Regulation.

Section ----.3 Definitions

    Proposed Sec.  ----.3 contains definitions for the terms 
``affiliate'' (as well as the related terms ``company'' and 
``control''), ``consumer,'' ``medical information,'' and ``you.''
Affiliate
    Several FCRA provisions apply to information sharing with persons 
``related by common ownership or affiliated by corporate control,'' 
``related by common ownership or affiliated by common corporate 
control,'' or ``affiliated by common ownership or common corporate 
control.'' E.g., FCRA, sections 603(d)(2), 615(b)(2), and 624(b)(2). 
Section 2 of the FACT Act defines the term ``affiliate'' to mean 
persons that are related by common ownership or affiliated by corporate 
control. Proposed paragraph (b) simplifies these various formulations 
by defining ``affiliate'' to mean any company that controls, is 
controlled by, or is under common control with another company. The 
proposed definition is identical to the definition of ``affiliate'' in 
the GLB Act privacy regulations.\1\ Consistent with the definitions in 
the privacy regulations and the practical application of the FCRA, the 
proposal uses a definition of ``control'' that applies exclusively to 
the control of a ``company,'' and defines ``company'' to include any 
corporation, limited liability company, business trust, general or 
limited partnership, association, or similar organization. See proposed 
paragraphs (d) (``company'') and (i) (``control'').\2\ The definition 
of ``company'' omits some entities that are ``persons'' under the 
FCRA--individuals, estates, cooperatives, governments, and government 
in which ``control'' could be exercised over individuals, government 
agencies, and other persons that do not fit within the definition of 
``company.''
---------------------------------------------------------------------------

    \1\ For purposes of the proposed regulation, an ``affiliate'' 
includes an operating subsidiary of a bank or savings association, 
and a credit union service organization that is controlled by a 
federal credit union.
    \2\ For purposes of the proposed regulation, NCUA will presume a 
federal credit union has a controlling influence over the management 
or policies of a credit union service organization if it is 67 
percent owned by credit unions.
---------------------------------------------------------------------------

Medical Information
    Under proposed paragraph (k), the term ``medical information'' 
means information or data, whether oral or recorded, in any form or 
medium, created by or derived from a health care provider or the 
consumer, that relates to (1) the past, present, or future physical, 
mental, or behavioral health or condition of an individual; (2) the 
provision of health care to an individual; or (3) the payment for the 
provision of health care to an individual. The term ``medical 
information'' does not include the age or gender of a consumer, 
demographic information about the consumer, including a consumer's 
residence address or e-mail address, or any other information about a 
consumer that does not relate to the physical, mental, or behavioral 
health or condition of a consumer, including the existence or value of 
any insurance policy. The proposal tracks the statutory definition of 
``medical information.''
    Creditors are reminded that other laws, such as the Americans with 
Disabilities Act, the Fair Housing Act, the GLB Act, and other parts of 
the FCRA, may limit or regulate the use, collection, and sharing of 
consumer information, including medical information. In particular, 
these and other laws, such as the Equal Credit Opportunity Act, also 
may prohibit creditors from using certain information that is excluded 
from the restrictions on obtaining or using medical information, such 
as age or gender information, in determining eligibility for credit or 
for other purposes.

Section ----.30 Obtaining and Using Medical Information in Connection 
With a Determination of Eligibility for Credit

    Section 411(a) of the FACT Act adds a broad new limitation on the 
ability of creditors to obtain medical information in connection with 
credit eligibility determinations or to use medical information in 
connection with credit eligibility determinations. Specifically, new 
section 604(g)(2) provides, that except as permitted by regulations, a 
creditor shall not obtain or use medical information pertaining to a 
consumer in connection with any determination of the consumer's 
eligibility, or continued eligibility, for credit.
A. General Prohibition on Obtaining or Using Medical Information
    Proposed Sec.  ----.30 contains the rules on obtaining or using 
medical information in connection with a determination of a consumer's 
eligibility, or continued eligibility, for credit. Proposed paragraph 
(a)(1) incorporates the general rule prohibiting creditors from 
obtaining or using medical information pertaining to a consumer in 
connection with any determination of a consumer's eligibility, or 
continued eligibility, for credit, except as provided in the 
regulations under Subpart D. The consumer's eligibility for credit 
typically would be determined when an initial decision is made on 
whether to grant or deny credit to the consumer. A determination of a 
consumer's continued eligibility for credit may also include decisions 
whether to terminate an account or adjust a credit limit following an 
account review.
    Proposed paragraph (a)(2) clarifies the definition of certain terms 
used in Subpart D, including ``credit'' and ``creditor.'' In addition, 
paragraph (a)(2) provides that the phrase ``eligibility, or continued 
eligibility, for credit'' means the consumer's qualification or fitness 
to receive, or continue to receive, credit, including the terms on 
which credit is offered, primarily for personal, family, or household 
purposes.
    The paragraph also clarifies that the phrase ``eligibility, or 
continued eligibility, for credit'' does not include the consumer's 
qualification or fitness to be offered employment, insurance products, 
or other non-credit products or services. Similarly, ``eligibility, or 
continued eligibility, for credit'' does not include a determination of 
whether the provisions of a debt cancellation contract, debt suspension 
agreement, credit insurance product, or similar forbearance practice or 
program are triggered. A forbearance practice or program may include 
circumstances in which a creditor allows a consumer to skip one or more 
scheduled payments because the consumer is hospitalized for a medical 
condition. For example, if a consumer is hospitalized on an emergency 
basis and is temporarily unable to pay his mortgage, the consumer's 
daughter may contact the consumer's mortgage lender by telephone, 
inform the lender of the consumer's medical condition, and request that 
the lender allow the deferral of one or more payments to accommodate 
the consumer's particular circumstances. The creditor's use of the 
medical information provided by the consumer's daughter to defer one or 
more mortgage payments to accommodate the consumer's particular 
circumstances would constitute a forbearance that is beyond the scope 
of the prohibition.

[[Page 23384]]

    Comment is requested on whether it is more appropriate to grant an 
exception to permit creditors to obtain and use medical information in 
connection with debt cancellation, debt suspension, or credit insurance 
products or practices, rather than issuing an interpretation that 
obtaining information necessary to trigger coverage under these 
products falls outside any determination of eligibility, or continued 
eligibility, for credit. In addition, comment is solicited on whether a 
separate exception for accommodating the particular medical condition 
or circumstances of the consumer should be created in lieu of or in 
addition to the interpretation that eligibility, or continued 
eligibility, for credit does not include forbearance.
    The proposed regulation also provides that the term ``eligibility, 
or continued eligibility, for credit'' does not include authorizing, 
processing, or documenting a payment or transaction on behalf of a 
consumer in a manner that does not involve a determination of the 
consumer's eligibility, or continued eligibility, for credit. Finally, 
the term ``eligibility, or continued eligibility, for credit'' does not 
include maintaining or servicing a consumer's account in a manner that 
does not involve a determination of the consumer's eligibility, or 
continued eligibility, for credit.
    The Agencies note that section 604(g)(2) contains two distinct 
prohibitions--one on obtaining medical information and one on using 
medical information. Nothing in the statute prohibits a creditor from 
obtaining medical information if the information is not obtained in 
connection with a determination of the consumer's eligibility, or 
continued eligibility, for credit. Thus, there is no prohibition, for 
example, on a creditor obtaining medical information through 
authorizing, processing, or documenting a payment or transaction on 
behalf of the consumer, or managing or servicing the consumer's 
account. Nevertheless, a creditor that has obtained medical information 
in these circumstances may not use that information in connection with 
a determination of the consumer's eligibility, or continued 
eligibility, for credit, unless permitted by an exception provided in 
the regulations. However, there is no prohibition in section 411 of the 
FACT Act on a person that is a creditor from obtaining or using medical 
information for an employment purpose or in connection with a 
determination of the consumer's eligibility for an insurance product.
B. Receiving Unsolicited Medical Information
    Creditors may receive unsolicited medical information without 
specifically asking for such information. This may occur, for example, 
when a consumer informs the loan officer that she needs a loan to pay 
for treatment for a particular medical condition, or when a consumer, 
in response to a general request on a credit application for 
information about outstanding debts, lists debts owed to hospitals and 
doctors for medical services. The Agencies do not believe that a 
creditor violates the prohibition on obtaining medical information when 
the creditor does not specifically ask for or request such information, 
yet the consumer or other person provides that information to the 
creditor. However, because the statutory prohibition on obtaining 
medical information could be interpreted broadly to cover circumstances 
in which medical information is obtained by a creditor without asking 
for it, the Agencies have proposed a rule of construction to make clear 
that a creditor does not violate the prohibition on obtaining medical 
information if the creditor receives unsolicited medical information.
    Proposed paragraph (b) contains this rule of construction for 
receiving unsolicited medical information. Under proposed paragraph 
(b)(1), a creditor does not obtain medical information for purposes of 
proposed paragraph (a)(1) if it receives medical information pertaining 
to a consumer in connection with any determination of the consumer's 
eligibility, or continued eligibility, for credit without specifically 
requesting medical information, and does not use that information in 
determining whether to extend credit to the consumer and the terms on 
which credit is offered or continued. Paragraph (b)(2) provides 
examples for guidance. The Agencies seek comment on the appropriateness 
of this rule of construction and on whether this provision should be 
drafted as an exception to the general prohibition, rather than as a 
rule of construction.
C. Financial Information Exception for Obtaining and Using Medical 
Information
    As noted above, new section 604(g)(5)(A) of the Act gives the 
Agencies the authority to prescribe regulations, after notice and 
opportunity for comment, to permit creditors to obtain and use medical 
information in connection with determinations of credit eligibility 
that the Agencies determine to be necessary and appropriate to protect 
legitimate operational, transactional, risk, consumer, and other needs 
(including actions necessary for administrative verification purposes), 
consistent with the intent of the statute to restrict the use of 
medical information for inappropriate purposes. Applying this standard, 
the Agencies believe it is necessary and appropriate to permit 
creditors to obtain and use medical information in a number of 
circumstances.
    Proposed Sec. Sec.  ----.30(c)-(d) contain exceptions to the 
general prohibition on creditors obtaining or using medical 
information. Proposed paragraph (c) contains the first exception, and 
provides that a creditor may obtain and use medical information 
pertaining to a consumer in connection with any determination of the 
consumer's eligibility, or continued eligibility, for credit so long as 
the following three elements are met. First, the information must 
relate to debts, expenses, income, benefits, collateral, or the purpose 
of the loan, including the use of proceeds. Second, the creditor must 
use the information in a manner and to an extent no less favorable than 
it would use comparable information that is not medical information in 
a credit transaction. Third, the creditor must not take the consumer's 
physical, mental, or behavioral health, condition or history, type of 
treatment, or prognosis into account as part of any such determination 
of credit eligibility. This three-part test strikes a balance between 
permitting creditors to obtain and use certain medical information 
about consumers when necessary and appropriate to satisfy prudent 
underwriting criteria and to ensure that credit is extended in a safe 
and sound manner, while restricting the use of medical information for 
inappropriate purposes.
    The first element of the test identifies certain types of 
information, specifically debts, expenses, income, benefits, 
collateral, or the purpose of the loan, that a creditor ordinarily 
would obtain and evaluate in connection with making a prudent credit 
decision, regardless of whether that information is medical or non-
medical information. A creditor should not be prohibited from obtaining 
or using information about a debt, for example, in connection with 
making a credit decision, just because that debt happens to be for 
medical products or services.
    The second element of the test provides that the creditor must use 
the medical information in a manner and to an extent no less favorable 
than it would use comparable, non-medical

[[Page 23385]]

information in a credit transaction. For example, a creditor may deny 
credit to the consumer because the consumer owes a debt to a hospital 
if the creditor would have denied credit to the consumer if the 
consumer had owed the same amount of debt with the same payment history 
to a retailer. Nothing in the rule prevents the creditor from treating 
information about medical debts (or expenses or income) more favorably 
than non-medical debts.
    The third element of the test provides that the creditor may not 
take the consumer's physical, mental, or behavioral health, condition, 
or history, type of treatment, or prognosis into account as part of any 
determination of the consumer's eligibility, or continued eligibility, 
for credit. For example, the consumer may owe a debt to a hospital or 
other facility that specializes in treating a potentially terminal 
disease. While the creditor may evaluate the debt to the hospital or 
facility in the same manner and to the same extent as it would evaluate 
any non-medical debt, the creditor may not take into account the 
consumer's individual physical, mental, or behavioral health, 
condition, or history, type of treatment, or prognosis in determining 
the consumer's eligibility, or continued eligibility for credit, or the 
terms under which credit will be offered or continued.
    The Agencies seek comment on the financial information exception 
outlined in paragraph (c)(1). In particular, the Agencies seek comment 
on whether each of the three parts of the exception is necessary and 
whether the three parts together strike the right balance between 
permitting creditors to obtain and use medical information where 
necessary and appropriate to protect legitimate operational, 
transactional, risk, consumer, and other needs (including actions 
necessary for administrative verification purposes) and restricting the 
use of medical information for inappropriate purposes.
    Proposed paragraph (c)(2) provides several examples of when 
creditors generally may obtain and use medical information under the 
financial information exception in proposed paragraph (c)(1). These 
examples in proposed paragraph (c)(2) are not exclusive. The Agencies 
seek comment on all of the examples in proposed paragraph (c)(2), 
including whether any of the examples should be amended or deleted, or 
whether additional examples should be provided.
    Proposed paragraph (c)(2)(i) provides examples of the circumstances 
in which medical information would relate to debts, expenses, income, 
benefits, collateral, or the purpose of the loan, including the use of 
proceeds. A creditor would, for example, be able to obtain and use 
medical information about--
     The dollar amount, repayment terms, repayment 
history, and similar information regarding medical debts that is used 
to calculate, measure, or verify the repayment ability of the consumer, 
the use of proceeds, or the terms for granting credit;
     The value, condition, and lien status of a 
medical device that is used as collateral to secure a loan;
     The dollar amount and continued eligibility for 
disability income or benefits related to health or a medical condition 
that is relied on as a source of repayment; or
     The identity of creditors to whom outstanding 
medical debts are owed in connection with an application for credit, 
including but not limited to a transaction involving the consolidation 
of medical debts.
    The Agencies propose to include five additional examples to 
illustrate uses of medical information consistent and inconsistent with 
the financial information exception. Proposed paragraph (c)(2)(ii) 
provides examples of uses of medical information that are consistent 
with the exception. The first example involves a consumer who includes 
two $20,000 debts on an application for credit--one debt to a hospital 
and the other to a retailer. The creditor contacts the hospital and the 
retailer in order to verify the amount and payment status of the debts 
and learns that both are more than 90 days past due. Any two debts of 
this size that are past due would disqualify the consumer under the 
creditor's established underwriting criteria. The creditor decides to 
deny the application on the basis of the consumer's poor repayment 
history on outstanding debts. Under these circumstances, the creditor 
obtains and uses information about medical debts the same way it uses 
information about non-medical debts. Accordingly, the creditor has used 
medical information in a manner consistent with the exception.
    In the second example, a consumer indicates on an application for a 
$200,000 mortgage loan that she receives $15,000 in long-term 
disability income each year from her former employer and has no other 
income. Annual income of $15,000, regardless of source, would not be 
sufficient to support the requested amount of credit. The creditor 
denies the application on the basis that the projected debt-to-income 
ratio of the consumer does not meet the creditor's underwriting 
criteria. In this example, the creditor analyzes the long-term 
disability income, which is medical information, the same way it would 
analyze any other income information of a potential borrower.
    The third example in proposed paragraph (c)(2)(ii) involves a 
consumer who includes on an application for a $10,000 home equity loan 
that he has a $50,000 debt to a medical facility that specializes in 
treating a potentially terminal disease. The creditor contacts the 
medical facility to verify the debt and obtain the repayment history 
and current status of the loan, and learns that the debt is current and 
that the applicant meets the income requirements of the creditor's 
underwriting guidelines. The creditor grants the application. The 
creditor has used medical information in accordance with the exception.
    Proposed paragraph (c)(2)(iii) provides two examples of uses of 
medical information that are inconsistent with the exception. The first 
example involves a consumer who includes on an application for $25,000 
of credit information about a $50,000 debt to a hospital. The creditor 
contacts the hospital to verify the amount and payment status of the 
debt and learns that the debt is current and that the consumer has no 
delinquencies in her repayment history. If the existing debt were 
instead owed to a home furnishing retailer, the creditor would approve 
the application and extend credit based on the amount and repayment 
history of the outstanding debt. The creditor, however, denies the 
application because the consumer is indebted to a hospital. The 
creditor has used medical information, here the identity of the medical 
creditor, in a manner and to an extent that is less favorable than it 
would use comparable non-medical information.
    In the second example in proposed paragraph (c)(2)(iii), a consumer 
meets with a loan officer of a creditor to apply for a mortgage loan. 
While filling out the loan application, the consumer informs the loan 
officer orally that she has a potentially terminal disease. The 
consumer meets the creditor's established requirements for the 
requested mortgage. The loan officer recommends to the credit committee 
that the consumer be denied credit because the consumer has that 
disease. The creditor has used medical information in a manner 
inconsistent with the exception by taking into account the consumer's 
physical, mental, or behavioral health, condition, or history, type of 
treatment, or prognosis as part of a determination of

