[Federal Register: June 10, 2005 (Volume 70, Number 111)]
[Rules and Regulations]
[Page 33957-33996]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr10jn05-17]

[[Page 33957]]

-----------------------------------------------------------------------

Part II Department of the Treasury

Office of the Comptroller of the Currency

12 CFR Part 41

Office of Thrift Supervision

12 CFR Part 571

Federal Reserve System
-------------------------------------------------

12 CFR Parts 222 and 232

Federal Deposit Insurance Corporation----------------------------------

12 CFR Part 334

National Credit Union Administration-----------------------------------

12 CFR Part 717

-----------------------------------------------------------------------

Fair Credit Reporting Medical Information Regulations; Interim Final
Rule

[[Page 33958]]

-----------------------------------------------------------------------

DEPARTMENT OF THE TREASURY

Office of the Comptroller of the Currency

12 CFR Part 41

[Docket No. 05-10]
RIN 1557-AC85

FEDERAL RESERVE SYSTEM

12 CFR Parts 222 and 232

[Regulation V and FF; Docket No. R-1188]

FEDERAL DEPOSIT INSURANCE CORPORATION

12 CFR Part 334

RIN 3064-AC81

DEPARTMENT OF THE TREASURY

Office of Thrift Supervision

12 CFR Part 571

[No. 2005-16]
RIN 1550-AB88

NATIONAL CREDIT UNION ADMINISTRATION

12 CFR Part 717

Fair Credit Reporting Medical Information Regulations

AGENCIES: Office of the Comptroller of the Currency, Treasury (OCC);
Board of Governors of the Federal Reserve System (Board); Federal
Deposit Insurance Corporation (FDIC); Office of Thrift Supervision,
Treasury (OTS); National Credit Union Administration (NCUA).

ACTION: Interim final rules; request for public comments.

-----------------------------------------------------------------------

SUMMARY: The OCC, Board, FDIC, OTS, and NCUA (Agencies) are publishing
interim final rules to implement section 411 of the Fair and Accurate
Credit Transactions Act of 2003 (FACT Act). The interim final rules
create exceptions to the statute's general prohibition on creditors
obtaining or using medical information pertaining to a consumer in
connection with any determination of the consumer's eligibility, or
continued eligibility, for credit for all creditors. The exceptions
permit creditors to obtain or use medical information in connection
with credit eligibility determinations where necessary and appropriate
for legitimate purposes, consistent with the Congressional intent to
restrict the use of medical information for inappropriate purposes. The
interim final rules also create limited exceptions to permit affiliates
to share medical information with each other without becoming consumer
reporting agencies.

DATES: This interim final rule is effective March 7, 2006. Comments
must be received by July 11, 2005.

ADDRESSES: Comments should be directed to:
OCC: You should include OCC and Docket Number 05-10 in your
comment. You may submit comments by any of the following methods:
Federal eRulemaking Portal: http://www.regulations.gov.

Follow the instructions for submitting comments.
OCC Web Site: http://www.occ.treas.gov. Click on ``Contact

the OCC,'' scroll down and click on ``Comments on proposed
regulations.''
E-mail Address: regs.comments@occ.treas.gov.
Fax: (202) 874-4448.
Mail: Office of the Comptroller of the Currency, 250 E
Street, SW., Mail Stop 1-5, Washington, DC 20219.
Hand Delivery/Courier: 250 E Street, SW., Attn: Public
Information Room, Mail Stop 1-5, Washington, DC 20219.
Instructions: All submissions received must include the agency name
(OCC) and docket number or Regulatory Information Number (RIN) for this
rulemaking. In general, OCC will enter all comments received into the
docket without change, including any business or personal information
that you provide. You may review comments and other related materials
by any of the following methods:
Viewing Comments Personally: You may personally inspect
and photocopy comments at the OCC's Public Information Room, 250 E
Street, SW., Washington, DC. You can make an appointment to inspect
comments by calling (202) 874-5043.
Viewing Comments Electronically: You may request e-mail or
CD-ROM copies of comments that the OCC has received by contacting the
OCC's Public Information Room at regs.comments@occ.treas.gov.
Docket: You may also request available background
documents and project summaries using the methods described above.
Board: You may submit comments, identified by Docket No. R-1188, by
any of the following methods:
Agency Web Site: http://www.federalreserve.gov
Follow the instructions for submitting comments at http://www.federalreserve.gov/generalinfo/foia/ProposedRegs.cfm.
Federal eRulemaking Portal: http://www.regulations.gov.

