[Code of Federal Regulations] [Title 12, Volume 6] [Revised as of January 1, 2006] From the U.S. Government Printing Office via GPO Access [CITE: 12CFR717.32] [Page 565-570] TITLE 12--BANKS AND BANKING CHAPTER VII--NATIONAL CREDIT UNION ADMINISTRATION PART 717_FAIR CREDIT REPORTING--Table of Contents Subpart D_Medical Information Sec. 717.32 Sharing medical information with affiliates. (a) Scope. This section applies to Federal credit unions. (b) In general. The exclusions from the term ``consumer report'' in section 603(d)(2) of the Act that allow the sharing of information with affiliates do not apply if a Federal credit union communicates to an affiliate: (1) Medical information; (2) An individualized list or description based on the payment transactions of the consumer for medical products or services; or (3) An aggregate list of identified consumers based on payment transactions for medical products or services. (c) Exceptions. A Federal credit union may rely on the exclusions from the term ``consumer report'' in section 603(d)(2) of the Act to communicate the information in paragraph (b) to an affiliate: (1) In connection with the business of insurance or annuities (including the activities described in section 18B of [[Page 566]] the model Privacy of Consumer Financial and Health Information Regulation issued by the National Association of Insurance Commissioners, as in effect on January 1, 2003); (2) For any purpose permitted without authorization under the regulations promulgated by the Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA); (3) For any purpose referred to in section 1179 of HIPAA; (4) For any purpose described in section 502(e) of the Gramm-Leach- Bliley Act; (5) In connection with a determination of the consumer's eligibility, or continued eligibility, for credit consistent with Sec. 717.30; or (6) As otherwise permitted by order of the NCUA. Effective Date Notes: 1. At 70 FR 33993, June 10, 2005, subpart D was added, effective Mar. 7, 2006. At 70 FR 70664, Nov. 22, 2005, the effective date was delayed until Apr. 1, 2006. For the convenience of the user, the added text is set forth as follows. 2. At 70 FR 70693, Nov. 22, 2005, subpart D was added, effective Apr. 1, 2006. At 70 FR 75931, Dec. 22, 2005, the amendatory instruction was corrected to revise subpart D. This text is set forth above. Subpart D_Medical Information Sec. 717.30 Obtaining or using medical information in connection with a determination of eligibility for credit. (a) Scope. This section applies to: (1) A Federal credit union that participates as a creditor in a transaction; or (2) Any other person that participates as a creditor in a transaction involving a person described in paragraph (1). (b) General prohibition on obtaining or using medical information-- (1) In general. A creditor may not obtain or use medical information pertaining to a consumer in connection with any determination of the consumer's eligibility, or continued eligibility, for credit, except as provided in this section. (2) Definitions. (i) Credit has the same meaning as in section 702 of the Equal Credit Opportunity Act, 15 U.S.C. 1691a. (ii) Creditor has the same meaning as in section 702 of the Equal Credit Opportunity Act, 15 U.S.C. 1691a. (iii) Eligibility, or continued eligibility, for credit means the consumer's qualification or fitness to receive, or continue to receive, credit, including the terms on which credit is offered. The term does not include: (A) Any determination of the consumer's qualification or fitness for employment, insurance (other than a credit insurance product), or other non-credit products or services; (B) Authorizing, processing, or documenting a payment or transaction on behalf of the consumer in a manner that does not involve a determination of the consumer's eligibility, or continued eligibility, for credit; or (C) Maintaining or servicing the consumer's account in a manner that does not involve a determination of the consumer's eligibility, or continued eligibility, for credit. (c) Rule of construction for obtaining and using unsolicited medical information--(1) In general. A creditor does not obtain medical information in violation of the prohibition if it receives medical information pertaining to a consumer in connection with any determination of the consumer's eligibility, or continued eligibility, for credit without specifically requesting medical information. (2) Use of unsolicited medical information. A creditor that receives unsolicited medical information in the manner described in paragraph (1) may use that information in connection with any determination of the consumer's eligibility, or continued eligibility, for credit to the extent the creditor can rely on at least one of the exceptions in Sec. 717.30(d) or (e). (3) Examples. A creditor does not obtain medical information in violation of the prohibition if, for example: (i) In response to a general question regarding a consumer's debts or expenses, the creditor receives information that the consumer owes a debt to a hospital. (ii) In a conversation with the creditor's loan officer, the consumer informs the creditor that the consumer has a particular medical condition. (iii) In connection with a consumer's application for an extension of credit, the creditor requests a consumer report from a consumer reporting agency and receives medical information in the consumer report furnished by the agency even though the creditor did not specifically request medical information from the consumer reporting agency. (d) Financial information exception for obtaining and using medical information--(1) In general. A creditor may obtain and use medical information pertaining to a consumer in connection with any determination of the consumer's eligibility, or continued eligibility, for credit so long as: (i) The information is the type of information routinely used in making credit eligibility determinations, such as information relating to debts, expenses, income, benefits, assets, collateral, or the purpose of the loan, including the use of