[[Page 23386]]

eligibility or continued eligibility for credit.
D. Specific Exceptions for Obtaining and Using Medical Information
    Proposed paragraph (d) contains specific exceptions to the general 
prohibition to allow creditors to obtain and use medical information 
for a limited number of particular purposes. The Agencies request 
comment on whether each of these specific exceptions is necessary and 
appropriate and, if so, whether they are properly defined.
    Proposed paragraph (d)(1)(i) provides that a creditor may obtain 
and use medical information to determine whether the use of a power of 
attorney or legal representative is necessary and appropriate. This 
exception would permit a creditor to verify, in connection with a 
credit eligibility determination, that the exercise of a power of 
attorney or legal representative is triggered by the consumer's medical 
condition.
    Under proposed paragraph (d)(1)(ii), a creditor may also use 
medical information to comply with applicable requirements of local, 
state, or federal laws. For example, some state laws may require 
creditors to consider medical information in certain circumstances to 
protect populations that may be vulnerable to financial abuse by 
caregivers. This exception would permit creditors to obtain and use 
medical information to comply with those laws.
    Proposed paragraph (d)(1)(iii) provides that a creditor may also 
obtain and use medical information to the extent such information is 
included in a consumer report from a consumer reporting agency in 
accordance with section 604(g)(1)(B) of the FCRA, and is used for the 
purpose for which the consumer provided specific written consent. As 
noted above, section 411 of the FACT Act prevents consumer reporting 
agencies from furnishing consumer reports containing medical 
information, except under specified circumstances. Consumer reports 
must be furnished with coding that blocks the identity of the provider 
of medical information and the nature of the services, products, or 
devices, unless a consumer provides a consumer reporting agency with 
specific written consent to furnish a report to a creditor containing 
uncoded medical information. This exception clarifies that a creditor 
may obtain uncoded medical information from a consumer reporting agency 
in accordance with section 604(g)(1)(B) of the FCRA, and use that 
information for the purpose for which the consumer provided specific 
written consent.
    The Agencies have not proposed a separate exception for obtaining 
and using consumer reports in accordance with section 604(g)(1)(C) of 
the FCRA, which relates to consumer reports containing coded medical 
information. The Agencies do not believe that it is necessary to 
propose a separate exception.
    The Agencies have considered three options that would allow 
creditors to obtain and use consumer reports containing the information 
described in section 604(g)(1) of the FCRA. The Agencies have 
considered whether the definition of ``medical information'' may be 
interpreted in a manner that would exclude the coded information that 
may be furnished under section 604(g)(1)(C) of the Act. This approach 
would permit all creditors to obtain consumer reports with coded 
information (but not consumer reports with uncoded medical information 
furnished under section 604(g)(1)(B)) and use that information in 
connection with a determination of the consumer's eligibility, or 
continued eligibility, for credit, even in the absence of an exception 
in the regulations. This approach is based on a statutory 
interpretation that such coded information would not relate to the 
physical, mental, or behavioral health of the consumer, and thus, is 
not medical information.
    The Agencies also have considered whether section 604(g) or other 
provisions of the FCRA may be interpreted in such a manner that no 
exception would be necessary to permit creditors to obtain and use 
medical information in consumer reports furnished by consumer reporting 
agencies in accordance with section 604(g)(1). For example, the 
Agencies have considered whether the broad prohibition in section 
604(g)(2) on obtaining and using medical information in credit 
eligibility determinations may be construed as being qualified by the 
specific provisions in section 604(g)(1) that authorize consumer 
reporting agencies to furnish consumer reports containing medical 
information under certain limited circumstances. This possible 
interpretation would be based on the Agencies' observation that (1) it 
is unlikely that Congress would permit consumer reporting agencies to 
furnish consumer reports containing medical information in connection 
with credit transactions without permitting creditors to obtain and use 
these reports, and (2) in these circumstances, Congress may well have 
provided the consumer protections it deemed necessary by specifying the 
limitations under which consumer reporting agencies could furnish 
reports containing medical information.
    The Agencies also have considered whether creditors who intend to 
obtain and use this coded medical information would be able to do so in 
accordance with the financial information exception in Sec.  ----.30(c) 
of the proposed regulations. Coded medical information relates to 
medical debts, and the creditor may use debt information in making 
credit eligibility determinations in a manner and to an extent that is 
no less favorable than it would use comparable information that is not 
medical information. In addition, because the medical information is 
coded as prescribed in the FCRA, it would not provide the creditor with 
specific information regarding the consumer's health, condition, 
history, type of treatment, or prognosis (which may not be taken into 
account under the financial information exception in proposed Sec.  --
--.30(c)(1)(iii)).
    The Agencies also note that the rule of construction in Sec.  --
--.30(b) of the proposed regulations would enable creditors to receive 
consumer reports containing coded medical information without violating 
the limit on ``obtaining'' medical information prescribed by section 
604(g)(2) of the FCRA, so long as they do not use that medical 
information in making credit eligibility determinations.
    The Agencies specifically request comment on the most appropriate 
way in which to deal with information contained in consumer reports, 
and related matters. In particular, comment is requested on these three 
approaches.
    A creditor may also obtain and use medical information for purposes 
of fraud prevention and detection under proposed paragraph (d)(1)(iv). 
Comment is solicited as to whether and to what extent it is necessary 
for creditors to obtain and use medical information for purposes of 
fraud prevention and detection in connection with the determination of 
a consumer's credit eligibility and whether the exception could be 
narrowed to prevent the unnecessary use of medical information without 
compromising legitimate fraud prevention and detection programs.
    Proposed paragraph (d)(1)(v) provides that a creditor may obtain 
and use medical information in the case of credit for the purpose of 
financing medical products or services to determine and verify the 
medical purpose of a loan and the use of proceeds. Certain creditors 
have established specialized loan programs that finance specific 
medical procedures, such as vision correction

[[Page 23387]]

surgery, but not others. In such cases, the creditor may need to obtain 
and use medical information in connection with determining whether the 
purpose of the loan is within the scope of the creditor's established 
loan program. Proposed paragraph (d)(2) provides examples of this 
exception. The Agencies invite comment on whether the medical purpose 
financing exception strikes the appropriate balance between satisfying 
the legitimate needs of medical finance creditors and the intent of 
Congress to limit the use of medical information in credit eligibility 
determinations.
    Proposed paragraph (d)(1)(vi) provides that a creditor may obtain 
and use medical information if the consumer or the consumer's legal 
representative requests in writing, on a separate document signed by 
the consumer or the consumer's legal representative, that the creditor 
use specific medical information for a specific purpose in determining 
the consumer's eligibility, or continued eligibility, for credit, to 
accommodate the consumer's particular circumstances. The signed, 
written request must describe the specific medical information that the 
consumer requests the creditor to use and the specific purpose for 
which the information will be used. This exception is designed to 
accommodate the particular medical condition or circumstances of the 
individual consumer and is not intended to allow creditors to obtain 
consent on a routine basis or as a part of loan applications or 
documentation. This exception would not be met by a form that contains 
a pre-printed description of various types of medical information and 
the uses to which it might be put. Instead, it contemplates an 
individualized process in which the consumer informs the creditor about 
the specific medical information that the consumer would like the 
creditor to use and for what purpose. Proposed paragraph (d)(3) 
provides examples of this consumer request exception.
    The Agencies seek comment on the need for a broader exception to 
permit creditors to make a ``medical accommodation'' where individual 
circumstances may warrant such an accommodation. The Agencies note that 
forbearance practices and programs, as discussed in the explanation of 
paragraph (a)(2) above, would permit creditors to take into account a 
consumer's medical condition to defer scheduled payments or take 
certain other actions on existing accounts as a medical accommodation 
to the consumer. Comment is requested on whether forbearance plus the 
consumer request exception provides sufficient flexibility to provide 
medical accommodations to consumers.
    The Agencies also request comment on whether the procedural aspects 
of the consumer request exception (i.e., the request must be in 
writing, on a separate form signed by the consumer or the consumer's 
legal representative) would unnecessarily hinder the ability of a 
creditor to make a medical accommodation where a consumer's medical 
condition and financial circumstances may justify such an 
accommodation, or whether these procedures are necessary to protect 
consumers.
    The Agencies seek comment on whether there is a need to establish 
an exception for consumer consent whereby a creditor could request that 
a consumer consent to the specific use of the consumer's medical 
information. If so, the Agencies request specific comment on when this 
exception might be used and how the exception should be fashioned to 
ensure appropriate consumer protection.
    Finally, proposed paragraph (d)(1)(vii) provides that a creditor 
may obtain and use medical information as otherwise permitted by order 
of the appropriate agency.
E. Limits on Redisclosure
    Proposed paragraph (e) incorporates the statutory provision 
regarding the limits on redisclosure of medical information. This 
paragraph provides that a person that receives medical information 
about a consumer from a consumer reporting agency or an affiliate is 
prohibited from disclosing that information to any other person, except 
as necessary to carry out the purposes for which the information was 
initially disclosed, or as otherwise permitted by statute, regulation, 
or order.
F. Request for Comment
    The Agencies solicit comment on each of the proposed provisions of 
Sec.  ----.30. Specifically, the Agencies request comment as to whether 
each of the proposed exceptions is, in fact, necessary and appropriate 
to protect legitimate operational, transactional, risk, consumer, and 
other needs (including actions necessary for administrative 
verification purposes), and consistent with the intent of Congress to 
restrict the use of medical information for inappropriate purposes. 
Comment is also requested on the examples used in this section and 
whether additional or different examples should be included.
    The Agencies also invite comment on whether any additional or 
different exceptions should be included in the final regulation. 
Commenters that recommend additional or different exceptions should 
explain why the exception is necessary and appropriate to protect 
legitimate operational, transactional, risk, consumer, and other needs, 
and is consistent with the intent of Congress to restrict the use of 
medical information for inappropriate purposes.

Section ----.31 Sharing Medical Information With Affiliates

    Section ----.31(a) provides that the standard exclusions from the 
definition of ``consumer report'' contained in section 603(d)(2) of the 
Act--including the exclusions for sharing transaction or experience 
information among affiliates or sharing other eligibility information 
among affiliates after notice and an opportunity to opt-out--do not 
apply if medical information, an individualized list or description 
based on payment transactions for medical products or services, or an 
aggregate list or description based on payment transactions for medical 
products or services is disclosed to an affiliate.
    Paragraph (b) provides that the special restrictions on sharing the 
information outlined in paragraph (a) with affiliates do not apply, and 
the standard exclusions from the definition of consumer report remain 
in effect, if the information is disclosed to an affiliate in certain 
circumstances. Paragraph (b) incorporates the four statutory exceptions 
from section 604(g)(3)(A) and (B) of the Act.
    The first exception is when the information described in paragraph 
(a) is shared with an affiliate in connection with the business of 
insurance or annuities (including the activities described in section 
18B of the model Privacy of Consumer Financial and Health Information 
Regulation issued by the National Association of Insurance 
Commissioners, as in effect on January 1, 2003). The second exception 
is when the information described in paragraph (a) is shared with an 
affiliate for any purpose permitted without authorization under the 
Standards for Individually Identifiable Health Information promulgated 
by the Department of Health and Human Services (HHS) pursuant to the 
Health Insurance Portability and Accountability Act of 1996 (HIPAA).
    The third exception is when the information described in paragraph 
(a) is shared with an affiliate for any purpose referred to under 
section 1179 of HIPAA. Section 1179 of HIPAA provides that to the 
extent that an entity is engaged in activities of a financial 
institution or is engaged in authorizing,

[[Page 23388]]

processing, clearing, settling, billing, transferring, reconciling or 
collecting payments for a financial institution, the HIPAA standards 
and requirements do not apply to the entity with respect to such 
activities. Section 1179 also provides as an example of a use or 
disclosure of information not covered by that statute, the use or 
disclosure of information for authorizing, processing, clearing, 
settling, billing, transferring, reconciling, or collection, a payment 
for, or related to, health care premiums or health care. For purposes 
of this rulemaking, the phrase ``purposes referred to under section 
1179'' means, at a minimum, authorizing, processing, clearing, 
settling, billing, transferring, reconciling or collecting payments.
    The fourth exception is when the information described in paragraph 
(a) is shared with an affiliate for any purpose described in section 
502(e) of the GLB Act. The Agencies note that some of the purposes 
described in section 502(e) of the GLB Act may be germane to the 
sharing of information among affiliates--for example, sharing with the 
consent of the consumer, for fraud prevention purposes, or as necessary 
to effect, administer, or enforce a transaction requested or authorized 
by the consumer--while other purposes described in section 502(e) are 
not--for example, sharing information with law enforcement or 
regulatory authorities.
    In addition to the statutory exceptions, paragraph (b) also 
contains two additional exceptions that the Agencies believe are 
necessary and appropriate. Paragraph (b)(5) provides that the special 
restrictions on sharing the information described in paragraph (a) with 
affiliates do not apply, and the standard exclusions from the 
definition of consumer report remain in effect, if the information is 
disclosed to an affiliate in connection with a determination of the 
consumer's eligibility, or continued eligibility, for credit consistent 
with Sec.  ----.30 of this subpart. The Agencies believe it is 
necessary and appropriate to allow an affiliate to share medical 
information with another affiliate that obtains or uses it consistent 
with Sec.  ----.30.
    Paragraph (b)(6) provides that the special restrictions on sharing 
medical-related information with affiliates do not apply if otherwise 
permitted by order of the appropriate agency. This exception 
incorporates the authority delegated to the Agencies by Congress to 
create exceptions through orders.
    The Agencies note that prohibitions on obtaining or using medical 
information in Sec.  ----.30 operate independent of the exceptions that 
permit the sharing of that information among affiliates in accordance 
with the provisions of section 603(d)(2) of the Act. For example, if a 
mortgage lender has obtained and used medical information in accordance 
with one of the exceptions in Sec.  ----.30(c) or (d), the mortgage 
lender may share that information with its credit card affiliate 
without becoming a consumer reporting agency if one of the exceptions 
in Sec.  ----.31(b) applies. However, the credit card affiliate may not 
obtain or use that information in connection with any determination of 
the consumer's eligibility, or continued eligibility, for credit, 
unless consistent with Sec.  ----.30.
    The Agencies invite comment on the exceptions included in proposed 
Sec.  ----.31(b). Specifically, comment is solicited on whether 
additional or different exceptions are necessary and appropriate.
Additional Issues
    The statute provides that the final rules shall take effect on the 
later of 90 days after the rules are issued in final form, or the date 
specified in the regulations. Comment is requested on whether an 
effective date of 90 days after the final rules are issued is 
appropriate or whether a different effective date should be 
established.

III. Regulatory Analysis

Paperwork Reduction Act

    In accordance with the Paperwork Reduction Act of 1995 (44 U.S.C. 
3506; 5 CFR 1320), the Agencies reviewed the proposed rule to implement 
section 411 of the Fair and Accurate Credit Transactions Act of 2003 as 
required by the Office of Management and Budget. No collections of 
information pursuant to the Paperwork Reduction Act are contained in 
the proposed rule.

Initial Regulatory Flexibility Analysis

    OCC: The Regulatory Flexibility Act (5 U.S.C. 601-612) (RFA) 
requires an agency to either provide an Initial Regulatory Flexibility 
Analysis with a proposed rule or certify that the proposed rule will 
not have a significant economic impact on a substantial number of small 
entities (defined for purposes of the RFA to include banks with less 
than $150 million in assets).
A. Reasons for Proposed Rule
    Section 411 of the FACT Act requires the OCC, together with the 
other Agencies, to publish rules that are determined to be necessary 
and appropriate to protect legitimate operational, transactional risk, 
consumer, and other needs, including actions necessary for 
administrative verification, consistent with the intent of the section 
to restrict the use of medical information for inappropriate purposes, 
that permit the use of medical information in connection with any 
determination of a consumer's eligibility, or continued eligibility for 
credit. Section 411 also authorizes the OCC to issue regulations that 
are determined to be necessary and appropriate so as to exclude medical 
information shared by a covered entity with an affiliate from the 
definition of a consumer report in section 603(d) of the Fair Credit 
Reporting Act, and to address the reuse and redisclosure of medical 
information.
    The OCC does not expect that this rule, if adopted, would have a 
significant economic impact on small entities. The proposed rule 
implements section 411 of the FACT Act and imposes only minimal 
economic impact on national banks. The proposed rule would create 
exceptions to the FACT Act's prohibition against national banks 
obtaining and using a consumer's medical information in connection with 
credit determinations. Additionally, the proposed rule would implement 
the FACT Act's restrictions on the sharing of medical information among 
affiliates and would include exceptions to permit the sharing of 
medical information in certain circumstances. The proposed rule would 
apply to all national banks that obtain or use medical information in 
connection with credit determinations, regardless of bank size. 
However, it is likely that small national banks, because of the nature 
and size of their operations, will encounter fewer instances where they 
might obtain or use medical information. Therefore, no group of 
national banks, particularly small national banks, is expected to 
encounter a significant economic impact. However, the OCC invites 
comment on whether these assumptions are correct. Also, the OCC invites 
comment on the burden that likely will result on small institutions 
from this rulemaking, and has prepared the following analysis.
B. Statement of Objectives and Legal Basis
    The objectives of the proposed rule are described in the 
SUPPLEMENTARY INFORMATION section. In sum, the objectives are: (1) To 
implement the general statutory prohibition on creditors obtaining and 
using medical information in connection with credit eligibility 
determinations; (2) to fulfill the statutory mandate to prescribe 
regulations that permit creditors to obtain and use medical information 
for eligibility purposes when necessary and