Follow the instructions for submitting comments.
E-mail: regs.comments@federalreserve.gov. Include docket
number in the subject line of the message.
Fax: 202/452-3819 or 202/452-3102.
Mail: Jennifer J. Johnson, Secretary, Board of Governors
of the Federal Reserve System, 20th Street and Constitution Avenue,
NW., Washington, DC 20551.
All public comments are available from the Board's Web site at
http://www.federalreserve.gov/generalinfo/foia/ProposedRegs.cfm as

submitted, except as necessary for technical reasons. Accordingly, your
comments will not be edited to remove any identifying or contact
information. Public comments may also be viewed electronically or in
paper in Room MP-500 of the Board's Martin Building (20th and C
Streets, NW.) between 9 a.m. and 5 p.m. on weekdays.
FDIC: You may submit comments, identified by RIN number by any of
the following methods:
Agency Web Site: http://www.fdic.gov/regulations/laws/federal/propose.html.
Follow instructions for submitting comments on

the Agency Web Site.
E-Mail: Comments@FDIC.gov. Include the RIN number in the
subject line of the message.
Mail: Robert E. Feldman, Executive Secretary, Attention:
Comments, Federal Deposit Insurance Corporation, 550 17th Street, NW.,
Washington, DC 20429.
Hand Delivery/Courier: Guard station at the rear of the
550 17th Street Building (located on F Street) on business days between
7 a.m. and 5 p.m.
Instructions: All submissions received must include the
agency name and RIN for this rulemaking. All comments received will be
posted without change to http://www.fdic.gov/regulations/laws/federal/propose.html
including any personal information provided.

OTS: You may submit comments, identified by number 2005-16, by any
of the following methods:
Federal eRulemaking Portal: http://www.regulations.gov.

Follow the instructions for submitting comments.
E-mail Address: regs.comments@ots.treas.gov. Please
include number 2005-16 in the subject line of the message and include
your name and telephone number in the message.
Fax: (202) 906-6518.
Mail: Regulation Comments, Chief Counsel's Office, Office
of Thrift

[[Page 33959]]

Supervision, 1700 G Street, NW., Washington, DC 20552, Attention: No.
2005-16.
Hand Delivery/Courier: Guard's Desk, East Lobby Entrance,
1700 G Street, NW., from 9 a.m. to 4 p.m. on business days, Attention:
Regulation Comments, Chief Counsel's Office, Attention: No. 2005-16.
Instructions: All submissions received must include the agency name
and docket number or Regulatory Information Number (RIN) for this
rulemaking. All comments received will be posted without change to the
OTS Internet Site at http://www.ots.treas.gov/pagehtml.cfm?catNumber=67&an=1
, including any personal information

provided.
Docket: For access to the docket to read background documents or
comments received, go to http://www.ots.treas.gov/pagehtml.cfm?catNumber=67&an=1.
In addition, you may inspect comments

at the Public Reading Room, 1700 G Street, NW., by appointment. To make
an appointment for access, call (202) 906-5922, send an e-mail to
public.info@ots.treas.gov, or send a facsimile transmission to (202)

906-7755. (Prior notice identifying the materials you will be
requesting will assist us in serving you.) We schedule appointments on
business days between 10 a.m. and 4 p.m. In most cases, appointments
will be available the next business day following the date we receive a
request.
NCUA: You may submit comments by any of the following methods
(Please send comments by one method only):
Federal eRulemaking Portal: http://www.regulations.gov.