proceeds; [[Page 567]] (ii) The creditor uses the medical information in a manner and to an extent that is no less favorable than it would use comparable information that is not medical information in a credit transaction; and (iii) The creditor does not take the consumer's physical, mental, or behavioral health, condition or history, type of treatment, or prognosis into account as part of any such determination. (2) Examples. (i) Examples of the types of information routinely used in making credit eligibility determinations. Paragraph (d)(1)(i) of this section permits a creditor, for example, to obtain and use information about: (A) The dollar amount, repayment terms, repayment history, and similar information regarding medical debts to calculate, measure, or verify the repayment ability of the consumer, the use of proceeds, or the terms for granting credit; (B) The value, condition, and lien status of a medical device that may serve as collateral to secure a loan; (C) The dollar amount and continued eligibility for disability income or benefits related to health or a medical condition that is relied on as a source of repayment; or (D) The identity of creditors to whom outstanding medical debts are owed in connection with an application for credit, including but not limited to, a transaction involving the consolidation of medical debts. (ii) Examples of uses of medical information consistent with the exception. (A) A consumer includes on an application for credit information about two $20,000 debts. One debt is to a hospital; the other debt is to a retailer. The creditor contacts the hospital and the retailer to verify the amount and payment status of the debts. The creditor learns that both debts are more than 90 days past due. Any two debts of this size that are more than 90 days past due would disqualify the consumer under the creditor's established underwriting criteria. The creditor denies the application on the basis that the consumer has a poor repayment history on outstanding debts. The creditor has used medical information in a manner and to an extent no less favorable than it would use comparable non-medical information. (B) A consumer indicates on an application for a $200,000 mortgage loan that she receives $15,000 in long-term disability income each year from her former employer and has no other income. Annual income of $15,000, regardless of source, would not be sufficient to support the requested amount of credit. The creditor denies the application on the basis that the projected debt-to-income ratio of the consumer does not meet the creditor's underwriting criteria. The creditor has used medical information in a manner and to an extent that is no less favorable than it would use comparable non-medical information. (C) A consumer includes on an application for a $10,000 home equity loan that he has a $50,000 debt to a medical facility that specializes in treating a potentially terminal disease. The creditor contacts the medical facility to verify the debt and obtain the repayment history and current status of the loan. The creditor learns that the debt is current. The applicant meets the income and other requirements of the creditor's underwriting guidelines. The creditor grants the application. The creditor has used medical information in accordance with the exception. (iii) Examples of uses of medical information inconsistent with the exception. (A) A consumer applies for $25,000 of credit and includes on the application information about a $50,000 debt to a hospital. The creditor contacts the hospital to verify the amount and payment status of the debt, and learns that the debt is current and that the consumer has no delinquencies in her repayment history. If the existing debt were instead owed to a retail department store, the creditor would approve the application and extend credit based on the amount and repayment history of the outstanding debt. The creditor, however, denies the application because the consumer is indebted to a hospital. The creditor has used medical information, here the identity of the medical creditor, in a manner and to an extent that is less favorable than it would use comparable non-medical information. (B) A consumer meets with a loan officer of a creditor to apply for a mortgage loan. While filling out the loan application, the consumer informs the loan officer orally that she has a potentially terminal disease. The consumer meets the creditor's established requirements for the requested mortgage loan. The loan officer recommends to the credit committee that the consumer be denied credit because the consumer has that disease. The credit committee follows the loan officer's recommendation and denies the application because the consumer has a potentially terminal disease. The creditor has used medical information in a manner inconsistent with the exception by taking into account the consumer's physical, mental, or behavioral health, condition, or history, type of treatment, or prognosis as part of a determination of eligibility or continued eligibility for credit. (C) A consumer who has an apparent medical condition, such as a consumer who uses a wheelchair or an oxygen tank, meets with a loan officer to apply for a home equity loan. The consumer meets the creditor's established requirements for the requested home equity loan and the creditor typically does not require consumers to obtain a debt cancellation contract, debt suspension agreement, or credit insurance product in connection with such loans. However, based on the [[Page 568]] consumer's apparent medical condition, the loan officer recommends to the credit committee that credit be extended to the consumer only if the consumer obtains a debt cancellation contract, debt suspension agreement, or credit insurance product. The credit committee agrees with the loan officer's recommendation. The loan officer informs the consumer that the consumer must obtain a debt cancellation contract, debt suspension agreement, or credit insurance product to qualify for the loan. The consumer obtains one of these