[[Page 23389]]

appropriate to protect legitimate operational, transaction, risk, 
consumer, and other needs by granting exceptions; and (3) to implement 
the statutory exceptions to the special restrictions on sharing medical 
information with affiliates and to propose two additional exceptions 
the Agencies believe may be necessary and appropriate. The legal bases 
for the proposed rule are the National Bank Act found at 12 U.S.C. 1 et 
seq., 24(Seventh), 481, and 484, the Depository Institutions 
Deregulation and Monetary Control Act of 1980 found at 12 U.S.C. 93a, 
and the Federal Deposit Insurance Act found at 12 U.S.C. 1818; and the 
Fair Credit Reporting Act found at 15 U.S.C. 1681a, 1681b, and 1681s.
C. Description of Small Entities to Which the Rule Will Apply
    The proposed rule would apply to 1,214 national banks, Federal 
branches, and Federal agencies of foreign banks with assets under $150 
million.
D. Projected Reporting, Recordkeeping and Other Compliance Requirements
    The OCC does not believe that the proposed rule imposes any 
reporting or any specific recordkeeping requirements within the meaning 
of the RFA. Section 411 requires that all covered entities have the 
ability to identify medical information as defined by the FACT Act in 
order to avoid the general prohibition against obtaining or using it in 
connection with any eligibility determination. This may entail some 
training costs.
    However, the OCC believes that training costs will be minimal for a 
variety of reasons. One reason is the OCC does not believe that covered 
entities presently obtain or use medical information in making credit 
eligibility determinations on a broad basis. Another is that bank staff 
would already be trained on complying with other laws governing 
obtaining and using confidential information, including medical 
information, as discussed below.
    Further, entities have the option of complying with the general 
statutory prohibition on obtaining and using medical information or an 
applicable exception. Thus, any burden that may be associated with 
complying with the exceptions can be avoided entirely by complying with 
the general prohibition. The OCC contemplates that those entities that 
find the exceptions to be burden reducing would opt to use them.
    The OCC solicits information and comment on these assumptions. The 
OCC also seeks information and comment on any costs, such as training 
costs, compliance requirements, or changes in operating procedures 
arising from the application of the proposed rule in addition to or 
which may differ from those arising from the application of the statute 
generally.
E. Identification of Duplicative, Overlapping, or Conflicting Federal 
Rules
    The OCC is unable to identify any statutes or rules, which would 
overlap or conflict with the proposed regulation. The OCC seeks comment 
and information about any such statutes or rules, as well as any other 
state, local, or industry rules or policies that require a covered 
institution to implement business practices that would comply with the 
requirements of the proposed rule.
F. Discussion of Significant Alternatives
    The proposed rule creates exceptions to the general prohibition on 
the use of medical information in determining the eligibility of a 
consumer for an initial extension or the continuation of an extension 
of credit. The proposed rule attempts to harmonize the circumstances 
under which a credit reporting agency may transfer medical information 
to a user of consumer reports with the ability of a financial 
institution to obtain and use that information. The proposed rule also 
provides exceptions, in addition to those contained in section 411, 
under which a financial institution may share medical information with 
an affiliate and not become a consumer reporting agency.
    In developing the proposal, the Agencies considered numerous 
alternatives. In particular, the Agencies considered creating a wide 
variety of possible exceptions to the general prohibition on obtaining 
and using medical information and numerous alternatives. A number of 
these are discussed in the SUPPLEMENTARY INFORMATION, including the 
following:
    1. The Agencies considered clarifying through an exception that 
obtaining and using medical information in connection with debt 
cancellation, debt suspension, or credit insurance products or similar 
forbearance practices or programs, is not prohibited, but are proposing 
to clarify this point through interpretation instead;
    2. The Agencies considered three options that would allow creditors 
to obtain and use consumer reports containing the various types of 
information described in section 604(g)(1) of the FCRA and are 
soliciting comment on these approaches;
    3. The Agencies considered the need for a broader exception to 
permit creditors to make a ``medical accommodation'' where individual 
circumstances may warrant such an accommodation; and
    4. The Agencies further considered the need to establish an 
exception for consumer consent whereby a creditor could request that a 
consumer consent to the specific use of the consumer's medical 
information.
    In all these cases and others, the Agencies have described relevant 
alternatives and are inviting comment on them in the SUPPLEMENTARY 
INFORMATION section.
    The relatively narrow scope of the exceptions proposed reflects the 
statutory mandate to create only those exceptions ``determined to be 
necessary and appropriate.'' While the Agencies believe that the 
proposed exceptions would be among those useful to small entities as 
well as large, we are not proposing a general exception that would 
apply only to small entities. Comment is solicited on whether such an 
exception would be necessary and appropriate and whether the risk is 
different for a small entity than a large entity that medical 
information obtained might be used for the type of ``inappropriate 
purposes'' the statute prohibits.
    The OCC welcomes comments on any significant alternatives, 
consistent with the mandate in section 411 to protect the privacy of 
medical information, that would minimize the impact of the proposed 
rule on small entities.
    Board: Subject to certain exceptions, the Regulatory Flexibility 
Act (5 U.S.C. 601-612) (RFA) requires an agency to publish an initial 
regulatory flexibility analysis with a proposed rule whenever the 
agency is required to publish a general notice of proposed rulemaking 
for a proposed rule. The SUPPLEMENTARY INFORMATION above describes the 
reasons why the regulations are being proposed and the objectives and 
the legal basis of the proposed rule. The SUPPLEMENTARY INFORMATION 
section also describes the compliance requirements of the proposed rule 
and identifies other relevant Federal rules which may duplicate or 
overlap with the proposed rule. The Board, in connection with its 
initial regulatory flexibility analysis, requests public comment in the 
following areas.
A. Reasons for the Proposed Rule
    Section 411 of the FACT Act requires the Board, together with the 
other Agencies, to publish rules that are determined to be necessary 
and appropriate to protect legitimate

[[Page 23390]]

operational, transactional risk, consumer, and other needs, including 
actions necessary for administrative verification, consistent with the 
intent of the section to restrict the use of medical information for 
inappropriate purposes, that permit the use of medical information in 
connection with any determination of a consumer's eligibility, or 
continued eligibility for credit. It permits the Board to issue 
regulations that are determined to be necessary and appropriate so as 
to exclude medical information shared by a covered entity with an 
affiliate from the definition of a consumer report in section 603(d) of 
the FCRA, and to address the reuse and redisclosure of medical 
information.
B. Statement of Objectives and Legal Basis
    The SUPPLEMENTARY INFORMATION above contains this information. The 
legal basis for the proposed rule is section 411 of the FACT Act.
C. Description of Small Entities to Which the Rule Applies
    The proposed rule would apply to all banks that are members of the 
Federal Reserve System (other than national banks), branches and 
Agencies of foreign banks (other than Federal branches, Federal 
Agencies, and insured State branches of foreign banks), commercial 
lending companies owned or controlled by foreign banks, organizations 
operating under section 25 or 25A of the Federal Reserve Act (12 U.S.C. 
601 et seq., and 611 et seq.), bank holding companies and affiliates 
(other than depository institutions and consumer reporting agencies) of 
such holding companies. The Board's proposed rule will apply to the 
following institutions (numbers approximate): State member banks (932), 
bank holding companies (5,152), holding company non-bank subsidiaries 
(2,131), U.S. branches and agencies of foreign banks (289), Edge and 
agreement corporations (75), for a total of approximately 8,579 
institutions. The Board estimates that over 5,000 of these institutions 
could be considered small institutions with assets less than $150 
million.
D. Projected Reporting, Recordkeeping and Other Compliance Requirements
    The Board does not believe that the proposed rule imposes any new 
reporting or recordkeeping requirements, as defined in section 603 of 
the RFA. Section 411 requires that all covered entities have the 
ability to identify medical information as defined in order to avoid 
the general prohibition against obtaining or using it in connection 
with any eligibility determination. The Board believes that identifying 
that information for the purpose of either using it in eligibility 
determinations pursuant to the exceptions or to share the information 
with affiliates places no additional compliance burdens or costs on 
financial institutions.
    The Board seeks information and comment on any costs, compliance 
requirements, or changes in operating procedures arising from the 
application of the proposed rule in addition to or which may differ 
from those arising from the application of the statute generally.
E. Identification of Duplicative, Overlapping, or Conflicting Federal 
Rules
    The Board is unable to identify any federal statutes or regulations 
that would duplicate, overlap, or conflict with the proposed rule. The 
Board seeks comment regarding any statues or regulations, including 
state or local statutes or regulations, that would duplicate, overlap, 
or conflict with the proposed rule, including particularly any that 
address situations in which medical information may be: (i) Obtained or 
used in connection with a determination of credit eligibility; or (ii) 
shared among financial institutions and their affiliates.
F. Discussion of Significant Alternatives
    The proposed rule creates exceptions to the general prohibition to 
the use of medical information in determining the eligibility of a 
consumer for an initial extension or the continuation of an extension 
of credit. The proposed rule attempts to harmonize the circumstances 
under which a credit reporting agency may transfer medical information 
to a user of consumer reports with the ability of a financial 
institution to obtain and use that information. The proposed rule also 
provides exceptions, in addition to those contained in section 411, 
under which a financial institution may share medical information with 
an affiliate and not become a consumer reporting agency.
    The Board welcomes comments on any significant alternatives, 
consistent with the mandate in section 411 to protect the privacy of 
medical information, that would minimize the impact of the proposed 
rule on small entities.
    FDIC: Subject to certain exceptions, the Regulatory Flexibility Act 
(5 U.S.C. 601-612) (RFA) requires an agency to publish an initial 
regulatory flexibility analysis with a proposed rule whenever the 
agency is required to publish a general notice of proposed rulemaking 
for a proposed rule. The FDIC, in connection with its initial 
regulatory flexibility analysis, requests public comment in the 
following areas.
A. Reasons for the Proposed Rule
    Section 411 of the FACT Act requires the FDIC, together with the 
other Agencies, to publish rules that are determined to be necessary 
and appropriate to protect legitimate operational, transactional risk, 
consumer, and other needs, including actions necessary for 
administrative verification, consistent with the intent of the section 
to restrict the use of medical information for inappropriate purposes, 
that permit the use of medical information in connection with any 
determination of a consumer's eligibility, or continued eligibility for 
credit. It permits the FDIC to issue regulations that are determined to 
be necessary and appropriate so as to exclude medical information 
shared by a covered entity with an affiliate from the definition of a 
consumer report in section 603(d) of the FCRA, and to address the reuse 
and redisclosure of medical information.
B. Statement of Objectives and Legal Basis
    The SUPPLEMENTARY INFORMATION above contains this information. The 
legal basis for the proposed rule is section 411 of the FACT Act.
C. Description of Small Entities to Which the Rule Applies
    The proposed rule would apply to all state non-member banks, 
approximately 3,700 of which are small entities as defined by the RFA.
D. Projected Reporting, Recordkeeping and Other Compliance Requirements
    The FDIC does not believe that the proposed rule imposes any new 
reporting or recordkeeping requirements, as defined in section 603 of 
the RFA. Section 411 requires that all covered entities have the 
ability to identify medical information as defined in order to avoid 
the general prohibition against obtaining or using it in connection 
with any eligibility determination. The FDIC believes that identifying 
that information for the purpose of either using it in eligibility 
determinations pursuant to the exceptions or to share the information 
with affiliates places no additional compliance burdens or costs on 
financial institutions.

[[Page 23391]]

    The FDIC seeks information and comment on any costs, compliance 
requirements, or changes in operating procedures arising from the 
application of the proposed rule in addition to or which may differ 
from those arising from the application of the statute generally.
E. Identification of Duplicative, Overlapping, or Conflicting Federal 
Rules
    The FDIC is unable to identify any federal statutes or regulations 
that would duplicate, overlap, or conflict with the proposed rule. The 
FDIC seeks comment regarding any statues or regulations, including 
state or local statutes or regulations, that would duplicate, overlap, 
or conflict with the proposed rule, including particularly any that 
address situations in which medical information may be: (i) Obtained or 
used in connection with a determination of credit eligibility; or (ii) 
shared among financial institutions and their affiliates.
F. Discussion of Significant Alternatives
    The proposed rule creates exceptions to the general prohibition to 
the use of medical information in determining the eligibility of a 
consumer for an initial extension or the continuation of an extension 
of credit. The proposed rule attempts to harmonize the circumstances 
under which a credit reporting agency may transfer medical information 
to a user of consumer reports with the ability of a financial 
institution to obtain and use that information. The proposed rule also 
provides exceptions, in addition to those contained in section 411, 
under which a financial institution may share medical information with 
an affiliate and not become a consumer reporting agency.
    The FDIC welcomes comments on any significant alternatives, 
consistent with the mandate in section 411 to protect the privacy of 
medical information, that would minimize the impact of the proposed 
rule on small entities.
    OTS: The Regulatory Flexibility Act (5 U.S.C. 601-612) (RFA) 
requires an agency to either provide an Initial Regulatory Flexibility 
Analysis (IRFA) with a proposed rule or certify that the proposed rule 
will not have a significant economic impact on a substantial number of 
small entities. As discussed below, OTS does not expect that this rule, 
if adopted, would have a significant economic impact on a substantial 
number of small entities. Nonetheless, it is providing this IRFA.
    The proposed rule implements section 411 of the FACT Act. The 
proposed rule would implement the statutory prohibition on creditors 
obtaining and using a consumer's medical information in connection with 
credit determinations, while creating exceptions in certain 
circumstances. Additionally, the proposed rule would implement the FACT 
Act's restrictions on the sharing of medical information among 
affiliates, while including exceptions to permit the sharing of medical 
information in certain circumstances. As discussed below, the proposed 
rule would apply to savings associations or their subsidiaries, savings 
and loan holding companies, or affiliates of savings associations or 
savings and loan holding companies other than bank holding companies, 
banks, or subsidiaries of bank holding companies or banks.
    OTS does not expect that this rule, if adopted, would have a 
significant economic impact on a substantial number of small entities. 
The general statutory prohibition on obtaining and using medical 
information incorporated into the rule will only apply impact entities 
that obtain or use medical information in connection with credit 
determinations, regardless of size. OTS does not believe that obtaining 
and using medical information for credit eligibility determinations is 
a widespread practice today among creditors it regulates. Small 
entities, because of the nature and size of their operations, may be 
less likely than larger institutions to do so. Therefore, no group of 
covered entities, particularly small ones, is expected to encounter a 
significant economic impact. However, OTS invites comment whether these 
assumptions are correct. OTS further invites comment on the burden that 
will result on small entities from this rulemaking, and has prepared 
the following analysis.
A. Reasons for the Proposed Rule
    Section 411 of the FACT Act requires OTS, together with the other 
Agencies, to publish rules that are determined to be necessary and 
appropriate to protect legitimate operational, transactional risk, 
consumer, and other needs, including actions necessary for 
administrative verification, consistent with the intent of the section 
to restrict the use of medical information for inappropriate purposes, 
that permit the use of medical information in connection with any 
determination of a consumer's eligibility, or continued eligibility for 
credit. Section 411 also authorizes OTS to issue regulations that are 
determined to be necessary and appropriate so as to exclude medical 
information shared by a covered entity with an affiliate from the 
definition of a consumer report in section 603(d) of the Fair Credit 
Reporting Act, and to address the reuse and redisclosure of medical 
information.
B. Statement of Objectives and Legal Basis
    The objectives of the proposed rule are described in the 
SUPPLEMENTARY INFORMATION section. In sum, the objectives are: (1) To 
implement the general statutory prohibition on creditors obtaining and 
using medical information in connection with credit eligibility 
determinations, (2) to fulfill the statutory mandate to prescribe 
regulations that permit creditors to obtain and use medical information 
for eligibility purposes when necessary and appropriate to protect 
legitimate operational, transaction, risk, consumer, and other needs by 
granting exceptions, and (3) to implement the statutory exceptions to 
the special restrictions on sharing medical information with affiliates 
and to propose two additional exceptions the Agencies believe may be 
necessary and appropriate.
    The legal bases for the proposed rule are provisions of: (1) The 
Home Owners' Loan Act found at 12 U.S.C. 1462a, 1463, 1464, and 1467a; 
(2) the Federal Deposit Insurance Act, the Bank Protection Act, and 
other banking laws found at 12 U.S.C. 1828, 1831p-1, and 1881-1884; (3) 
the Fair Credit Reporting Act found at 15 U.S.C. 1681s and 1681w; and 
(4) the Gramm-Leach-Bliley Act found at 15 U.S.C. 6801 and 6805(b)(1).
C. Description of Small Entities to Which the Rule Applies
    Section 571.30(a)-(d) of the proposed rule would apply to those 
creditors, as defined in Sec.  571.30(a)(2), that are savings 
associations or their subsidiaries, savings and loan holding companies, 
or affiliates of savings associations or savings and loan holding 
companies other than bank holding companies, banks, or subsidiaries of 
bank holding companies or banks.
    Sections 571.30(e) and 571.31 of the proposed rule would apply to 
all savings associations and, in accordance with 12 CFR 559.3(h)(1), to 
federal savings association operating subsidiaries as well.
    Small savings associations are generally defined, for RFA purposes, 
as those with assets of $150 million or less. 13 CFR 121.201 (2003). 
OTS calculates that of the 921 savings associations, a maximum of 479 
of these are small savings associations. OTS also calculates that these 
479 savings associations hold 122 subordinate