Follow the instructions for submitting comments.
NCUA Web Site: http://www.ncua.gov/RegulationsOpinionsLaws/proposed_regs/proposed_regs.html.
Follow the

instructions for submitting comments.
E-mail: Address to regcomments@ncua.gov. Include ``[Your
name] Comments on Interim Final Rule Part 717, Fair Credit Reporting--
Medical Information'' in the e-mail subject line.
Fax: (703) 518-6319. Use the subject line described above
for e-mail.
Mail: Address to Mary Rupp, Secretary of the Board,
National Credit Union Administration, 1775 Duke Street, Alexandria,
Virginia 22314-3428.
Hand Delivery/Courier: Address to Mary Rupp, Secretary of
the Board, National Credit Union Administration. Deliver to guard
station in the lobby of 1775 Duke Street, Alexandria, Virginia 22314-
3428, on business days between 8 a.m. and 5 p.m.
All public comments are available on the agency's Web site at
http://www.ncua.gov/RegulationsOpinionsLaws/comments as submitted,

except as may not be possible for technical reasons. Public comments
will not be edited to remove any identifying or contact information.
Paper copies of comments may be inspected in NCUA's law library, at
1775 Duke Street, Alexandria, Virginia 22314, by appointment weekdays
between 9 a.m. and 3 p.m. To make an appointment, call (703) 518-6546
or send an e-mail to OGCMail@ncua.gov.

FOR FURTHER INFORMATION CONTACT: OCC: Amy Friend, Assistant Chief
Counsel, (202) 874-5200; Michael Bylsma, Director, or Stephen Van
Meter, Assistant Director, Community and Consumer Law, (202) 874-5750;
Patrick T. Tierney, Senior Attorney, Legislative and Regulatory
Activities Division, (202) 874-5090; or Carol Turner, Compliance
Specialist, Compliance Department, (202) 874-4858, Office of the
Comptroller of the Currency, 250 E Street, SW., Washington, DC 20219.
Board: David A. Stein, Counsel; Minh-Duc T. Le, Ky Tran-Trong, or
Krista P. DeLargy, Senior Attorneys, Division of Consumer and Community
Affairs, (202) 452-3667 or (202) 452-2412; or Andrew Miller, Counsel,
Legal Division, (202) 452-3428, Board of Governors of the Federal
Reserve System, 20th and C Streets, NW., Washington, DC 20551.
FDIC: Richard M. Schwartz, Counsel, Legal Division, (202) 898-7424;
David Lafleur, Policy Analyst, (202) 898-6569, or Patricia Cashman,
Senior Policy Analyst, Division of Supervision and Consumer Protection,
(202) 898-6534, Federal Deposit Insurance Corporation, 550 17th Street,
NW., Washington, DC 20429.
OTS: Elizabeth Baltierra, Program Analyst (Compliance), Compliance
Policy, (202) 906-6540; Richard Bennett, Counsel, (202) 906-7409;
Judith A. McCormick, Director, Consumer Protection and Specialty
Programs, (202) 906-5636, Office of Thrift Supervision, 1700 G Street,
NW., Washington, DC 20552.
NCUA: Regina M. Metz, Staff Attorney, Office of General Counsel,
(703) 518-6540, National Credit Union Administration, 1775 Duke Street,
Alexandria, VA 22314-3428.

SUPPLEMENTARY INFORMATION:

I. Background

The FACT Act became law on December 4, 2003. Pub. L. 108-159, 117
Stat. 1952. In general, the FACT Act amends the Fair Credit Reporting
Act (FCRA or Act) to enhance the ability of consumers to combat
identity theft, increase the accuracy of consumer reports, and allow
consumers to exercise greater control regarding the type and amount of
marketing solicitations they receive. Section 411 of the FACT Act
generally limits the ability of creditors to obtain or use medical
information in connection with credit eligibility determinations,
consumer reporting agencies to disclose medical information, and all
persons to share medical information and other medical-related
information with affiliates.
Section 411(a) of the FACT Act adds a new section 604(g)(1) to the
FCRA to restrict the circumstances under which consumer reporting
agencies may furnish consumer reports that contain medical information
about consumers. Under section 604(g)(1), a consumer reporting agency
may not furnish a consumer report that contains medical information
about a consumer unless:
(1) The report is furnished in connection with an insurance
transaction, and the consumer affirmatively consents to the furnishing
of the report;
(2) The report is furnished for employment purposes or in
connection with a credit transaction, the information to be furnished
is relevant to process or effect the employment or credit transaction,
and the consumer provides specific written consent for the furnishing
of the report that describes in clear and conspicuous language the use
for which the information will be furnished; or
(3) The information to be furnished pertains solely to
transactions, accounts, or balances relating to debts arising from the
receipt of medical services, products, or devices, where such
information, other than account status or amounts, is restricted or
reported using codes that do not identify, or do not provide
information sufficient to infer, the specific provider or the nature of
such services, products, or devices.
Section 411(c) of the FACT Act revises the definition of ``medical
information'' in section 603(i) to mean information or data, whether
oral or recorded, in any form or medium, created by or derived from a
health care provider or the consumer, that relates to the past,
present, or future physical, mental, or behavioral health or condition
of an individual, the provision of health care to an individual, or the
payment for the provision of health care to an individual. The term
``medical