products from a third party and the creditor approves the loan. The creditor has used medical information in a manner inconsistent with the exception by taking into account the consumer's physical, mental, or behavioral health, condition, or history, type of treatment, or prognosis in setting conditions on the consumer's eligibility for credit. (e) Specific exceptions for obtaining and using medical information--(1) In general. A creditor may obtain and use medical information pertaining to a consumer in connection with any determination of the consumer's eligibility, or continued eligibility, for credit-- (i) To determine whether the use of a power of attorney or legal representative that is triggered by a medical event or condition is necessary and appropriate or whether the consumer has the legal capacity to contract when a person seeks to exercise a power of attorney or act as legal representative for a consumer based on an asserted medical event or condition; (ii) To comply with applicable requirements of local, State, or Federal laws; (iii) To determine, at the consumer's request, whether the consumer qualifies for a legally permissible special credit program or credit- related assistance program that is-- (A) Designed to meet the special needs of consumers with medical conditions; and (B) Established and administered pursuant to a written plan that-- (1) Identifies the class of persons that the program is designed to benefit; and (2) Sets forth the procedures and standards for extending credit or providing other credit-related assistance under the program. (iv) To the extent necessary for purposes of fraud prevention or detection; (v) In the case of credit for the purpose of financing medical products or services, to determine and verify the medical purpose of a loan and the use of proceeds; (vi) Consistent with safe and sound practices, if the consumer or the consumer's legal representative specifically requests that the creditor use medical information in determining the consumer's eligibility, or continued eligibility, for credit, to accommodate the consumer's particular circumstances, and such request is documented by the creditor; (vii) Consistent with safe and sound practices, to determine whether the provisions of a forbearance practice or program that is triggered by a medical event or condition apply to a consumer; (viii) To determine the consumer's eligibility for, the triggering of, or the reactivation of a debt cancellation contract or debt suspension agreement if a medical condition or event is a triggering event for the provision of benefits under the contract or agreement; or (ix) To determine the consumer's eligibility for, the triggering of, or the reactivation of a credit insurance product if a medical condition or event is a triggering event for the provision of benefits under the product. (2) Example of determining eligibility for a special credit program or credit assistance program. A not-for-profit organization establishes a credit assistance program pursuant to a written plan that is designed to assist disabled veterans in purchasing homes by subsidizing the down payment for the home purchase mortgage loans of qualifying veterans. The organization works through mortgage lenders and requires mortgage lenders to obtain medical information about the disability of any consumer that seeks to qualify for the program, use that information to verify the consumer's eligibility for the program, and forward that information to the organization. A consumer who is a veteran applies to a creditor for a home purchase mortgage loan. The creditor informs the consumer about the credit assistance program for disabled veterans and the consumer seeks to qualify for the program. Assuming that the program complies with all applicable law, including applicable fair lending laws, the creditor may obtain and use medical information about the medical condition and disability, if any, of the consumer to determine whether the consumer qualifies for the credit assistance program. (3) Examples of verifying the medical purpose of the loan or the use of proceeds. (i) If a consumer applies for $10,000 of credit for the purpose of financing vision correction surgery, the creditor may verify with the surgeon that the procedure will be performed. If the surgeon reports that surgery will not be performed on the consumer, the creditor may use that medical information to deny the consumer's application for credit, because the loan would not be used for the stated purpose. (ii) If a consumer applies for $10,000 of credit for the purpose of financing cosmetic surgery, the creditor may confirm the cost of the procedure with the surgeon. If the surgeon reports that the cost of the procedure is $5,000, the creditor may use that medical information to offer the consumer only $5,000 of credit. [[Page 569]] (iii) A creditor has an established medical loan program for financing particular elective surgical procedures. The creditor receives a loan application from a consumer requesting $10,000 of credit under the established loan program for an elective surgical procedure. The consumer indicates on the application that the purpose of the loan is to finance an elective surgical procedure not eligible for funding under the guidelines of the established loan program. The creditor may deny the consumer's application because the purpose of the loan is not for a particular procedure funded by the established loan program. (4) Examples of obtaining and using medical information at the request of the consumer. (i) If a consumer applies for a loan and specifically requests that the creditor consider the consumer's medical disability at the relevant time as an explanation for adverse payment history information in his credit report, the creditor may consider such medical information in evaluating the consumer's willingness and ability to repay the requested loan to accommodate the consumer's particular circumstances, consistent with safe and sound practices. The creditor may also decline to consider such medical information