[[Page 23392]]

organizations that could possibly qualify as small entities.
    With regard to savings and loan holding companies, the Small 
Business Administration (SBA) prescribes size standards for various 
economic activities and industries using the North American Industry 
Classification System (NAICS). 13 CFR part 121. Under the SBA's 
standards, companies that are primarily engaged in holding securities 
of (or other equity interests in) depository institutions for the 
purpose of controlling those companies are addressed at NAICS Codes 
551111 and 551112 (Office of Bank Holding Companies and Office of Other 
Holding Companies). Companies within this group are considered to be 
small if they have annual receipts of $6 million or less. Companies 
that are primarily engaged in holding the securities of depository 
institutions and operating these entities are classified under NAICS 
Codes 522110-522190. Companies classified in this group are considered 
to be small if their total assets are less than $150 million.
    In this IRFA, OTS has analyzed the impact of this rule using both 
the $150 million asset size standard and the $6 million annual receipts 
standard. OTS specifically requests comment on its use of these 
standards. Commenters are invited to address whether these or other 
size standards are appropriate.
    OTS calculates that there are approximately 969 OTS-regulated 
savings and loan holding companies. OTS further calculates that there 
are maximum of 381 savings and loan holding companies that could 
possibly qualify as small entities. OTS estimates that there are 151 
small savings and loan holding companies under an asset-based 
definition of $150 million or less of assets and 381 small savings and 
loan holding companies under a revenue-based definition of $6 million 
or less in annual receipts.
D. Projected Reporting, Recordkeeping and Other Compliance Requirements
    OTS does not believe that the proposed rule imposes any new 
reporting or any specific recordkeeping requirements within the meaning 
of the RFA. Implicitly, however, section 411 requires that all covered 
entities have the ability to identify medical information as defined by 
the FACT Act in order to avoid the general prohibition against 
obtaining or using it in connection with any eligibility determination. 
This may entail some training costs.
    However, OTS believes that training costs will be minimal for a 
variety of reasons. One reason is OTS does not believe that covered 
entities currently widely obtain or use medical information in making 
credit eligibility determinations. Another is that staff would already 
be trained on complying with other laws governing obtaining and using 
confidential information, including medical information, as discussed 
below.
    Further, entities have the option of complying with the general 
statutory prohibition on obtaining and using medical information or an 
applicable exception. Thus, any additional burden that may be 
associated with complying with the exceptions can be avoided entirely 
by complying with the general prohibition instead. OTS contemplates 
that entities that find the exceptions to be burden reducing would opt 
to use them and that others would choose to comply with the general 
prohibition.
    OTS solicits information and comments on these assumptions. OTS 
also solicits information and comment on any costs, such as training 
costs, as well as compliance requirements, or changes in operating 
procedures arising from the application of the proposed rule in 
addition to or which may differ from those arising from the application 
of the statute generally.
E. Identification of Duplicative, Overlapping, or Conflicting Federal 
Rules
    The SUPPLEMENTARY INFORMATION section describes the compliance 
requirements of the proposed rule and identifies other relevant Federal 
rules that may duplicate or overlap with the proposed rule. As 
discussed in the SUPPLEMENTARY INFORMATION, other laws and rules issued 
under these laws, such as the Americans with Disabilities Act, the Fair 
Housing Act, the Gramm-Leach-Bliley Act, and other parts of the FCRA, 
may limit or regulate the use, collection, and sharing of consumer 
information, including medical information. In particular, these and 
other laws and rules, such as the Equal Credit Opportunity Act and 
Regulation B, also may prohibit creditors from using certain 
information that is excluded from the restrictions on obtaining or 
using medical information, such as age or gender information, in 
determining eligibility for credit or for other purposes. In this 
sense, there may be some overlap between these federal statutes and 
regulations and the proposed rule.
    OTS seeks comment and information regarding any statues or rules, 
including state or local statutes or regulations, that would duplicate, 
overlap, or conflict with the proposed rule, including particularly any 
that address situations in which medical information may be: (i) 
Obtained or used in connection with a determination of credit 
eligibility; or (ii) shared among financial institutions and their 
affiliates.
F. Discussion of Significant Alternatives
    The proposed rule creates exceptions to the general prohibition to 
the use of medical information in determining the eligibility of a 
consumer for an initial extension or the continuation of an extension 
of credit. The proposed rule attempts to harmonize the circumstances 
under which a credit reporting agency may transfer medical information 
to a user of consumer reports with the ability of a financial 
institution to obtain and use that information. The proposed rule also 
provides exceptions, in addition to those contained in section 411, 
under which a financial institution may share medical information with 
an affiliate and not become a consumer reporting agency.
    In developing the proposal, the Agencies considered numerous 
alternatives. In particular, it considered a wide variety of possible 
exceptions to create to the general prohibition on obtaining and using 
medical information and numerous alternatives. A number of these are 
discussed in the SUPPLEMENTARY INFORMATION, including the following:
    1. The Agencies considered clarifying through an exception that 
obtaining and using medical information in connection with debt 
cancellation, debt suspension, or credit insurance products or similar 
forbearance practices or programs, is not prohibited, but are proposing 
to clarify this point through interpretation instead.
    2. The Agencies considered three options that would allow creditors 
to obtain and use consumer reports containing the various types of 
information described in section 604(g)(1) of the FCRA and are 
soliciting comment on these approaches.
    3. The Agencies considered the need for a broader exception to 
permit creditors to make a ``medical accommodation'' where individual 
circumstances may warrant such an accommodation.
    4. The Agencies further considered the need to establish an 
exception for consumer consent whereby a creditor could request that a 
consumer consent to the specific use of the consumer's medical 
information.
    In all these cases and others, the Agencies have described relevant 
alternatives and are inviting comment on them in the SUPPLEMENTARY 
INFORMATION section.

[[Page 23393]]

    The relatively narrow scope of the exceptions proposed reflects the 
statutory mandate to create only those exceptions ``determined to be 
necessary and appropriate.'' While the Agencies believe that the 
proposed exceptions would be among those useful to small entities as 
well as large, we are not proposing a general exception that would 
apply only to small entities. Comment is solicited on whether such an 
exception would be necessary and appropriate and whether the risk is 
different for a small entity than a large entity that medical 
information obtained might be used for the type of ``inappropriate 
purposes'' the statute prohibits.
    OTS welcomes comments on any significant alternatives, consistent 
with the mandate in section 411 to protect the privacy of medical 
information, which would minimize the impact of the proposed rule on 
small entities.
    NCUA: The Regulatory Flexibility Act requires the NCUA to prepare 
an analysis to describe any significant economic impact a proposed rule 
may have on a substantial number of small credit unions (those under 
$10 million in assets).
    Section 411 of the FACT Act limits the ability of creditors to 
obtain or use medical information in connection with credit eligibility 
determinations and narrows when any person can share medical 
information and medical-related information with affiliates without 
becoming a consumer reporting agency for purposes of the FCRA. The 
statute requires the NCUA and the federal banking agencies to prescribe 
regulations that create exceptions to permit creditors to obtain or use 
medical information in connection with credit eligibility 
determinations where necessary and appropriate to protect legitimate 
operational, transactional, risk, consumer, and other needs (including 
administrative verification purposes), consistent with congressional 
intent to restrict the use of medical information for inappropriate 
purposes. Furthermore, the statute grants discretionary rulemaking 
authority to the NCUA, the federal banking agencies, and the Federal 
Trade Commission to create exceptions, in addition to those already 
provided in the statute, to allow affiliates to share medical 
information and medical-related information.
    Proposed Sec. Sec.  717.30 and 717.31 of the NCUA's proposed 
regulations would apply to all federal credit unions, regardless of 
their size. The proposed rule would contain restrictions set forth in 
section 411 of the FACT Act on federal credit unions obtaining and 
using medical information in connection with credit eligibility 
determinations and the sharing of medical information and medical-
related information with affiliates. The proposed regulations, however, 
also would grant exceptions to the statutory limitations to allow 
creditors to obtain or use medical information in enumerated situations 
in connection with determinations of consumer eligibility or continued 
eligibility for credit. The proposal would also enumerate the 
situations in which federal credit unions would be permitted to share 
medical information among affiliates.
    NCUA is not aware of any other federal rules that duplicate, 
overlap, or conflict with the proposed rule. NCUA specifically requests 
comment on the impact of the proposed rule on small federal credit 
unions.

OCC and OTS Executive Order 12866 Determination

    The OCC and OTS each has determined that its portion of the 
proposed rulemaking is not a significant regulatory action under 
Executive Order 12866. OCC and OTS Unfunded Mandates Reform Act of 1995 
Determination.

OCC Executive Order 13132 Determination

    The OCC has determined that this proposal does not have any 
Federalism implications, as required by Executive Order 13132.

NCUA Executive Order 13132 Determination

    Executive Order 13132 encourages independent regulatory agencies to 
consider the impact of their actions on state and local interests. In 
adherence to fundamental federalism principles, the NCUA, an 
independent regulatory agency as defined in 44 U.S.C. 3502(5), 
voluntarily complies with the executive order. The proposed rule 
applies only to federally chartered credit unions and would not have 
substantial direct effects on the states, on the connection between the 
national government and the states, or on the distribution of power and 
responsibilities among the various levels of government. The NCUA has 
determined that this proposed rule does not constitute a policy that 
has federalism implications for purposes of the executive order.

OCC and OTS Unfunded Mandates Reform Act of 1995 Determination

    Section 202 of the Unfunded Mandates Reform Act of 1995, Public Law 
104-4 (Unfunded Mandates Act) requires that an agency prepare a 
budgetary impact statement before promulgating a rule that includes a 
Federal mandate that may result in expenditure by State, local, and 
tribal governments, in the aggregate, or by the private sector, of $100 
million or more in any one year. If a budgetary impact statement is 
required, section 205 of the Unfunded Mandates Act also requires an 
agency to identify and consider a reasonable number of regulatory 
alternatives before promulgating a rule. The OCC and OTS each has 
determined that this proposed rule will not result in expenditures by 
State, local, and tribal governments, or by the private sector, of $100 
million or more. Accordingly, neither the OCC nor the OTS has prepared 
a budgetary impact statement or specifically addressed the regulatory 
alternatives considered.

NCUA: The Treasury and General Government Appropriations Act, 1999--
Assessment of Federal Regulations and Policies on Families

    The NCUA has determined that this proposed rule would not affect 
family well-being within the meaning of section 654 of the Treasury and 
General Government Appropriations Act, 1999, Public Law 105-277, 112 
Stat. 2681 (1998).

NCUA: Interpretive Ruling and Policy Statement (IRPS) 87-2, as Amended 
by IRPS 03-2

    Under NCUA's IRPS 87-2, as amended by IRPS 03-2, the NCUA Board's 
general policy is to provide a 60-day comment period for a proposed 
regulation. In this case, the NCUA Board believes that a 30-day comment 
period will be adequate and is appropriate given that the statutory 
deadline for the final rule is June 4, 2004. NCUA IRPS 87-2, 52 FR 
35231, Sept. 18, 1987, as amended by IRPS 03-2, 68 FR 31949, May 29, 
2003.

OCC Community Bank Comment Request

    The OCC invites your comments on the impact of this proposal on 
community banks. The OCC recognizes that community banks operate with 
more limited resources than larger institutions and may present a 
different risk profile. Thus, the OCC specifically requests comment on 
the impact of the proposal on community banks' current resources and 
available personnel with the requisite expertise, and whether the goals 
of the proposal could be achieved, for community banks, through an 
alternative approach.

[[Page 23394]]

IV. Solicitation of Comments on Use of Plain Language

    Section 722 of the GLB Act requires the Agencies \3\ to use plain 
language in all proposed and final rules published after January 1, 
2000. We invite your comments on how to make this proposed rule easier 
to understand. For example:
---------------------------------------------------------------------------

    \3\ Section 722 of the GLB Act does not apply to NCUA, but NCUA 
has a similar Agency Regulatory Goal to promote clear and 
understandable regulations that impose minimal regulatory burden.
---------------------------------------------------------------------------

     Have we organized the material to suit your 
needs? If not, how could this material be better organized?
     Are the requirements in the rule clearly stated? 
If not, how could the rule be more clearly stated?
     Do the regulations contain technical language or 
jargon that is not clear? If so, which language requires clarification?
     Would a different format (grouping and order of 
sections, use of headings, paragraphing) make the regulation easier to 
understand? If so, what changes to the format would make the regulation 
easier to understand?
     Would more, but shorter, sections be better? If 
so, which sections should be changed?
     What else could we do to make the regulation 
easier to understand?

List of Subjects

12 CFR Part 41

    Banks, Banking, Consumer protection, National banks, Reporting and 
recordkeeping requirements.

12 CFR Part 222

    Banks, Banking, Consumer protection, Credit, Fair Credit Reporting 
Act, Holding companies, Privacy, Reporting and recordkeeping 
requirements, State member banks.

12 CFR Part 334

    Administrative practice and procedure, Bank deposit insurance, 
Banks, Banking, Reporting and recordkeeping requirements, Safety and 
soundness.

12 CFR Part 571

    Consumer protection, Credit, Fair Credit Reporting Act, Privacy, 
Reporting and recordkeeping requirements, Savings associations.

12 CFR Part 717

    Consumer protection, Credit unions, Fair credit reporting, Medical 
information, Privacy, Reporting and recordkeeping requirements.

Office of the Comptroller of the Currency

12 CFR Chapter I

Authority and Issuance

    For the reasons set forth in the preamble, the OCC proposes to 
amend Chapter I of Title 12 of the Code of Federal Regulations as 
follows:
    1. Add part 41 to read as follows:

PART 41--FAIR CREDIT

Subpart A--General Provisions
Sec.
41.1 Purpose and scope.
41.2 Examples.
41.3 Definitions.
Subpart B--[Reserved]
Subpart C--[Reserved]
Subpart D--Medical Information
41.30 Obtaining or using medical information in connection with a 
determination of eligibility for credit.
41.31 Sharing medical information with affiliates.

    Authority: 12 U.S.C. 1 et seq., 24 (Seventh), 93a, 481, 484, and 
1818; 15 U.S.C. 1681a, 1681b, and 1681s.

Subpart A--General Provisions


Sec.  41.1  Purpose and scope.

    (a) Purpose. The purpose of this part is to establish standards for 
national banks in key areas of regulation regarding consumer report 
information and fair credit. In addition, the purpose of this part is 
to specify the type of information, including medical information, 
national banks may obtain, use, or share among affiliates. This part 
also contains a number of measures national banks must take to combat 
consumer fraud and related crimes, including identity theft.
    (b) Scope.
    (1) [Reserved]
    (2) Institutions covered. Except as otherwise provided in this 
part, these regulations apply to national banks, Federal branches and 
Agencies of foreign banks, and their respective operating subsidiaries 
that are not functionally regulated within the meaning of section 
5(c)(5) of the Bank Holding Company Act of 1956, as amended (12 U.S.C. 
1844(c)(5)).


Sec.  41.2  Examples.

    The examples in this part are not exclusive. Compliance with an 
example, to the extent applicable, constitutes compliance with this 
part. Examples in a paragraph illustrate only the issue described in 
the paragraph and do not illustrate any other issue that may arise in 
this part.


Sec.  41.3  Definitions.

    As used in this part, unless the context requires otherwise:
    (a) Act means the Fair Credit Reporting Act (15 U.S.C. 1681 et 
seq.).
    (b) Affiliate means any company that controls, is controlled by, or 
is under common control with another company.
    (c) [Reserved]
    (d) Company means any corporation, limited liability company, 
business trust, general or limited partnership, association, or similar 
organization.
    (e) Consumer means an individual.
    (f) [Reserved]
    (g) [Reserved]
    (h) [Reserved]
    (i) Control of a company means:
    (1) Ownership, control, or power to vote 25 percent or more of the 
outstanding shares of any class of voting security of the company, 
directly or indirectly, or acting through one or more other persons;
    (2) Control in any manner over the election of a majority of the 
directors, trustees, or general partners (or individuals exercising 
similar functions) of the company; or
    (3) The power to exercise, directly or indirectly, a controlling 
influence over the management or policies of the company, as the OCC 
determines.
    (j) [Reserved]
    (k) Medical information means:
    (1) Information or data, whether oral or recorded, in any form or 
medium, created by or derived from a health care provider or the 
consumer, that relates to:
    (i) The past, present, or future physical, mental, or behavioral 
health or condition of an individual;
    (ii) The provision of health care to an individual; or
    (iii) The payment for the provision of health care to an 
individual.
    (2) The term does not include:
    (i) The age or gender of a consumer;
    (ii) Demographic information about the consumer, including a 
consumer's residence address or e-mail address; or
    (iii) Any other information about a consumer that does not relate 
to the physical, mental, or behavioral health or condition of a 
consumer, including the existence or value of any insurance policy.
    (l) [Reserved]
    (m) [Reserved]
    (n) [Reserved]
* * * * *

[[Page 23395]]

Subpart B--[Reserved]

Subpart C--[Reserved]

Subpart D--Medical Information


Sec.  41.30  Obtaining or using medical information in connection with 
a determination of eligibility for credit.