[[Page 33960]]

information'' does not include the age or gender of a consumer,
demographic information about the consumer, including a consumer's
residence address or e-mail address, or any other information about a
consumer that does not relate to the physical, mental, or behavioral
health or condition of a consumer, including the existence or value of
any insurance policy.
Section 411(a) also amends the FCRA by adding new section 604(g)(2)
to prohibit creditors from obtaining or using medical information
pertaining to a consumer in connection with any determination of the
consumer's eligibility, or continued eligibility, for credit. Section
604(g)(2) contains two independent prohibitions--a prohibition on
obtaining medical information and a prohibition on using medical
information. The statute contains no prohibition, however, on creditors
obtaining or using medical information other than in connection with a
determination of the consumer's eligibility, or continued eligibility,
for credit. For example, section 604(g)(2) does not prohibit a creditor
from obtaining medical information in connection with employment
purposes. Nevertheless, a creditor that obtains medical information in
connection with employment purposes may not subsequently use that
information in connection with any determination of the consumer's
eligibility, or continued eligibility, for credit. Section 604(g)(5)(A)
requires the Agencies to prescribe regulations that permit transactions
that are determined to be necessary and appropriate to protect
legitimate operational, transactional, risk, consumer, and other needs
(including administrative verification purposes), consistent with
Congressional intent to restrict the use of medical information for
inappropriate purposes.
Section 411(b) of the FACT Act adds a new section 603(d)(3) to the
FCRA to restrict the sharing of medically related information with
affiliates if that information meets the definition of ``consumer
report'' in section 603(d)(1) of the FCRA. Specifically, section
603(d)(3) provides that the standard exclusions from the definition of
``consumer report'' contained in section 603(d)(2)--such as sharing
transaction or experience information among affiliates or sharing other
information among affiliates after notice and an opportunity to opt-
out--do not apply if medically related information is disclosed to an
affiliate. Medically related information includes medical information,
as described above, as well as an individualized list or description
based on payment transactions for medical products or services, and an
aggregate list of identified consumers based on payment transactions
for medical products or services.
Section 604(g)(3), however, provides several exceptions that allow
institutions to share medically related information with affiliates in
accordance with the standard exclusions that apply to the sharing of
non-medically related information. These exceptions provide that an
institution may share medically related information with an affiliate
without having the communication categorically treated as a consumer
report if the information is disclosed to an affiliate:
(1) In connection with the business of insurance or annuities
(including the activities described in section 18B of the model Privacy
of Consumer Financial and Health Information Regulation issued by the
National Association of Insurance Commissioners, as in effect on
January 1, 2003);
(2) For any purpose permitted without authorization under the
Standards for Individually Identifiable Health Information promulgated
by the Department of Health and Human Services (HHS) pursuant to the
Health Insurance Portability and Accountability Act of 1996 (HIPAA);
(3) For any purpose referred to under section 1179 of HIPAA;
(4) For any purpose described in section 502(e) of the Gramm-Leach-
Bliley Act; or
(5) As otherwise determined to be necessary and appropriate, by
regulation or order, by the Federal Trade Commission (FTC), the
Agencies, or an applicable State insurance authority.
Section 604(g)(4), as added by section 411(a)(4) of the FACT Act,
also provides that any person that receives medical information from an
affiliate pursuant to an exception in section 604(g)(3) or from a
consumer reporting agency under section 604(g)(1) must not disclose
such information to any other person, except as necessary to carry out
the purpose for which the information was initially disclosed, or as
otherwise permitted by statute, regulation, or order.