to accommodate the consumer, but may evaluate the consumer's application in accordance with its otherwise applicable underwriting criteria. The creditor may not deny the consumer's application or otherwise treat the consumer less favorably because the consumer specifically requested a medical accommodation, if the creditor would have extended the credit or treated the consumer more favorably under the creditor's otherwise applicable underwriting criteria. (ii) If a consumer applies for a loan by telephone and explains that his income has been and will continue to be interrupted on account of a medical condition and that he expects to repay the loan by liquidating assets, the creditor may, but is not required to, evaluate the application using the sale of assets as the primary source of repayment, consistent with safe and sound practices, provided that the creditor documents the consumer's request by recording the oral conversation or making a notation of the request in the consumer's file. (iii) If a consumer applies for a loan and the application form provides a space where the consumer may provide any other information or special circumstances, whether medical or non-medical, that the consumer would like the creditor to consider in evaluating the consumer's application, the creditor may use medical information provided by the consumer in that space on that application to accommodate the consumer's application for credit, consistent with safe and sound practices, or may disregard that information. (iv) If a consumer specifically requests that the creditor use medical information in determining the consumer's eligibility, or continued eligibility, for credit and provides the creditor with medical information for that purpose, and the creditor determines that it needs additional information regarding the consumer's circumstances, the creditor may request, obtain, and use additional medical information about the consumer as necessary to verify the information provided by the consumer or to determine whether to make an accommodation for the consumer. The consumer may decline to provide additional information, withdraw the request for an accommodation, and have the application considered under the creditor's otherwise applicable underwriting criteria. (v) If a consumer completes and signs a credit application that is not for medical purpose credit and the application contains boilerplate language that routinely requests medical information from the consumer or that indicates that by applying for credit the consumer authorizes or consents to the creditor obtaining and using medical information in connection with a determination of the consumer's eligibility, or continued eligibility, for credit, the consumer has not specifically requested that the creditor obtain and use medical information to accommodate the consumer's particular circumstances. (5) Example of a forbearance practice or program. After an appropriate safety and soundness review, a creditor institutes a program that allows consumers who are or will be hospitalized to defer payments as needed for up to three months, without penalty, if the credit account has been open for more than one year and has not previously been in default, and the consumer provides confirming documentation at an appropriate time. A consumer is hospitalized and does not pay her bill for a particular month. This consumer has had a credit account with the creditor for more than one year and has not previously been in default. The creditor attempts to contact the consumer and speaks with the consumer's adult child, who is not the consumer's legal representative. The adult child informs the creditor that the consumer is hospitalized and is unable to pay the bill at that time. The creditor defers payments for up to three months, without penalty, for the hospitalized consumer and sends the consumer a letter confirming this practice and the date on which the next payment will be due. Sec. 717.31 Limits on redisclosure of information. (a) Scope. This section applies to Federal credit unions. (b) Limits on redisclosure. If a Federal credit union receives medical information about a consumer from a consumer reporting agency [[Page 570]] or its affiliate, the person must not disclose that information to any other person, except as necessary to carry out the purpose for which the information was initially disclosed, or as otherwise permitted by statute, regulation, or order. Sec. 717.32 Sharing medical information with affiliates. (a) Scope. This section applies to Federal credit unions. (b) In general. The exclusions from the term ``consumer report'' in section 603(d)(2) of the Act that allow the sharing of information with affiliates do not apply if a Federal credit union communicates to an affiliate-- (1) Medical information; (2) An individualized list or description based on the payment transactions of the consumer for medical products or services; or (3) An aggregate list of identified consumers based on payment transactions for medical products or services. (c) Exceptions. A Federal credit union may rely on the exclusions from the term ``consumer report'' in section 603(d)(2) of the Act to communicate the information in paragraph (b) to an affiliate-- (1) In connection with the business of insurance or annuities (including the activities described in section 18B of the model Privacy of Consumer Financial and Health Information Regulation issued by the National Association of Insurance Commissioners, as in effect on January 1, 2003); (2) For any purpose permitted without authorization under the regulations promulgated by the Department of Health and Human Services pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA); (3) For any purpose referred to in section 1179 of HIPAA; (4) For any purpose described in section 502(e) of the Gramm-Leach- Bliley Act; (5) In connection with a determination of the consumer's eligibility, or continued eligibility, for credit consistent with Sec. 717.30; or (6) As otherwise permitted by order of the NCUA. Subparts E-H [Reserved]