    (a) General prohibition on obtaining or using medical information--
(1) In general. A bank may not obtain or use medical information 
pertaining to a consumer in connection with any determination of the 
consumer's eligibility, or continued eligibility, for credit, except as 
provided in this subpart.
    (2) Definitions as used in this subpart--(i) Eligibility, or 
continued eligibility, for credit means the consumer's qualification or 
fitness to receive, or continue to receive, credit, including the terms 
on which credit is offered, primarily for personal, family, or 
household purposes. The term does not include:
    (A) The consumer's qualification or fitness to be offered 
employment, insurance products, or other non-credit products or 
services;
    (B) Any determination of whether the provisions of a debt 
cancellation contract, debt suspension agreement, credit insurance 
product, or similar forbearance practice or program are triggered;
    (C) Authorizing, processing, or documenting a payment or 
transaction on behalf of the consumer in a manner that does not involve 
a determination of the consumer's eligibility, or continued 
eligibility, for credit; or
    (D) Maintaining or servicing the consumer's account in a manner 
that does not involve a determination of the consumer's eligibility, or 
continued eligibility, for credit.
    (ii) Bank means an institution that:
    (A) is covered by this part in Sec.  41.1(b)(2); and
    (B) is a ``creditor'' as that term is defined by section 702 of the 
Equal Credit Opportunity Act (15 U.S.C. 1691a).
    (iii) Credit has the same meaning as in section 702 of the Equal 
Credit Opportunity Act (15 U.S.C. 1691a).
    (b) Rule of construction for receiving unsolicited medical 
information--(1) In general. A bank does not obtain medical information 
for purposes of paragraph (a)(1) of this section if it:
    (i) Receives medical information pertaining to a consumer in 
connection with any determination of the consumer's eligibility, or 
continued eligibility, for credit without specifically requesting 
medical information; and
    (ii) Does not use that information in determining whether to extend 
or continue to extend credit to the consumer and the terms on which 
credit is offered or continued.
    (2) Examples of receiving unsolicited medical information. A bank 
receives unsolicited medical information if, for example:
    (i) In response to a general question regarding a consumer's debts 
or expenses, the bank receives information that the consumer has a 
particular medical condition and does not use that information in 
determining whether to extend credit to the consumer or the terms on 
which credit is offered.
    (ii) In conversation with the loan officer, the consumer informs 
the bank that the consumer has a particular medical condition, and the 
bank does not use that information in determining whether to extend 
credit to the consumer or the terms on which credit is offered.
    (c) Financial information exception for obtaining and using medical 
information--(1) In general. A bank may obtain and use medical 
information pertaining to a consumer in connection with any 
determination of the consumer's eligibility, or continued eligibility, 
for credit so long as:
    (i) The information relates to debts, expenses, income, benefits, 
collateral, or the purpose of the loan, including the use of proceeds;
    (ii) The bank uses the medical information in a manner and to an 
extent that is no less favorable than it would use comparable 
information that is not medical information in a credit transaction; 
and
    (iii) The bank does not take the consumer's physical, mental, or 
behavioral health, condition or history, type of treatment, or 
prognosis into account as part of any such determination.
    (2) Examples--(i) Examples of information related to debts, 
expenses, income, benefits, collateral, or the purpose of the loan. 
Paragraph (c)(1)(i) of this section permits a bank, for example, to 
obtain and use information about:
    (A) The dollar amount, repayment terms, repayment history, and 
similar information regarding medical debts that is used to calculate, 
measure, or verify the repayment ability of the consumer, the use of 
proceeds, or the terms for granting credit;
    (B) The value, condition, and lien status of a medical device that 
is used as collateral to secure a loan;
    (C) The dollar amount and continued eligibility for disability 
income or benefits related to health or a medical condition that is 
relied on as a source of repayment; or
    (D) The identity of entities to whom outstanding medical debts are 
owed in connection with an application for credit, including but not 
limited to a transaction involving the consolidation of medical debts.
    (ii) Examples of uses of medical information consistent with the 
exception. (A) A consumer includes on an application for credit 
information about two $20,000 debts. One debt is to a hospital; the 
other debt is to a retailer. The bank contacts the hospital and the 
retailer to verify the amount and payment status of the debts. The bank 
learns that both debts are more than 90 days past due. Any two debts of 
this size that are past due would disqualify the consumer under the 
bank's established underwriting criteria. The bank denies the 
application on the basis that the consumer has a poor repayment history 
on outstanding debts. The bank has used medical information in a manner 
and to an extent no less favorable than it would use comparable non-
medical information.
    (B) A consumer indicates on an application for a $200,000 mortgage 
loan that she receives $15,000 in long-term disability income each year 
from her former employer and has no other income. Annual income of 
$15,000, regardless of source, would not be sufficient to support the 
requested amount of credit. The bank denies the application on the 
basis that the projected debt-to-income ratio of the consumer does not 
meet the bank's underwriting criteria. The bank has used medical 
information in a manner and to an extent that is no less favorable than 
it would use comparable non-medical information.
    (C) A consumer includes on an application for a $10,000 home equity 
loan that he has a $50,000 debt to a medical facility that specializes 
in treating a potentially terminal disease. The bank contacts the 
medical facility to verify the debt and obtain the repayment history 
and current status of the loan. The bank learns that the debt is 
current and that the applicant meets the income requirements of the 
bank's underwriting guidelines. The bank grants the application. The 
bank has used medical information in accordance with the exception.
    (iii) Examples of uses of medical information inconsistent with the 
exception.
    (A) A consumer applies for $25,000 of credit and includes on the 
application information about a $50,000 debt to a hospital. The bank 
contacts the hospital to verify the amount and payment status

[[Page 23396]]

of the debt, and learns that the debt is current and that the consumer 
has no delinquencies in her repayment history. If the existing debt 
were instead owed to a home furnishing retailer, the bank would approve 
the application and extend credit based on the amount and repayment 
history of the outstanding debt. The bank, however, denies the 
application because the consumer is indebted to a hospital. The bank 
has used medical information, here the identity of the hospital, in a 
manner and to an extent that is less favorable than it would use 
comparable non-medical information.
    (B) A consumer meets with a loan officer of a bank to apply for a 
mortgage loan. While filling out the loan application, the consumer 
informs the loan officer orally that she has a potentially terminal 
disease. The consumer meets the bank's established requirements for the 
requested mortgage. The loan officer recommends to the credit committee 
that the consumer be denied credit because the consumer has that 
disease. The bank has used medical information in a manner inconsistent 
with the exception by taking into account the consumer's physical, 
mental, or behavioral health, condition, or history, type of treatment, 
or prognosis as part of a determination of eligibility or continued 
eligibility for credit.
    (d) Specific exceptions for obtaining and using medical 
information--(1) In general. A bank may obtain and use medical 
information pertaining to a consumer in connection with any 
determination of the consumer's eligibility, or continued eligibility, 
for credit:
    (i) To determine whether the use of a power of attorney or legal 
representative is necessary and appropriate;
    (ii) To comply with applicable requirements of local, state, or 
federal laws;
    (iii) To the extent such information is included in a consumer 
report from a consumer reporting agency, in accordance with 15 U.S.C. 
1681b(g)(1)(B), and is used for the purpose(s) for which the consumer 
provided specific written consent;
    (iv) For purposes of fraud prevention and detection;
    (v) In the case of credit for the purpose of financing medical 
products or services, to determine and verify the medical purpose of a 
loan and the use of proceeds;
    (vi) If the consumer or the consumer's legal representative 
requests in writing, on a separate form signed by the consumer or the 
consumer's legal representative that the bank use specific medical 
information for a specific purpose in determining the consumer's 
eligibility, or continued eligibility, for credit, to accommodate the 
consumer's particular circumstances. The signed written request must 
describe the specific medical information that the consumer requests 
the bank to use and the specific purpose for which the information will 
be used; or
    (vii) As otherwise permitted by order of the OCC.
    (2) Examples of determining the medical purpose of the loan or the 
use of proceeds. (i) If a consumer applies for $10,000 of credit for 
the purpose of financing vision correction surgery, the bank may 
confirm the consumer's medical eligibility to undergo that procedure 
with the surgeon. If the surgeon reports that surgery will not be 
performed on the consumer, the bank may use that medical information to 
deny the consumer's application for credit, because the loan would not 
be used for the stated purpose.
    (ii) If a consumer applies for $10,000 of credit for the purpose of 
financing cosmetic surgery, the bank may confirm the cost of the 
procedure with the surgeon. If the surgeon reports that the cost of the 
procedure is $5,000, the bank may use that medical information to offer 
the consumer only $5,000 of credit.
    (iii) A bank has an established medical loan program for financing 
particular elective surgical procedures. The bank receives a loan 
application from a consumer requesting $10,000 of credit under the 
established loan program for an elective surgical procedure. The 
consumer indicates on the application that the purpose of the loan is 
to finance an elective surgical procedure not eligible for funding 
under the guidelines of the established loan program. The bank may deny 
the consumer's application because the purpose of the loan is not for a 
particular procedure funded by the established loan program.
    (3) Examples of obtaining and using medical information at the 
request of the consumer. Consistent with safe and sound practices, and 
after obtaining from the consumer a signed, written document that 
describes the specific medical information that the consumer requests 
the bank to use and the specific purpose for which the information will 
be used, the bank may obtain and use the specific medical information 
for the specific purpose described in the request:
    (i) If a consumer applies for a loan and requests that the bank 
consider the consumer's medical disability at the relevant time as an 
explanation for adverse payment history information in his credit 
report, the bank may consider such medical information in evaluating 
the consumer's willingness and ability to repay the requested loan.
    (ii) If a consumer applies for a loan and explains that his income 
has been and will continue to be interrupted on account of a medical 
condition and that he expects to repay the loan from liquidation of 
assets, the bank may evaluate the application using the sale of assets 
as the primary source of repayment.
    (e) Limits on redisclosure of information. If the bank receives 
medical information about a consumer from a consumer reporting agency 
or its affiliate, the bank must not disclose that information to any 
other person, except as necessary to carry out the purpose for which 
the information was initially disclosed, or as otherwise permitted by 
statute, regulation, or order.


Sec.  41.31  Sharing medical information with affiliates.

    (a) In general. The exclusions from the term ``consumer report'' in 
section 603(d)(2) of the Act that allow the sharing of information with 
affiliates do not apply if the bank communicates to an affiliate:
    (1) Medical information;
    (2) An individualized list or description based on the payment 
transactions of the consumer for medical products or services; or
    (3) An aggregate list of identified consumers based on payment 
transactions for medical products or services.
    (b) Exceptions. The bank may rely on the exclusions from the term 
``consumer report'' in section 603(d)(2) of the Act to communicate the 
information in paragraph (a) of this section to an affiliate:
    (1) In connection with the business of insurance or annuities 
(including the activities described in section 18B of the model Privacy 
of Consumer Financial and Health Information Regulation issued by the 
National Association of Insurance Commissioners, as in effect on 
January 1, 2003);
    (2) For any purpose permitted without authorization under the 
regulations promulgated by the U.S. Department of Health and Human 
Services pursuant to the Health Insurance Portability and 
Accountability Act of 1996 (HIPAA);
    (3) For any purpose referred to in section 1179 of HIPAA;
    (4) For any purpose described in section 502(e) of the Gramm-Leach-
Bliley Act;
    (5) In connection with a determination of the consumer's 
eligibility, or continued eligibility, for credit consistent with Sec.  
41.30; or

[[Page 23397]]

    (6) As otherwise permitted by order of the OCC.

Board of Governors of the Federal Reserve System

12 CFR Chapter II

Authority and Issuance

    For the reasons set forth in the joint preamble, title 12, chapter 
II, of the Code of Federal Regulations is proposed to be amended by 
revising part 222 to read as follows:

PART 222--FAIR CREDIT REPORTING (REGULATION V)

    1. The authority citation for part 222 is amended to read as 
follows:

    Authority: 15 U.S.C. 1681b and 1681s; Secs. 3 and 217, Pub. L. 
108-159, 117 Stat. 1952.

    2. In subpart A to part 222, the following amendments are made:
    a. Section 222.1 is amended by adding a new paragraph (b).
    b. Section 222.2 is added.
    c. Section 222.3 is added.
    3. A new subpart D is added to part 222.

Subpart A--General Provisions


Sec.  222.1  Purpose, scope, and effective dates

* * * * *
    (b) Scope.
    (1) [Reserved]
    (2) Institutions covered. (i) Except as otherwise provided in 
paragraph (b)(2) of this section, these regulations apply to banks that 
are members of the Federal Reserve System (other than national banks), 
branches and Agencies of foreign banks (other than Federal branches, 
Federal Agencies, and insured State branches of foreign banks), 
commercial lending companies owned or controlled by foreign banks, 
organizations operating under section 25 or 25A of the Federal Reserve 
Act (12 U.S.C. 601 et seq., and 611 et seq.), and bank holding 
companies and affiliates of such holding companies.
    (ii) [Reserved]
    (iii) Section 222.30(a)-(d) of this part applies to persons listed 
in paragraph (b)(2)(i) of this section that are creditors.
    (iv) Section 222.31 of this part applies to banks that are members 
of the Federal Reserve System (other than national banks), branches and 
Agencies of foreign banks (other than Federal branches, Federal 
Agencies, and insured State branches of foreign banks), commercial 
lending companies owned or controlled by foreign banks, organizations 
operating under section 25 or 25A of the Federal Reserve Act (12 U.S.C. 
601 et seq., and 611 et seq.).
* * * * *


Sec.  222.2  Examples.

    The examples in this part are not exclusive. Compliance with an 
example, to the extent applicable, constitutes compliance with this 
part. Examples in a paragraph illustrate only the issue described in 
the paragraph and do not illustrate any other issue that may arise in 
this part.


Sec.  222.3  Definitions.

    As used in this part, unless the context requires otherwise:
    (a) Act means the Fair Credit Reporting Act (15 U.S.C. 1681 et 
seq.).
    (b) Affiliate means any company that controls, is controlled by, or 
is under common control with another company.
    (c) [Reserved]
    (d) Company means any corporation, limited liability company, 
business trust, general or limited partnership, association, or similar 
organization.
    (e) Consumer means an individual.
    (f) [Reserved]
    (g) [Reserved]
    (h) [Reserved]
    (i) Control of a company means:
    (1) Ownership, control, or power to vote 25 percent or more of the 
outstanding shares of any class of voting security of the company, 
directly or indirectly, or acting through one or more other persons;
    (2) Control in any manner over the election of a majority of the 
directors, trustees, or general partners (or individuals exercising 
similar functions) of the company; or
    (3) The power to exercise, directly or indirectly, a controlling 
influence over the management or policies of the company, as the Board 
determines.
    (j) [Reserved]
    (k) Medical information means:
    (1) Information or data, whether oral or recorded, in any form or 
medium, created by or derived from a health care provider or the 
consumer, that relates to--
    (i) The past, present, or future physical, mental, or behavioral 
health or condition of an individual;
    (ii) The provision of health care to an individual; or
    (iii) The payment for the provision of health care to an 
individual.
    (2) The term does not include:
    (i) The age or gender of a consumer;
    (ii) Demographic information about the consumer, including a 
consumer's residence address or e-mail address; or
    (iii) Any other information about a consumer that does not relate 
to the physical, mental, or behavioral health or condition of a 
consumer, including the existence or value of any insurance policy.
    (l) [Reserved]
    (m) [Reserved]
    (n) [Reserved]
    (o) You means member banks of the Federal Reserve System (other 
than national banks), branches and Agencies of foreign banks (other 
than Federal branches, Federal Agencies, and insured State branches of 
foreign banks), commercial lending companies owned or controlled by 
foreign banks, organizations operating under section 25 or 25A of the 
Federal Reserve Act (12 U.S.C. 601 et seq., and 611 et seq.), and bank 
holding companies and affiliates of such holding companies (other than 
depository institutions and consumer reporting agencies).

Subpart B--[Reserved]

Subpart C--[Reserved]

Subpart D--Medical Information
Sec.
222.30 Obtaining or using medical information in connection with a 
determination of eligibility for credit.
222.31 Sharing medical information with affiliates.

Subpart D--Medical Information


Sec.  222.30  Obtaining or using medical information in connection with 
a determination of eligibility for credit.

    (a) General prohibition on obtaining or using medical information--
(1) In general. A creditor may not obtain or use medical information 
pertaining to a consumer in connection with any determination of the 
consumer's eligibility, or continued eligibility, for credit, except as 
provided in this subpart.
    (2) Definitions as used in this subpart--(i) Eligibility, or 
continued eligibility, for credit means the consumer's qualification or 
fitness to receive, or continue to receive, credit, including the terms 
on which credit is offered, primarily for personal, family, or 
household purposes. The term does not include:
    (A) The consumer's qualification or fitness to be offered 
employment, insurance products, or other non-credit products or 
services;
    (B) Any determination of whether the provisions of a debt 
cancellation contract, debt suspension agreement, credit insurance 
product, or similar forbearance practice or program are triggered;
    (C) Authorizing, processing, or documenting a payment or 
transaction on behalf of the consumer in a manner

[[Page 23398]]

that does not involve a determination of the consumer's eligibility, or 
continued eligibility, for credit; or
    (D) Maintaining or servicing the consumer's account in a manner 
that does not involve a determination of the consumer's eligibility, or 
continued eligibility, for credit.
    (ii) Creditor has the same meaning as in section 702 of the Equal 
Credit Opportunity Act, 15 U.S.C. 1691a.
    (iii) Credit has the same meaning as in section 702 of the Equal 
Credit Opportunity Act, 15 U.S.C. 1691a.
    (b) Rule of construction for receiving unsolicited medical 
information--(1) In general. A creditor does not obtain medical 
information for purposes of paragraph (a)(1) of this section if it--
    (i) Receives medical information pertaining to a consumer in 
connection with any determination of the consumer's eligibility, or 
continued eligibility, for credit without specifically requesting 
medical information; and
    (ii) Does not use that information in determining whether to extend 
or continue to extend credit to the consumer and the terms on which 
credit is offered or continued.
    (2) Examples of receiving unsolicited medical information. A 
creditor receives unsolicited medical information if, for example:
    (i) In response to a general question regarding a consumer's debts 
or expenses, the creditor receives information that the consumer has a 
particular medical condition and does not use that information in 
determining whether to extend credit to the consumer or the terms on 
which credit is offered.
    (ii) In conversation with the loan officer, the consumer informs 
the creditor that the consumer has a particular medical condition, and 
the creditor does not use that information in determining whether to 
extend credit to the consumer or the terms on which credit is offered.
    (c) Financial information exception for obtaining and using medical 
information--(1) In general. A creditor may obtain and use medical 
information pertaining to a consumer in connection with any 
determination of the consumer's eligibility, or continued eligibility, 
for credit so long as:
    (i) The information relates to debts, expenses, income, benefits, 
collateral, or the purpose of the loan, including the use of proceeds;
    (ii) The creditor uses the medical information in a manner and to 
an extent that is no less favorable than it would use comparable 
information that is not medical information in a credit transaction; 
and
    (iii) The creditor does not take the consumer's physical, mental, 
or behavioral health, condition or history, type of treatment, or 
prognosis into account as part of any such determination.
    (2) Examples--(i) Examples of information related to debts, 
expenses, income, benefits, collateral, or the purpose of the loan. 
Paragraph (c)(1)(i) of this section permits a creditor, for example, to 
obtain and use information about:
    (A) The dollar amount, repayment terms, repayment history, and 
similar information regarding medical debts that is used to calculate, 
measure, or verify the repayment ability of the consumer, the use of 
proceeds, or the terms for granting credit;
    (B) The value, condition, and lien status of a medical device that 
is used as collateral to secure a loan;
    (C) The dollar amount and continued eligibility for disability 
income or benefits related to health or a medical condition that is 
relied on as a source of repayment; or
    (D) The identity of creditors to whom outstanding medical debts are 
owed in connection with an application for credit, including but not 
limited to a transaction involving the consolidation of medical debts.
    (ii) Examples of uses of medical information consistent with the 
exception. (A) A consumer includes on an application for credit 
information about two $20,000 debts. One debt is to a hospital; the 
other debt is to a retailer. The creditor contacts the hospital and the 
retailer to verify the amount and payment status of the debts. The 
creditor learns that both debts are more than 90 days past due. Any two 
debts of this size that are past due would disqualify the consumer 
under the creditor's established underwriting criteria. The creditor 
denies the application on the basis that the consumer has a poor 
repayment history on outstanding debts. The creditor has used medical 
information in a manner and to an extent no less favorable than it 
would use comparable non-medical information.
    (B) A consumer indicates on an application for a $200,000 mortgage 
loan that she receives $15,000 in long-term disability income each year 
from her former employer and has no other income. Annual income of 
$15,000, regardless of source, would not be sufficient to support the 
requested amount of credit. The creditor denies the application on the 
basis that the projected debt-to-income ratio of the consumer does not 
meet the creditor's underwriting criteria. The creditor has used 
medical information in a manner and to an extent that is no less 
favorable than it would use comparable non-medical information.
    (C) A consumer includes on an application for a $10,000 home equity 
loan that he has a $50,000 debt to a medical facility that specializes 
in treating a potentially terminal disease. The creditor contacts the 
medical facility to verify the debt and obtain the repayment history 
and current status of the loan. The creditor learns that the debt is 
current and that the applicant meets the income requirements of the 
creditor's underwriting guidelines. The creditor grants the 
application. The creditor has used medical information in accordance 
with the exception.
    (iii) Examples of uses of medical information inconsistent with the 
exception.
    (A) A consumer applies for $25,000 of credit and includes on the 
application information about a $50,000 debt to a hospital. The 
creditor contacts the hospital to verify the amount and payment status 
of the debt, and learns that the debt is current and that the consumer 
has no delinquencies in her repayment history. If the existing debt 
were instead owed to a home furnishing retailer, the creditor would 
approve the application and extend credit based on the amount and 
repayment history of the outstanding debt. The creditor, however, 
denies the application because the consumer is indebted to a hospital. 
The creditor has used medical information, here the identity of the 
medical creditor, in a manner and to an extent that is less favorable 
than it would use comparable non-medical information.
    (B) A consumer meets with a loan officer of a creditor to apply for 
a mortgage loan. While filling out the loan application, the consumer 
informs the loan officer orally that she has a potentially terminal 
disease. The consumer meets the creditor's established requirements for 
the requested mortgage. The loan officer recommends to the credit 
committee that the consumer be denied credit because the consumer has 
that disease. The creditor has used medical information in a manner 
inconsistent with the exception by taking into account the consumer's 
physical, mental, or behavioral health, condition, or history, type of 
treatment, or prognosis as part of a determination of eligibility or 
continued eligibility for credit.
    (d) Specific exceptions for obtaining and using medical 
information--(1) In general. A creditor may obtain and use medical 
information pertaining to a