II. Overview of Comments Received

On April 28, 2004, the Agencies published a notice of proposed
rulemaking in the Federal Register (69 FR 23380) to implement the
provisions of section 411 of the FACT Act. The Agencies proposed to
create exceptions to the general prohibition against creditors
obtaining or using medical information in connection with credit
eligibility determinations, as required by section 604(g)(5)(A), to
permit transactions necessary and appropriate to protect legitimate
operational, transactional, risk, consumer, and other needs (including
administrative verification purposes), consistent with the intent of
Congress to restrict the use of medical information for inappropriate
purposes. In addition, the Agencies proposed to create additional
exceptions to the special restrictions in section 603(d)(3) on sharing
medically related information with affiliates, as permitted by section
604(g)(3)(C).
Each of the Agencies received up to 40 comment letters in response
to the proposal, although many commenters sent copies of the same
letter to more than one Agency. Comments were received from a variety
of industry commenters, including banks, thrifts, credit unions, credit
card companies, mortgage lenders and other non-bank creditors, and
industry trade associations. Comments were also received from insurance
companies and insurance industry trade associations. Other comments
were received from consumer and community groups, privacy advocates,
and health care associations. A comment letter was received from two
Members of Congress, and another comment letter was received from the
Federal Trade Commission.
Most commenters supported the proposed rule. Commenters offered a
number of suggested changes, with the most common suggestions
including: broadening the scope of coverage to apply to all creditors;
broadening the scope of coverage to apply to an individual's credit
eligibility made in connection with business credit; clarifying the
definition of ``medical information'; implementing the statute by
relying primarily on interpretations of the statute rather than
exceptions; addressing debt cancellation contracts, debt suspension
agreements, and credit insurance products through an exception; and
revising the language and scope of various exceptions to the general
prohibition on obtaining and using medical information.
The Agencies have modified the proposed rule in light of the
comments received. These comments, and the Agencies' responses to the
comments, are discussed in the following section-by-section analysis.
As discussed below, the Agencies are adopting these rules as interim
final rules so that interested parties may comment on the expanded
scope of the exceptions for obtaining and using medical information in
connection with credit eligibility determinations.

[[Page 33961]]

III. Section-by-Section Analysis

Section --.2 Examples

Section --.2 of the proposal discussed the scope and effect of the
examples included in the proposed rule. Commenters supported the
provision regarding the scope and effect of examples. Section --.2 is
therefore adopted as proposed.

Section --.3 Definitions

Section --.3 of the proposal contained definitions for the terms
``affiliate'' (as well as the related terms ``company'' and
``control''), ``consumer,'' ``medical information,'' and ``you.'' The
proposed definition of ``you'' has not been included in the interim
final rule as unnecessary.\1\
---------------------------------------------------------------------------

\1\ The OTS previously added a definition of ``you'' to Sec.
571.3(o) in connection with its disposal rule. See 69 FR 77610,
77621 (Dec. 28, 2004). That definition remains in the OTS's rule.
---------------------------------------------------------------------------

Affiliate

Several FCRA provisions apply to information sharing with persons
``related by common ownership or affiliated by corporate control,''
``related by common ownership or affiliated by common corporate
control,'' or ``affiliated by common ownership or common corporate
control.'' E.g., FCRA, sections 603(d)(2), 615(b)(2), and 624(b)(2).
Each of these provisions was enacted as part of the 1996 amendments to
the FCRA. Similarly, section 2 of the FACT Act defines the term
``affiliate'' to mean persons that are related by common ownership or
affiliated by corporate control.
Under the proposal, the Agencies proposed to define ``affiliate''
to mean any company that controls, is controlled by, or is under common
control with another company, which is identical to the definition of
``affiliate'' in section 509 of the GLB Act and the GLB Act privacy
regulations. The Agencies received very few comments on the definition
of ``affiliate'' and none that suggested changes to the definition.
In the interim final rules, the Agencies have revised the
definition of ``affiliate'' to track more closely the definition
contained in section 2 of the FACT Act. Section --.3(b) of the interim
final rules defines ``affiliate'' to mean any company that is related
by common ownership or common corporate control with another
company.\2\
---------------------------------------------------------------------------

\2\ For purposes of the regulation, an ``affiliate'' includes an
operating subsidiary of a bank or savings association, and a credit
union service organization that is controlled by a Federal credit
union.
---------------------------------------------------------------------------

The Agencies believe there is no substantive difference between the
FACT Act definition of ``affiliate'' and the definition of
``affiliate'' in section 509 of the GLB Act. The Agencies are not aware
of any circumstances in which two entities would be affiliates for
purposes of the FCRA but not for purposes of the GLB Act privacy rules,
or vice versa. Furthermore, even though affiliated entities have had to
comply with different formulations of the ``affiliate'' definition
under the FCRA and the GLB Act since 1999, the Agencies are not aware
of any compliance difficulties or disputes resulting from the two
statutes using somewhat different wording to describe what constitutes
an affiliate.
Under the GLB Act privacy rules, the definition of ``control''
determines whether two or more entities meet the definition of
``affiliate.'' \3\ The Agencies included the same definition of
``control'' in the proposal. The Agencies received no comments on the
proposed definition of ``control.'' Accordingly, the Agencies interpret
the phrase ``related by common ownership or common corporate control''
as used in the FACT Act to have the same meaning as ``control'' in the
GLB Act privacy rules. For example, if an individual owns 25 percent of
two companies, the companies would be affiliates under both the GLB Act
and FCRA definitions. However, the individual would not be considered
an affiliate of the companies because the definition of ``affiliate''
is limited to companies.
---------------------------------------------------------------------------

\3\ See 12 CFR 40.3(g), 216.3(g), 332.3(g), 573.3(g), and
716.3(g).
---------------------------------------------------------------------------

For purposes of clarity, the Agencies are revising the defined term
from ``control'' (as in the proposal) to ``common ownership or common
corporate control'' in order to track more closely the terminology used
in the FACT Act.\4\ In addition, the Agencies believe that certain
types of persons, for example, governments or governmental agencies or
individuals are not subject to control, as that term is defined in the
interim final rules, for purposes of defining an affiliate.
---------------------------------------------------------------------------

\4\ For purposes of the regulation, NCUA presumes that a Federal
credit union has a controlling influence over the management or
policies of a credit union service organization if it is 67 percent
owned by credit unions.
---------------------------------------------------------------------------

The proposal also included a definition of ``company,'' which was
defined to include any corporation, limited liability company, business
trust, general or limited partnership, association, or similar
organization. Omitted from the definition of ``company'' are some
entities that are ``persons'' under the FCRA, including estates,
cooperatives, and governments or governmental subdivisions or agencies,
as well as individuals. The Agencies received no comments on the
proposed definition of ``company,'' which is adopted as proposed.
The interim final rule includes a definition of ``person'' to
reflect that the definition of ``affiliate'' now refers to a ``person''
rather than to a ``company.'' The definition of ``person'' tracks the
statutory definition and means any individual, partnership,
corporation, trust, estate, cooperative, association, government or
governmental subdivision or agency, or other entity.

Medical Information

Under the proposed rule, paragraph (k) defined the term ``medical
information'' to mean information or data, whether oral or recorded, in
any form or medium, created by or derived from a health care provider
or the consumer, that relates to (1) the past, present, or future
physical, mental, or behavioral health or condition of an individual;
(2) the provision of health care to an individual; or (3) the payment
for the provision of health care to an individual. Proposed paragraph
(k) also made clear that the term ``medical information'' did not
include the age or gender of a consumer, demographic information about
the consumer, including a consumer's residence address or e-mail
address, or any other information about a consumer that does not relate
to the physical, mental, or behavioral health or condition of a
consumer, including the existence or value of any insurance policy. The
definition in the proposal tracked the statutory definition of
``medical information.''
The Agencies requested comment on whether coded information
furnished by a consumer reporting agency in accordance with section
604(g)(1)(C) of the FCRA should be deemed to fall outside the
definition of ``medical information.'' Industry commenters generally
believed that coded information should be excluded from the definition
of ``medical information'' because Congress, by requiring coding by
consumer reporting agencies, determined the appropriate protection for
this information. Privacy advocates, consumer and community groups, and
health care associations urged the Agencies not to exclude coded
information from the definition of ``medical information'' because they
believed it would be an inappropriate narrowing of the statutory
definition and would effectively remove such information from the anti-
discrimination protections of proposed Sec. --.30(c) by allowing
creditors to treat medical debts, if coded, differently than non-
medical debts. Based on the