[[Page 23399]]

consumer in connection with any determination of the consumer's 
eligibility, or continued eligibility, for credit--
    (i) To determine whether the use of a power of attorney or legal 
representative is necessary and appropriate;
    (ii) To comply with applicable requirements of local, state, or 
federal laws;
    (iii) To the extent such information is included in a consumer 
report from a consumer reporting agency, in accordance with 15 U.S.C. 
1681b(g)(1)(B), and is used for the purpose(s) for which the consumer 
provided specific written consent;
    (iv) For purposes of fraud prevention and detection;
    (v) In the case of credit for the purpose of financing medical 
products or services, to determine and verify the medical purpose of a 
loan and the use of proceeds;
    (vi) If the consumer or the consumer's legal representative 
requests in writing, on a separate form signed by the consumer or the 
consumer's legal representative that the creditor use specific medical 
information for a specific purpose in determining the consumer's 
eligibility, or continued eligibility, for credit, to accommodate the 
consumer's particular circumstances. The signed written request must 
describe the specific medical information that the consumer requests 
the creditor to use and the specific purpose for which the information 
will be used; or
    (vii) As otherwise permitted by order of the Board.
    (2) Examples of determining the medical purpose of the loan or the 
use of proceeds. (i) If a consumer applies for $10,000 of credit for 
the purpose of financing vision correction surgery, the creditor may 
confirm the consumer's medical eligibility to undergo that procedure 
with the surgeon. If the surgeon reports that surgery will not be 
performed on the consumer, the creditor may use that medical 
information to deny the consumer's application for credit, because the 
loan would not be used for the stated purpose.
    (ii) If a consumer applies for $10,000 of credit for the purpose of 
financing cosmetic surgery, the creditor may confirm the cost of the 
procedure with the surgeon. If the surgeon reports that the cost of the 
procedure is $5,000, the creditor may use that medical information to 
offer the consumer only $5,000 of credit.
    (iii) A creditor has an established medical loan program for 
financing particular elective surgical procedures. The creditor 
receives a loan application from a consumer requesting $10,000 of 
credit under the established loan program for an elective surgical 
procedure. The consumer indicates on the application that the purpose 
of the loan is to finance an elective surgical procedure not eligible 
for funding under the guidelines of the established loan program. The 
creditor may deny the consumer's application because the purpose of the 
loan is not for a particular procedure funded by the established loan 
program.
    (3) Examples of obtaining and using medical information at the 
request of the consumer. Consistent with safe and sound practices, and 
after obtaining from the consumer a signed, written document that 
describes the specific medical information that the consumer requests 
the creditor to use and the specific purpose for which the information 
will be used, the creditor may obtain and use the specific medical 
information for the specific purpose specified in the request:
    (i) If a consumer applies for a loan and requests that the creditor 
consider the consumer's medical disability at the relevant time as an 
explanation for adverse payment history information in his credit 
report, the creditor may consider such medical information in 
evaluating the consumer's willingness and ability to repay the 
requested loan.
    (ii) If a consumer applies for a loan and explains that his income 
has been and will continue to be interrupted on account of a medical 
condition and that he expects to repay the loan from liquidation of 
assets, the creditor may evaluate the application using the sale of 
assets as the primary source of repayment.
    (e) Limits on redisclosure of information. If you receive medical 
information about a consumer from a consumer reporting agency or your 
affiliate, you must not disclose that information to any other person, 
except as necessary to carry out the purpose for which the information 
was initially disclosed, or as otherwise permitted by statute, 
regulation, or order.


Sec.  222.31  Sharing medical information with affiliates.

    (a) In general. The exclusions from the term ``consumer report'' in 
section 603(d)(2) of the Act that allow the sharing of information with 
affiliates do not apply to a person described in Sec.  222.1(b)(2)(iv) 
of this part if that person communicates to an affiliate
    (1) Medical information;
    (2) An individualized list or description based on the payment 
transactions of the consumer for medical products or services; or
    (3) An aggregate list of identified consumers based on payment 
transactions for medical products or services.
    (b) Exceptions. A person described in Sec.  222.1(b)(2)(iv) of this 
part may rely on the exclusions from the term ``consumer report'' in 
section 603(d)(2) of the Act to communicate the information in 
paragraph (a) to an affiliate--
    (1) In connection with the business of insurance or annuities 
(including the activities described in section 18B of the model Privacy 
of Consumer Financial and Health Information Regulation issued by the 
National Association of Insurance Commissioners, as in effect on 
January 1, 2003);
    (2) For any purpose permitted without authorization under the 
regulations promulgated by the Department of Health and Human Services 
pursuant to the Health Insurance Portability and Accountability Act of 
1996 (HIPAA);
    (3) For any purpose referred to in section 1179 of HIPAA;
    (4) For any purpose described in section 502(e) of the Gramm-Leach-
Bliley Act;
    (5) In connection with a determination of the consumer's 
eligibility, or continued eligibility, for credit consistent with Sec.  
222.30 of this part; or
    (6) As otherwise permitted by order of the Board.

Federal Deposit Insurance Corporation

12 CFR Chapter III

Authority and Issuance

    For the reasons set forth in the joint preamble, the Federal 
Deposit Insurance Corporation proposes to add part 334 of chapter III 
of title 12 of the Code of Federal Regulations to read as follows:

PART 334--FAIR CREDIT REPORTING

Subpart A--General Provisions

Sec.
334.1 Purpose, scope, and effective dates.
334.2 Examples.
334.3 Definitions.
Subpart B--[Reserved]
Subpart C--[Reserved]
Subpart D--Medical Information
334.30 Obtaining or using medical information in connection with a 
determination of eligibility for credit.
334.31 Sharing medical information with affiliates.

    Authority: 12 U.S.C. 1819(Tenth) and 1818; 15 U.S.C. 1681b and 
1681s.

[[Page 23400]]

Subpart A--General Provisions


Sec.  334.1  Purpose, scope, and effective dates.

    (a) [Reserved]
    (b) Scope.
    (1) [Reserved]
    (2) Institutions covered.
    (i) Except as otherwise provided in this paragraph, these 
regulations apply to banks insured by the FDIC (other than District 
Banks and members of the Federal Reserve System) and insured State 
branches of foreign banks and any subsidiaries and affiliates of such 
entities; and other entities or persons with respect to which the FDIC 
may exercise its enforcement authority under any provision of law. For 
purposes of this definition, a subsidiary does not include a broker, 
dealer, person providing insurance, investment company, and investment 
advisor.
    (ii) [Reserved]
    (iii) Section 334.30 of this part applies to creditors, as defined 
in Sec.  334.30(a)(2), that are subject to the jurisdiction of the 
Federal Deposit Insurance Corporation under paragraph (b)(2)(i) of this 
section.


Sec.  334.2  Examples.

    The examples in this part are not exclusive. Compliance with an 
example, to the extent applicable, constitutes compliance with this 
part. Examples in a paragraph illustrate only the issue described in 
the paragraph and do not illustrate any other issue that may arise in 
this part.


Sec.  334.3  Definitions.

    As used in this part, unless the context requires otherwise:
    (a) Act means the Fair Credit Reporting Act (15 U.S.C. 1681 et 
seq.).
    (b) Affiliate means any company that controls, is controlled by, or 
is under common control with another company.
    (c) [Reserved]
    (d) Company means any corporation, limited liability company, 
business trust, general or limited partnership, association, or similar 
organization.
    (e) Consumer means an individual.
    (f) [Reserved]
    (g) [Reserved]
    (h) [Reserved]
    (i) Control of a company means:
    (1) Ownership, control, or power to vote 25 percent or more of the 
outstanding shares of any class of voting security of the company, 
directly or indirectly, or acting through one or more other persons;
    (2) Control in any manner over the election of a majority of the 
directors, trustees, or general partners (or individuals exercising 
similar functions) of the company; or
    (3) The power to exercise, directly or indirectly, a controlling 
influence over the management or policies of the company, as the Board 
determines.
    (j) [Reserved]
    (k) Medical information means:
    (1) Information or data, whether oral or recorded, in any form or 
medium, created by or derived from a health care provider or the 
consumer, that relates to--
    (i) The past, present, or future physical, mental, or behavioral 
health or condition of an individual;
    (ii) The provision of health care to an individual; or
    (iii) The payment for the provision of health care to an 
individual.
    (2) The term does not include:
    (i) The age or gender of a consumer;
    (ii) Demographic information about the consumer, including a 
consumer's residence address or e-mail address; or
    (iii) Any other information about a consumer that does not relate 
to the physical, mental, or behavioral health or condition of a 
consumer, including the existence or value of any insurance policy.
    (l) [Reserved]
    (m) [Reserved]
    (n) [Reserved]
    (o) You means banks insured by the FDIC (other than District Banks 
and members of the Federal Reserve System) and insured State branches 
of foreign banks and any subsidiaries and affiliates of such entities; 
and other entities or persons with respect to which the FDIC may 
exercise its enforcement authority under any provision of law. For 
purposes of this definition, a subsidiary does not include a broker, 
dealer, person providing insurance, investment company, and investment 
advisor.

Subpart B--[Reserved]

Subpart C--[Reserved]

Subpart D--Medical Information


Sec.  334.30  Obtaining or using medical information in connection with 
a determination of eligibility for credit.

    (a) General prohibition on obtaining or using medical information--
(1) In general. A creditor may not obtain or use medical information 
pertaining to a consumer in connection with any determination of the 
consumer's eligibility, or continued eligibility, for credit, except as 
provided in this subpart.
    (2) Definitions as used in this subpart--(i) Eligibility, or 
continued eligibility, for credit means the consumer's qualification or 
fitness to receive, or continue to receive, credit, including the terms 
on which credit is offered, primarily for personal, family, or 
household purposes. The term does not include:
    (A) The consumer's qualification or fitness to be offered 
employment, insurance products, or other non-credit products or 
services;
    (B) Any determination of whether the provisions of a debt 
cancellation contract, debt suspension agreement, credit insurance 
product, or similar forbearance practice or program are triggered;
    (C) Authorizing, processing, or documenting a payment or 
transaction on behalf of the consumer in a manner that does not involve 
a determination of the consumer's eligibility, or continued 
eligibility, for credit; or
    (D) Maintaining or servicing the consumer's account in a manner 
that does not involve a determination of the consumer's eligibility, or 
continued eligibility, for credit.
    (ii) Creditor has the same meaning as in section 702 of the Equal 
Credit Opportunity Act, 15 U.S.C. 1691a.
    (iii) Credit has the same meaning as in section 702 of the Equal 
Credit Opportunity Act, 15 U.S.C. 1691a.
    (b) Rule of construction for receiving unsolicited medical 
information--(1) In general. A creditor does not obtain medical 
information for purposes of paragraph (a)(1) of this section if it--
    (i) Receives medical information pertaining to a consumer in 
connection with any determination of the consumer's eligibility, or 
continued eligibility, for credit without specifically requesting 
medical information; and
    (ii) Does not use that information in determining whether to extend 
or continue to extend credit to the consumer and the terms on which 
credit is offered or continued.
    (2) Examples of receiving unsolicited medical information. A 
creditor receives unsolicited medical information if, for example:
    (i) In response to a general question regarding a consumer's debts 
or expenses, the creditor receives information that the consumer has a 
particular medical condition and does not use that information in 
determining whether to extend credit to the consumer or the terms on 
which credit is offered.
    (ii) In conversation with the loan officer, the consumer informs 
the creditor that the consumer has a particular medical condition, and 
the creditor does not use that information in determining whether to 
extend credit to the consumer or the terms on which credit is offered.

[[Page 23401]]

    (c) Financial information exception for obtaining and using medical 
information--(1) In general. A creditor may obtain and use medical 
information pertaining to a consumer in connection with any 
determination of the consumer's eligibility, or continued eligibility, 
for credit so long as:
    (i) The information relates to debts, expenses, income, benefits, 
collateral, or the purpose of the loan, including the use of proceeds;
    (ii) The creditor uses the medical information in a manner and to 
an extent that is no less favorable than it would use comparable 
information that is not medical information in a credit transaction; 
and
    (iii) The creditor does not take the consumer's physical, mental, 
or behavioral health, condition or history, type of treatment, or 
prognosis into account as part of any such determination.
    (2) Examples--(i) Examples of information related to debts, 
expenses, income, benefits, collateral, or the purpose of the loan. 
Paragraph (c)(1)(i) of this section permits a creditor, for example, to 
obtain and use information about:
    (A) The dollar amount, repayment terms, repayment history, and 
similar information regarding medical debts that is used to calculate, 
measure, or verify the repayment ability of the consumer, the use of 
proceeds, or the terms for granting credit;
    (B) The value, condition, and lien status of a medical device that 
is used as collateral to secure a loan;
    (C) The dollar amount and continued eligibility for disability 
income or benefits related to health or a medical condition that is 
relied on as a source of repayment; or
    (D) The identity of creditors to whom outstanding medical debts are 
owed in connection with an application for credit, including but not 
limited to a transaction involving the consolidation of medical debts.
    (ii) Examples of uses of medical information consistent with the 
exception. (A) A consumer includes on an application for credit 
information about two $20,000 debts. One debt is to a hospital; the 
other debt is to a retailer. The creditor contacts the hospital and the 
retailer to verify the amount and payment status of the debts. The 
creditor learns that both debts are more than 90 days past due. Any two 
debts of this size that are past due would disqualify the consumer 
under the creditor's established underwriting criteria. The creditor 
denies the application on the basis that the consumer has a poor 
repayment history on outstanding debts. The creditor has used medical 
information in a manner and to an extent no less favorable than it 
would use comparable non-medical information.
    (B) A consumer indicates on an application for a $200,000 mortgage 
loan that she receives $15,000 in long-term disability income each year 
from her former employer and has no other income. Annual income of 
$15,000, regardless of source, would not be sufficient to support the 
requested amount of credit. The creditor denies the application on the 
basis that the projected debt-to-income ratio of the consumer does not 
meet the creditor's underwriting criteria. The creditor has used 
medical information in a manner and to an extent that is no less 
favorable than it would use comparable non-medical information.
    (C) A consumer includes on an application for a $10,000 home equity 
loan that he has a $50,000 debt to a medical facility that specializes 
in treating a potentially terminal disease. The creditor contacts the 
medical facility to verify the debt and obtain the repayment history 
and current status of the loan. The creditor learns that the debt is 
current and that the applicant meets the income requirements of the 
creditor's underwriting guidelines. The creditor grants the 
application. The creditor has used medical information in accordance 
with the exception.
    (iii) Examples of uses of medical information inconsistent with the 
exception.
    (A) A consumer applies for $25,000 of credit and includes on the 
application information about a $50,000 debt to a hospital. The 
creditor contacts the hospital to verify the amount and payment status 
of the debt, and learns that the debt is current and that the consumer 
has no delinquencies in her repayment history. If the existing debt 
were instead owed to a home furnishing retailer, the creditor would 
approve the application and extend credit based on the amount and 
repayment history of the outstanding debt. The creditor, however, 
denies the application because the consumer is indebted to a hospital. 
The creditor has used medical information, here the identity of the 
medical creditor, in a manner and to an extent that is less favorable 
than it would use comparable non-medical information.
    (B) A consumer meets with a loan officer of a creditor to apply for 
a mortgage loan. While filling out the loan application, the consumer 
informs the loan officer orally that she has a potentially terminal 
disease. The consumer meets the creditor's established requirements for 
the requested mortgage. The loan officer recommends to the credit 
committee that the consumer be denied credit because the consumer has 
that disease. The creditor has used medical information in a manner 
inconsistent with the exception by taking into account the consumer's 
physical, mental, or behavioral health, condition, or history, type of 
treatment, or prognosis as part of a determination of eligibility or 
continued eligibility for credit.
    (d) Specific exceptions for obtaining and using medical 
information. (1) In general. A creditor may obtain and use medical 
information pertaining to a consumer in connection with any 
determination of the consumer's eligibility, or continued eligibility, 
for credit--
    (i) To determine whether the use of a power of attorney or legal 
representative is necessary and appropriate;
    (ii) To comply with applicable requirements of local, state, or 
federal laws;
    (iii) To the extent such information is included in a consumer 
report from a consumer reporting agency, in accordance with 15 U.S.C. 
1681b(g)(1)(B), and is used for the purpose(s) for which the consumer 
provided specific written consent;
    (iv) For purposes of fraud prevention and detection;
    (v) In the case of credit for the purpose of financing medical 
products or services, to determine and verify the medical purpose of a 
loan and the use of proceeds;
    (vi) If the consumer or the consumer's legal representative 
requests in writing, on a separate form signed by the consumer or the 
consumer's legal representative that the creditor use specific medical 
information for a specific purpose in determining the consumer's 
eligibility, or continued eligibility, for credit, to accommodate the 
consumer's particular circumstances. The signed written request must 
describe the specific medical information that the consumer requests 
the creditor to use and the specific purpose for which the information 
will be used; or
    (vii) As otherwise permitted by order of the Board.
    (2) Examples of determining the medical purpose of the loan or the 
use of proceeds. (i) If a consumer applies for $10,000 of credit for 
the purpose of financing vision correction surgery, the creditor may 
confirm the consumer's medical eligibility to undergo that procedure 
with the surgeon. If the surgeon reports that surgery will not be