[[Page 33962]]

comments received and an analysis of the terms and structure of the
FACT Act, the Agencies have determined to treat coded information as
``medical information'' for purposes of the Agencies'' rules. The
statutory definition of ``medical information'' is quite broad. In
addition, the wording of section 604(g)(1) indicates that ``medical
information about a consumer'' includes both coded and uncoded
information from a consumer report. How creditors may obtain and use
this information is discussed below.
A number of commenters asked the Agencies to clarify that ``medical
information'' must relate or pertain to a specific consumer. Commenters
requested this clarification to ensure that creditors can continue to
use databases containing aggregate, non-personally identifiable
information about consumers to analyze consumer behavior patterns
without violating the restrictions on obtaining or using medical
information. The FTC recommended that the Agencies clarify that
information about collateral is not ``medical information'' because
information about collateral does not pertain to an individual.
The Agencies believe that the statutory definition of ``medical
information'' applies only to information that is associated with a
specific consumer because such information must relate to the condition
``of an individual'' or the provision of health care or payment for the
provision of health care ``to an individual.'' In the interim final
rule, the Agencies have clarified that the term ``medical information''
does not include information that does not identify a specific
consumer. Section --.3(k)(2)(iv) contains this clarification. The
interim final rule does not categorically exclude information about
collateral from the definition of medical information because the
relationship between information about collateral and medical
information about an individual may depend upon the facts and
circumstances.
One commenter asked the Agencies to clarify that information about
the death of an individual is not medical information. The Agencies
believe that the fact that a consumer is deceased generally is not
``medical information.'' However, certain information associated with
the death of a consumer, such as information about the medical
condition that resulted in the consumer's death, may be medical
information.
Creditors are reminded that other laws, such as the Americans with
Disabilities Act, the Fair Housing Act (FHA), the GLB Act, the Health
Insurance Portability and Accountability Act (HIPAA), and other parts
of the FCRA, may limit or regulate the use, collection, and sharing of
consumer information, including medical information. These and other
laws, such as the Equal Credit Opportunity Act (ECOA), also may
prohibit creditors from using certain information that is excluded from
the restrictions on obtaining or using medical information, such as age
or gender information, in determining eligibility for credit or for
other purposes. The exceptions created by this rule do not override or
modify, or in any way limit the responsibility of creditors to comply
with all applicable Federal and state fair lending laws. The OTS
reminds creditors subject to its rules that they must comply with the
requirements of the OTS's anti-discrimination rules when seeking to
obtain and use medical information in reliance on the exceptions in
this rule.\5\
---------------------------------------------------------------------------

\5\ The OTS's anti-discrimination regulations are found at 12
CFR part 528.
---------------------------------------------------------------------------

Section --.30 Obtaining or Using Medical Information in Connection With
a Determination of Eligibility for Credit

Section 411(a) of the FACT Act adds a new section 604(g)(2) to the
FCRA, which contains a broad new limitation on the ability of creditors
to either obtain or use medical information in connection with credit
eligibility determinations.
A. Scope of Rules on Obtaining or Using Medical Information
Section 604(g)(2) (as added by section 411 of the FACT Act)
prohibits any ``creditor'' from obtaining or using ``medical
information'' in connection with any determination of the consumer's
eligibility, or continued eligibility, for credit.\6\ The definition of
``medical information'' adopted in the FACT Act broadly includes
information or data, whether oral or recorded, in any form or medium,
created by or derived from a health care provider or a consumer that
relates to the past, present, or future physical, mental, or behavioral
health or condition of an individual, the provision of health care to
an individual, or the payment for the provision of health care to an
individual.\7\ The definition encompasses important financial
information about consumers that is typically used in the credit
underwriting process, such as information about the payment history and
status of medical debts and the amount of a consumer's disability
income.
---------------------------------------------------------------------------