[[Page 23402]]

performed on the consumer, the creditor may use that medical 
information to deny the consumer's application for credit, because the 
loan would not be used for the stated purpose.
    (ii) If a consumer applies for $10,000 of credit for the purpose of 
financing cosmetic surgery, the creditor may confirm the cost of the 
procedure with the surgeon. If the surgeon reports that the cost of the 
procedure is $5,000, the creditor may use that medical information to 
offer the consumer only $5,000 of credit.
    (iii) A creditor has an established medical loan program for 
financing particular elective surgical procedures. The creditor 
receives a loan application from a consumer requesting $10,000 of 
credit under the established loan program for an elective surgical 
procedure. The consumer indicates on the application that the purpose 
of the loan is to finance an elective surgical procedure not eligible 
for funding under the guidelines of the established loan program. The 
creditor may deny the consumer's application because the purpose of the 
loan is not for a particular procedure funded by the established loan 
program.
    (3) Examples of obtaining and using medical information at the 
request of the consumer. Consistent with safe and sound practices, and 
after obtaining from the consumer a signed, written document that 
describes the specific medical information that the consumer requests 
the creditor to use and the specific purpose for which the information 
will be used, the creditor may obtain and use the specific medical 
information for the specific purpose specified in the request:
    (i) If a consumer applies for a loan and requests that the creditor 
consider the consumer's medical disability at the relevant time as an 
explanation for adverse payment history information in his credit 
report, the creditor may consider such medical information in 
evaluating the consumer's willingness and ability to repay the 
requested loan.
    (ii) If a consumer applies for a loan and explains that his income 
has been and will continue to be interrupted on account of a medical 
condition and that he expects to repay the loan from liquidation of 
assets, the creditor may evaluate the application using the sale of 
assets as the primary source of repayment.
    (e) Limits on redisclosure of information. If you receive medical 
information about a consumer from a consumer reporting agency or your 
affiliate, you must not disclose that information to any other person, 
except as necessary to carry out the purpose for which the information 
was initially disclosed, or as otherwise permitted by statute, 
regulation, or order.


Sec.  334.31  Sharing medical information with affiliates.

    (a) In general. The exclusions from the term ``consumer report'' in 
section 603(d)(2) of the Act that allow the sharing of information with 
affiliates do not apply if you communicate to an affiliate--
    (1) Medical information;
    (2) An individualized list or description based on the payment 
transactions of the consumer for medical products or services; or
    (3) An aggregate list of identified consumers based on payment 
transactions for medical products or services.
    (b) Exceptions. You may rely on the exclusions from the term 
``consumer report'' in section 603(d)(2) of the Act to communicate the 
information in paragraph (a) to an affiliate--
    (1) In connection with the business of insurance or annuities 
(including the activities described in section 18B of the model Privacy 
of Consumer Financial and Health Information Regulation issued by the 
National Association of Insurance Commissioners, as in effect on 
January 1, 2003);
    (2) For any purpose permitted without authorization under the 
regulations promulgated by the Department of Health and Human Services 
pursuant to the Health Insurance Portability and Accountability Act of 
1996 (HIPAA);
    (3) For any purpose referred to in section 1179 of HIPAA;
    (4) For any purpose described in section 502(e) of the Gramm-Leach-
Bliley Act;
    (5) In connection with a determination of the consumer's 
eligibility, or continued eligibility, for credit consistent with Sec.  
334.30 of this part; or
    (6) As otherwise permitted by order of the Board.

Office of Thrift Supervision

12 CFR Chapter V

Authority and Issuance

    For the reasons set forth in the joint preamble, the Office of 
Thrift Supervision proposes to amend chapter V of title 12 of the Code 
of Federal Regulations by adding a new part 571 to read as follows:

PART 571--FAIR CREDIT REPORTING

Subpart A--General Provisions
Sec.
571.1 Purpose, scope, and effective dates.
571.2 Examples.
571.3 Definitions.
Subpart B--[Reserved]
Subpart C--[Reserved]
Subpart D--Medical Information
571.30 Obtaining or using medical information in connection with a 
determination of eligibility for credit.
571.31 Sharing medical information with affiliates.

    Authority: 12 U.S.C. 1462a, 1463, 1464, 1467a, 1828, 1831p-1, 
1881-1884; 15 U.S.C. 1681s and 1681w; 15 U.S.C. 6801 and 6805(b)(1).

Subpart A--General Provisions


Sec.  571.1  Purpose, scope, and effective dates.

    (a) [Reserved]
    (b) Scope.
    (1) [Reserved]
    (2) Institutions covered. (i) Except as otherwise provided in this 
paragraph (b)(2), this part applies to savings associations whose 
deposits are insured by the Federal Deposit Insurance Corporation (and 
federal savings association operating subsidiaries in accordance with 
Sec.  559.3(h)(1) of this chapter).
    (ii) [Reserved]
    (iii) Section 571.30(a)-(d) of this part applies to creditors, as 
defined in Sec.  571.30(a)(2), that are savings associations or their 
subsidiaries, savings and loan holding companies, or affiliates of 
savings associations or savings and loan holding companies other than 
bank holding companies, banks, or subsidiaries of bank holding 
companies or banks.


Sec.  571.2  Examples.

    The examples in this part are not exclusive. Compliance with an 
example, to the extent applicable, constitutes compliance with this 
part. Examples in a paragraph illustrate only the issue described in 
the paragraph and do not illustrate any other issue that may arise in 
this part.


Sec.  571.3  Definitions.

    As used in this part, unless the context requires otherwise:
    (a) Act means the Fair Credit Reporting Act (15 U.S.C. 1681 et 
seq.).
    (b) Affiliate means any company that controls, is controlled by, or 
is under common control with another company.
    (c) [Reserved]
    (d) Company means any corporation, limited liability company, 
business trust, general or limited partnership, association, or similar 
organization.
    (e) Consumer means an individual.
    (f) [Reserved]
    (g) [Reserved]
    (h) [Reserved]

[[Page 23403]]

    (i) Control of a company means:
    (1) Ownership, control, or power to vote 25 percent or more of the 
outstanding shares of any class of voting security of the company, 
directly or indirectly, or acting through one or more other persons;
    (2) Control in any manner over the election of a majority of the 
directors, trustees, or general partners (or individuals exercising 
similar functions) of the company; or
    (3) The power to exercise, directly or indirectly, a controlling 
influence over the management or policies of the company, as OTS 
determines.
    (j) [Reserved]
    (k) Medical information means:
    (1) Information or data, whether oral or recorded, in any form or 
medium, created by or derived from a health care provider or the 
consumer, that relates to--
    (i) The past, present, or future physical, mental, or behavioral 
health or condition of an individual;
    (ii) The provision of health care to an individual; or
    (iii) The payment for the provision of health care to an 
individual.
    (2) The term does not include:
    (i) The age or gender of a consumer;
    (ii) Demographic information about the consumer, including a 
consumer's residence address or e-mail address; or
    (iii) Any other information about a consumer that does not relate 
to the physical, mental, or behavioral health or condition of a 
consumer, including the existence or value of any insurance policy.
    (l)-(n) [Reserved]
    (o) You means savings associations whose deposits are insured by 
the Federal Deposit Insurance Corporation (and federal savings 
association operating subsidiaries in accordance with Sec.  559.3(h)(1) 
of this chapter).

Subpart B--[Reserved]

Subpart C--[Reserved]

Subpart D--Medical Information


Sec.  571.30  Obtaining or using medical information in connection with 
a determination of eligibility for credit.

    (a) General prohibition on obtaining or using medical information--
(1) In general. A creditor may not obtain or use medical information 
pertaining to a consumer in connection with any determination of the 
consumer's eligibility, or continued eligibility, for credit, except as 
provided in this subpart.
    (2) Definitions as used in this subpart--(i) Eligibility, or 
continued eligibility, for credit means the consumer's qualification or 
fitness to receive, or continue to receive, credit, including the terms 
on which credit is offered, primarily for personal, family, or 
household purposes. The term does not include:
    (A) The consumer's qualification or fitness to be offered 
employment, insurance products, or other non-credit products or 
services;
    (B) Any determination of whether the provisions of a debt 
cancellation contract, debt suspension agreement, credit insurance 
product, or similar forbearance practice or program are triggered;
    (C) Authorizing, processing, or documenting a payment or 
transaction on behalf of the consumer in a manner that does not involve 
a determination of the consumer's eligibility, or continued 
eligibility, for credit; or
    (D) Maintaining or servicing the consumer's account in a manner 
that does not involve a determination of the consumer's eligibility, or 
continued eligibility, for credit.
    (ii) Creditor has the same meaning as in section 702 of the Equal 
Credit Opportunity Act, 15 U.S.C. 1691a.
    (iii) Credit has the same meaning as in section 702 of the Equal 
Credit Opportunity Act, 15 U.S.C. 1691a.
    (b) Rule of construction for receiving unsolicited medical 
information--(1) In general. A creditor does not obtain medical 
information for purposes of paragraph (a)(1) of this section if it--
    (i) Receives medical information pertaining to a consumer in 
connection with any determination of the consumer's eligibility, or 
continued eligibility, for credit without specifically requesting 
medical information; and
    (ii) Does not use that information in determining whether to extend 
or continue to extend credit to the consumer and the terms on which 
credit is offered or continued.
    (2) Examples of receiving unsolicited medical information. A 
creditor receives unsolicited medical information if, for example:
    (i) In response to a general question regarding a consumer's debts 
or expenses, the creditor receives information that the consumer has a 
particular medical condition and does not use that information in 
determining whether to extend credit to the consumer or the terms on 
which credit is offered.
    (ii) In conversation with the loan officer, the consumer informs 
the creditor that the consumer has a particular medical condition, and 
the creditor does not use that information in determining whether to 
extend credit to the consumer or the terms on which credit is offered.
    (c) Financial information exception for obtaining and using medical 
information--(1) In general. A creditor may obtain and use medical 
information pertaining to a consumer in connection with any 
determination of the consumer's eligibility, or continued eligibility, 
for credit so long as:
    (i) The information relates to debts, expenses, income, benefits, 
collateral, or the purpose of the loan, including the use of proceeds;
    (ii) The creditor uses the medical information in a manner and to 
an extent that is no less favorable than it would use comparable 
information that is not medical information in a credit transaction; 
and
    (iii) The creditor does not take the consumer's physical, mental, 
or behavioral health, condition or history, type of treatment, or 
prognosis into account as part of any such determination.
    (2) Examples--(i) Examples of information related to debts, 
expenses, income, benefits, collateral, or the purpose of the loan. 
Paragraph (c)(1)(i) of this section permits a creditor, for example, to 
obtain and use information about:
    (A) The dollar amount, repayment terms, repayment history, and 
similar information regarding medical debts that is used to calculate, 
measure, or verify the repayment ability of the consumer, the use of 
proceeds, or the terms for granting credit;
    (B) The value, condition, and lien status of a medical device that 
is used as collateral to secure a loan;
    (C) The dollar amount and continued eligibility for disability 
income or benefits related to health or a medical condition that is 
relied on as a source of repayment; or
    (D) The identity of creditors to whom outstanding medical debts are 
owed in connection with an application for credit, including but not 
limited to a transaction involving the consolidation of medical debts.
    (ii) Examples of uses of medical information consistent with the 
exception. (A) A consumer includes on an application for credit 
information about two $20,000 debts. One debt is to a hospital; the 
other debt is to a retailer. The creditor contacts the hospital and the 
retailer to verify the amount and payment status of the debts. The 
creditor learns that both debts are more than 90 days past due. Any two 
debts of this size that are past due would disqualify the consumer 
under the creditor's established underwriting criteria. The creditor 
denies the

[[Page 23404]]

application on the basis that the consumer has a poor repayment history 
on outstanding debts. The creditor has used medical information in a 
manner and to an extent no less favorable than it would use comparable 
non-medical information.
    (B) A consumer indicates on an application for a $200,000 mortgage 
loan that she receives $15,000 in long-term disability income each year 
from her former employer and has no other income. Annual income of 
$15,000, regardless of source, would not be sufficient to support the 
requested amount of credit. The creditor denies the application on the 
basis that the projected debt-to-income ratio of the consumer does not 
meet the creditor's underwriting criteria. The creditor has used 
medical information in a manner and to an extent that is no less 
favorable than it would use comparable non-medical information.
    (C) A consumer includes on an application for a $10,000 home equity 
loan that he has a $50,000 debt to a medical facility that specializes 
in treating a potentially terminal disease. The creditor contacts the 
medical facility to verify the debt and obtain the repayment history 
and current status of the loan. The creditor learns that the debt is 
current and that the applicant meets the income requirements of the 
creditor's underwriting guidelines. The creditor grants the 
application. The creditor has used medical information in accordance 
with the exception.
    (iii) Examples of uses of medical information inconsistent with the 
exception.
    (A) A consumer applies for $25,000 of credit and includes on the 
application information about a $50,000 debt to a hospital. The 
creditor contacts the hospital to verify the amount and payment status 
of the debt, and learns that the debt is current and that the consumer 
has no delinquencies in her repayment history. If the existing debt 
were instead owed to a home furnishing retailer, the creditor would 
approve the application and extend credit based on the amount and 
repayment history of the outstanding debt. The creditor, however, 
denies the application because the consumer is indebted to a hospital. 
The creditor has used medical information, here the identity of the 
medical creditor, in a manner and to an extent that is less favorable 
than it would use comparable non-medical information.
    (B) A consumer meets with a loan officer of a creditor to apply for 
a mortgage loan. While filling out the loan application, the consumer 
informs the loan officer orally that she has a potentially terminal 
disease. The consumer meets the creditor's established requirements for 
the requested mortgage. The loan officer recommends to the credit 
committee that the consumer be denied credit because the consumer has 
that disease. The creditor has used medical information in a manner 
inconsistent with the exception by taking into account the consumer's 
physical, mental, or behavioral health, condition, or history, type of 
treatment, or prognosis as part of a determination of eligibility or 
continued eligibility for credit.
    (d) Specific exceptions for obtaining and using medical 
information--(1) In general. A creditor may obtain and use medical 
information pertaining to a consumer in connection with any 
determination of the consumer's eligibility, or continued eligibility, 
for credit--
    (i) To determine whether the use of a power of attorney or legal 
representative is necessary and appropriate;
    (ii) To comply with applicable requirements of local, State, or 
Federal laws;
    (iii) To the extent such information is included in a consumer 
report from a consumer reporting agency, in accordance with 15 U.S.C. 
1681b(g)(1)(B), and is used for the purpose(s) for which the consumer 
provided specific written consent;
    (iv) For purposes of fraud prevention and detection;
    (v) In the case of credit for the purpose of financing medical 
products or services, to determine and verify the medical purpose of a 
loan and the use of proceeds;
    (vi) If the consumer or the consumer's legal representative 
requests in writing, on a separate form signed by the consumer or the 
consumer's legal representative that the creditor use specific medical 
information for a specific purpose in determining the consumer's 
eligibility, or continued eligibility, for credit, to accommodate the 
consumer's particular circumstances. The signed written request must 
describe the specific medical information that the consumer requests 
the creditor to use and the specific purpose for which the information 
will be used; or
    (vii) As otherwise permitted by order of the Director of OTS.
    (2) Examples of determining the medical purpose of the loan or the 
use of proceeds. (i) If a consumer applies for $10,000 of credit for 
the purpose of financing vision correction surgery, the creditor may 
confirm the consumer's medical eligibility to undergo that procedure 
with the surgeon. If the surgeon reports that surgery will not be 
performed on the consumer, the creditor may use that medical 
information to deny the consumer's application for credit, because the 
loan would not be used for the stated purpose.
    (ii) If a consumer applies for $10,000 of credit for the purpose of 
financing cosmetic surgery, the creditor may confirm the cost of the 
procedure with the surgeon. If the surgeon reports that the cost of the 
procedure is $5,000, the creditor may use that medical information to 
offer the consumer only $5,000 of credit.
    (iii) A creditor has an established medical loan program for 
financing particular elective surgical procedures. The creditor 
receives a loan application from a consumer requesting $10,000 of 
credit under the established loan program for an elective surgical 
procedure. The consumer indicates on the application that the purpose 
of the loan is to finance an elective surgical procedure not eligible 
for funding under the guidelines of the established loan program. The 
creditor may deny the consumer's application because the purpose of the 
loan is not for a particular procedure funded by the established loan 
program.
    (3) Examples of obtaining and using medical information at the 
request of the consumer. Consistent with safe and sound practices, and 
after obtaining from the consumer a signed, written document that 
describes the specific medical information that the consumer requests 
the creditor to use and the specific purpose for which the information 
will be used, the creditor may obtain and use the specific medical 
information for the specific purpose specified in the request:
    (i) If a consumer applies for a loan and requests that the creditor 
consider the consumer's medical disability at the relevant time as an 
explanation for adverse payment history information in his credit 
report, the creditor may consider such medical information in 
evaluating the consumer's willingness and ability to repay the 
requested loan.
    (ii) If a consumer applies for a loan and explains that his income 
has been and will continue to be interrupted on account of a medical 
condition and that he expects to repay the loan from liquidation of 
assets, the creditor may evaluate the application using the sale of 
assets as the primary source of repayment.
    (e) Limits on redisclosure of information. If you receive medical 
information about a consumer from a consumer reporting agency or your 
affiliate, you must not disclose that

[[Page 23405]]

information to any other person, except as necessary to carry out the 
purpose for which the information was initially disclosed, or as 
otherwise permitted by statute, regulation, or order.


Sec.  571.31  Sharing medical information with affiliates.

    (a) In general. The exclusions from the term ``consumer report'' in 
section 603(d)(2) of the Act that allow the sharing of information with 
affiliates do not apply if you communicate to an affiliate--
    (1) Medical information;
    (2) An individualized list or description based on the payment 
transactions of the consumer for medical products or services; or
    (3) An aggregate list of identified consumers based on payment 
transactions for medical products or services.
    (b) Exceptions. You may rely on the exclusions from the term 
``consumer report'' in section 603(d)(2) of the Act to communicate the 
information in paragraph (a) of this section to an affiliate--
    (1) In connection with the business of insurance or annuities 
(including the activities described in section 18B of the model Privacy 
of Consumer Financial and Health Information Regulation issued by the 
National Association of Insurance Commissioners, as in effect on 
January 1, 2003);
    (2) For any purpose permitted without authorization under the 
regulations promulgated by the Department of Health and Human Services 
pursuant to the Health Insurance Portability and Accountability Act of 
1996 (HIPAA);
    (3) For any purpose referred to in section 1179 of HIPAA;
    (4) For any purpose described in section 502(e) of the Gramm-Leach-
Bliley Act;
    (5) In connection with a determination of the consumer's 
eligibility, or continued eligibility, for credit consistent with Sec.  
571.30 of this part; or
    (6) As otherwise permitted by order of the Director of OTS.

National Credit Union Administration

    For the reasons set out in the preamble, it is proposed that 12 CFR 
chapter VII be amended by adding a new part 717 to read as follows:

PART 717--FAIR CREDIT REPORTING

Subpart A--General Provisions
Sec.
Sec.  717.1 Purpose, scope, and effective dates.
Sec.  717.2 Examples.
Sec.  717.3 Definitions.
Subpart B--[Reserved]
Subpart C--[Reserved]
Subpart D--Medical Information
717.30 Obtaining or using medical information in connection with a 
determination of eligibility for credit.
717.31 Sharing medical information with affiliates.

    Authority: 15 U.S.C. 1681b and 1681s.

Subpart A--General Provisions


Sec.  717.1  Purpose, scope, and effective dates.

    (a) [Reserved]
    (b) Scope.
    (1) [Reserved]
    (2) Institutions covered. These regulations apply to federal credit 
unions.


Sec.  717.2  Examples.

    The examples in this part are not exclusive. Compliance with an 
example, to the extent applicable, constitutes compliance with this 
part. Examples in a paragraph illustrate only the issue described in 
the paragraph and do not illustrate any other issue that may arise in 
this part.


Sec.  717.3  Definitions.

    As used in this part, unless the context requires otherwise:
    (a) Act means the Fair Credit Reporting Act (15 U.S.C. 1681 et 
seq.).
    (b) Affiliate means any company that controls, is controlled by, or 
is under common control with another company. For example, an affiliate 
of a federal credit union is a credit union service organization 
(CUSO), as provided in 12 CFR part 712, that is controlled by the 
federal credit union.
    (c) [Reserved]
    (d) Company means any corporation, limited liability company, 
business trust, general or limited partnership, association, or similar 
organization.
    (e) Consumer means an individual.
    (f) [Reserved]
    (g) [Reserved]
    (h) [Reserved]
    (i) Control of a company means:
    (1) Ownership, control, or power to vote 25 percent or more of the 
outstanding shares of any class of voting security of the company, 
directly or indirectly, or acting through one or more other persons;
    (2) Control in any manner over the election of a majority of the 
directors, trustees, or general partners (or individuals exercising 
similar functions) of the company; or
    (3) The power to exercise, directly or indirectly, a controlling 
influence over the management or policies of the company, as the Board 
determines.
    (4) Example. NCUA will presume a credit union has a controlling 
influence over the management or policies of a CUSO, if the CUSO is 67% 
owned by credit unions.
    (j) [Reserved]
    (k) Medical information means:
    (1) Information or data, whether oral or recorded, in any form or 
medium, created by or derived from a health care provider or the 
consumer, that relates to--
    (i) The past, present, or future physical, mental, or behavioral 
health or condition of an individual;
    (ii) The provision of health care to an individual; or
    (iii) The payment for the provision of health care to an 
individual.
    (2) The term does not include:
    (i) The age or gender of a consumer;
    (ii) Demographic information about the consumer, including a 
consumer's residence address or e-mail address; or
    (iii) Any other information about a consumer that does not relate 
to the physical, mental, or behavioral health or condition of a 
consumer, including the existence or value of any insurance policy.
    (l) [Reserved]
    (m) [Reserved]
    (n) [Reserved]
    (o) You means a federal credit union.

Subpart B--[Reserved]

Subpart C--[Reserved]

Subpart D--Medical Information


Sec.  717.30  Obtaining or using medical information in connection with 
a determination of eligibility for credit.

    (a) General prohibition on obtaining or using medical information--
(1) In general. A creditor may not obtain or use medical information 
pertaining to a consumer in connection with any determination of the 
consumer's eligibility, or continued eligibility, for credit, except as 
provided in this subpart.
    (2) Definitions as used in this subpart--(i) Eligibility, or 
continued eligibility, for credit means the consumer's qualification or 
fitness to receive, or continue to receive, credit, including the terms 
on which credit is offered, primarily for personal, family, or 
household purposes. The term does not include:
    (A) The consumer's qualification or fitness to be offered 
employment, insurance products, or other non-credit products or 
services;
    (B) Any determination of whether the provisions of a debt 
cancellation contract, debt suspension agreement,

[[Page 23406]]

credit insurance product, or similar forbearance practice or program 
are triggered;
    (C) Authorizing, processing, or documenting a payment or 
transaction on behalf of the consumer in a manner that does not involve 
a determination of the consumer's eligibility, or continued 
eligibility, for credit; or
    (D) Maintaining or servicing the consumer's account in a manner 
that does not involve a determination of the consumer's eligibility, or 
continued eligibility, for credit.
    (ii) Creditor has the same meaning as in section 702 of the Equal 
Credit Opportunity Act, 15 U.S.C. 1691a.
    (iii) Credit has the same meaning as in section 702 of the Equal 
Credit Opportunity Act, 15 U.S.C. 1691a.
    (b) Rule of construction for receiving unsolicited medical 
information--(1) In general. A creditor does not obtain medical 
information for purposes of paragraph (a)(1) of this section if it--
    (i) Receives medical information pertaining to a consumer in 
connection with any determination of the consumer's eligibility, or 
continued eligibility, for credit without specifically requesting 
medical information; and
    (ii) Does not use that information in determining whether to extend 
or continue to extend credit to the consumer and the terms on which 
credit is offered or continued.
    (2) Examples of receiving unsolicited medical information. A 
creditor receives unsolicited medical information if, for example:
    (i) In response to a general question regarding a consumer's debts 
or expenses, the creditor receives information that the consumer has a 
particular medical condition and does not use that information in 
determining whether to extend credit to the consumer or the terms on 
which credit is offered.
    (ii) In conversation with the loan officer, the consumer informs 
the creditor that the consumer has a particular medical condition, and 
the creditor does not use that information in determining whether to 
extend credit to the consumer or the terms on which credit is offered.
    (c) Financial information exception for obtaining and using medical 
information--
    (1) In general. A creditor may obtain and use medical information 
pertaining to a consumer in connection with any determination of the 
consumer's eligibility, or continued eligibility, for credit so long 
as:
    (i) The information relates to debts, expenses, income, benefits, 
collateral, or the purpose of the loan, including the use of proceeds;
    (ii) The creditor uses the medical information in a manner and to 
an extent that is no less favorable than it would use comparable 
information that is not medical information in a credit transaction; 
and
    (iii) The creditor does not take the consumer's physical, mental, 
or behavioral health, condition or history, type of treatment, or 
prognosis into account as part of any such determination.
    (2) Examples--(i) Examples of information related to debts, 
expenses, income, benefits, collateral, or the purpose of the loan. 
Paragraph (c)(1)(i) of this section permits a creditor, for example, to 
obtain and use information about:
    (A) The dollar amount, repayment terms, repayment history, and 
similar information regarding medical debts that is used to calculate, 
measure, or verify the repayment ability of the consumer, the use of 
proceeds, or the terms for granting credit;
    (B) The value, condition, and lien status of a medical device that 
is used as collateral to secure a loan;
    (C) The dollar amount and continued eligibility for disability 
income or benefits related to health or a medical condition that is 
relied on as a source of repayment; or
    (D) The identity of creditors to whom outstanding medical debts are 
owed in connection with an application for credit, including but not 
limited to a transaction involving the consolidation of medical debts.
    (ii) Examples of uses of medical information consistent with the 
exception. (A) A consumer includes on an application for credit 
information about two $20,000 debts. One debt is to a hospital; the 
other debt is to a retailer. The creditor contacts the hospital and the 
retailer to verify the amount and payment status of the debts. The 
creditor learns that both debts are more than 90 days past due. Any two 
debts of this size that are past due would disqualify the consumer 
under the creditor's established underwriting criteria. The creditor 
denies the application on the basis that the consumer has a poor 
repayment history on outstanding debts. The creditor has used medical 
information in a manner and to an extent no less favorable than it 
would use comparable non-medical information.
    (B) A consumer indicates on an application for a $200,000 mortgage 
loan that she receives $15,000 in long-term disability income each year 
from her former employer and has no other income. Annual income of 
$15,000, regardless of source, would not be sufficient to support the 
requested amount of credit. The creditor denies the application on the 
basis that the projected debt-to-income ratio of the consumer does not 
meet the creditor's underwriting criteria. The creditor has used 
medical information in a manner and to an extent that is no less 
favorable than it would use comparable non-medical information.
    (C) A consumer includes on an application for a $10,000 home equity 
loan that he has a $50,000 debt to a medical facility that specializes 
in treating a potentially terminal disease. The creditor contacts the 
medical facility to verify the debt and obtain the repayment history 
and current status of the loan. The creditor learns that the debt is 
current and that the applicant meets the income requirements of the 
creditor's underwriting guidelines. The creditor grants the 
application. The creditor has used medical information in accordance 
with the exception.
    (iii) Examples of uses of medical information inconsistent with the 
exception.
    (A) A consumer applies for $25,000 of credit and includes on the 
application information about a $50,000 debt to a hospital. The 
creditor contacts the hospital to verify the amount and payment status 
of the debt, and learns that the debt is current and that the consumer 
has no delinquencies in her repayment history. If the existing debt 
were instead owed to a home furnishing retailer, the creditor would 
approve the application and extend credit based on the amount and 
repayment history of the outstanding debt. The creditor, however, 
denies the application because the consumer is indebted to a hospital. 
The creditor has used medical information, here the identity of the 
medical creditor, in a manner and to an extent that is less favorable 
than it would use comparable non-medical information.
    (B) A consumer meets with a loan officer of a creditor to apply for 
a mortgage loan. While filling out the loan application, the consumer 
informs the loan officer orally that she has a potentially terminal 
disease. The consumer meets the creditor's established requirements for 
the requested mortgage. The loan officer recommends to the credit 
committee that the consumer be denied credit because the consumer has 
that disease. The creditor has used medical information in a manner 
inconsistent with the exception by taking into account the consumer's 
physical, mental, or behavioral health, condition, or history, type of 
treatment, or

[[Page 23407]]

prognosis as part of a determination of eligibility or continued 
eligibility for credit.
    (d) Specific exceptions for obtaining and using medical 
information--(1) In general. A creditor may obtain and use medical 
information pertaining to a consumer in connection with any 
determination of the consumer's eligibility, or continued eligibility, 
for credit--
    (i) To determine whether the use of a power of attorney or legal 
representative is necessary and appropriate;
    (ii) To comply with applicable requirements of local, state, or 
federal laws;
    (iii) To the extent such information is included in a consumer 
report from a consumer reporting agency, in accordance with 15 U.S.C. 
1681b(g)(1)(B), and is used for the purpose(s) for which the consumer 
provided specific written consent;
    (iv) For purposes of fraud prevention and detection;
    (v) In the case of credit for the purpose of financing medical 
products or services, to determine and verify the medical purpose of a 
loan and the use of proceeds;
    (vi) If the consumer or the consumer's legal representative 
requests in writing, on a separate form signed by the consumer or the 
consumer's legal representative that the creditor use specific medical 
information for a specific purpose in determining the consumer's 
eligibility, or continued eligibility, for credit, to accommodate the 
consumer's particular circumstances. The signed written request must 
describe the specific medical information that the consumer requests 
the creditor to use and the specific purpose for which the information 
will be used; or
    (vii) As otherwise permitted by order of the NCUA.
    (2) Examples of determining the medical purpose of the loan or the 
use of proceeds. (i) If a consumer applies for $10,000 of credit for 
the purpose of financing vision correction surgery, the creditor may 
confirm the consumer's medical eligibility to undergo that procedure 
with the surgeon. If the surgeon reports that surgery will not be 
performed on the consumer, the creditor may use that medical 
information to deny the consumer's application for credit, because the 
loan would not be used for the stated purpose.
    (ii) If a consumer applies for $10,000 of credit for the purpose of 
financing cosmetic surgery, the creditor may confirm the cost of the 
procedure with the surgeon. If the surgeon reports that the cost of the 
procedure is $5,000, the creditor may use that medical information to 
offer the consumer only $5,000 of credit.
    (iii) A creditor has an established medical loan program for 
financing particular elective surgical procedures. The creditor 
receives a loan application from a consumer requesting $10,000 of 
credit under the established loan program for an elective surgical 
procedure. The consumer indicates on the application that the purpose 
of the loan is to finance an elective surgical procedure not eligible 
for funding under the guidelines of the established loan program. The 
creditor may deny the consumer's application because the purpose of the 
loan is not for a particular procedure funded by the established loan 
program.
    (3) Examples of obtaining and using medical information at the 
request of the consumer. Consistent with safe and sound practices, and 
after obtaining from the consumer a signed, written document that 
describes the specific medical information that the consumer requests 
the creditor to use and the specific purpose for which the information 
will be used, the creditor may obtain and use the specific medical 
information for the specific purpose specified in the request:
    (i) If a consumer applies for a loan and requests that the creditor 
consider the consumer's medical disability at the relevant time as an 
explanation for adverse payment history information in his credit 
report, the creditor may consider such medical information in 
evaluating the consumer's willingness and ability to repay the 
requested loan.
    (ii) If a consumer applies for a loan and explains that his income 
has been and will continue to be interrupted on account of a medical 
condition and that he expects to repay the loan from liquidation of 
assets, the creditor may evaluate the application using the sale of 
assets as the primary source of repayment.
    (e) Limits on redisclosure of information. If you receive medical 
information about a consumer from a consumer reporting agency or your 
affiliate, you must not disclose that information to any other person, 
except as necessary to carry out the purpose for which the information 
was initially disclosed, or as otherwise permitted by statute, 
regulation, or order.


Sec.  717.31  Sharing medical information with affiliates.

    (a) In general. The exclusions from the term ``consumer report'' in 
section 603(d)(2) of the Act that allow the sharing of information with 
affiliates do not apply if you communicate to an affiliate--
    (1) Medical information;
    (2) An individualized list or description based on the payment 
transactions of the consumer for medical products or services; or
    (3) An aggregate list of identified consumers based on payment 
transactions for medical products or services.
    (b) Exceptions. You may rely on the exclusions from the term 
``consumer report'' in section 603(d)(2) of the Act to communicate the 
information in paragraph (a) to an affiliate--
    (1) In connection with the business of insurance or annuities 
(including the activities described in section 18B of the model Privacy 
of Consumer Financial and Health Information Regulation issued by the 
National Association of Insurance Commissioners, as in effect on 
January 1, 2003);
    (2) For any purpose permitted without authorization under the 
regulations promulgated by the Department of Health and Human Services 
pursuant to the Health Insurance Portability and Accountability Act of 
1996 (HIPAA);
    (3) For any purpose referred to in section 1179 of HIPAA;
    (4) For any purpose described in section 502(e) of the Gramm-Leach-
Bliley Act;
    (5) In connection with a determination of the consumer's 
eligibility, or continued eligibility, for credit consistent with Sec.  
717.30 of this part; or
    (6) As otherwise permitted by order of the NCUA.

    Dated: April 16, 2004.
John D. Hawke, Jr.,
Comptroller of the Currency.

    By order of the Board of Governors of the Federal Reserve 
System, April 22, 2004.
Jennifer J. Johnson,
Secretary of the Board.

    Dated at Washington, DC, the 6th day of April, 2004.

    By order of the Board of Directors.

Federal Deposit Insurance Corporation.
Robert E. Feldman,
Executive Secretary.

    Dated: April 6, 2004.

    By the Office of Thrift Supervision.
James E. Gilleran,
Director.

    By the National Credit Union Administration Board on April 8, 
2004.
Becky Baker,
Secretary of the Board.
[FR Doc. 04-9526 Filed 4-27-04; 8:45 am]
BILLING CODE 4810-33-P; 6210-01-P; 6714-10-P; 6720-01-P; 7535-01-P