\6\ 15 U.S.C. 1681b(g)(2).
\7\ Id. at Sec. 1681a(i). ``Medical information'' does not
include the age or gender of a consumer, demographic information
about the consumer, including a consumer's residence address or e-
mail address, or any other information about a consumer that does
not relate to the physical, mental, or behavioral health or
condition of a consumer, including the existence or value of any
insurance policy. Id.
---------------------------------------------------------------------------

Section 111 of the FACT Act added a definition of ``creditor'' to
the FCRA that is also very broad and includes any person who regularly
extends, renews, or continues credit, any person who regularly arranges
for the extension, renewal, or continuation of credit, or any assignee
of an original creditor who participates in the decision to extend,
renew, or continue credit.\8\ A ``creditor'' includes depository
institutions as well as entities that are neither depository
institutions nor affiliates of depository institutions, such as
independent finance companies, loan brokers, health care providers, and
automobile dealers. Accordingly, section 604(g)(2) prohibits all
creditors from obtaining or using key financial information that is
also medical information in the credit underwriting process.
---------------------------------------------------------------------------

\8\ The meaning of ``creditor'' in the FCRA has the same meaning
as in the Equal Credit Opportunity Act (``ECOA''). Id. at Sec. Sec.
1681a(r)(5) and 1691a(e).
---------------------------------------------------------------------------

Section 604(g) does not contain any specific statutory exception to
this broad prohibition. Instead, section 604(g)(5) directs the Agencies
to prescribe regulations to permit ``transactions'' in which creditors
obtain or use medical information that are ``necessary and appropriate
to protect legitimate operational, transactional, risk, consumer, and
other needs consistent with the intent of paragraph (2) to restrict the
use of medical information for inappropriate purposes.'' \9\ Section
604(g)(5) does not by its terms limit the scope of the creditors that
may rely on exceptions granted by the Agencies.
---------------------------------------------------------------------------

\9\ Id. at Sec. 1681b(g)(5)(A).
---------------------------------------------------------------------------

Proposed Sec. --.1(b)(2) identified the persons to which the rules
relating to obtaining and using medical information in proposed
Sec. Sec. --.30(a)-(d) applied. As proposed, each Agency's rule and
the exceptions created by those rules applied to creditors subject to
the regulatory jurisdiction of the respective Agency. The most
significant issue raised by commenters in connection with the proposal
related to the classes of creditors to which the exceptions to the
statutory prohibition in section 604(g)(2) would apply. Many commenters
strongly urged the Agencies to make clear that the regulatory
exceptions apply to all creditors that are subject to the statutory
prohibition on

[[Page 33963]]

obtaining or using medical information, not just bank and thrift
creditors and their affiliates and Federal credit unions. Many
financial institution creditors indicated that, if the exceptions
failed to apply to all creditors, the lending activities of financial
institutions would be adversely affected because financial institutions
often originate loans through, or purchase loans from, persons that are
creditors for purposes of the FCRA but are not financial institutions.
In particular, commenters noted that arrangers of credit (which are
creditors for purposes of the FCRA) may include doctors and other
health care providers that inform consumers of medical financing
options and act as a liaison between the consumer and the creditor.
Finally, commenters argued that, without clarification that the
classes of creditors that could rely on the Agencies' regulatory
exceptions were the same as the classes of creditors subject to the
statutory prohibition, a significant number of creditors unaffiliated
with banks, thrifts, or Federal credit unions would be in doubt about
their ability to obtain and use excepted medical information in the
same way and to the same extent as the Agencies' rules allow creditors
that are banks, thrifts, Federal credit unions, or affiliates of those
institutions to obtain and use the identical information. This result
could reduce the availability of credit generally because of the
breadth of the statute's definition of medical information. Two Members
of Congress who sponsored section 411 of the FACT Act, submitted a
comment letter supporting this view and indicating that it was their
intention that the exceptions would apply to non-bank finance
companies, state-chartered credit unions, and doctors, medical
suppliers, and other medical professionals.
The prohibition on creditors obtaining or using medical information
in connection with credit eligibility determinations in section
604(g)(2) applies to all creditors. As noted above, section 605(g)(5)
does not, by its terms, limit the creditors that may rely on the
exceptions granted by the Agencies. Moreover, that section, by its
terms, applies to ``transactions'' for which the Agencies determine
exceptions are necessary, not to ``creditors'' that the Agencies
determine must be protected by the exceptions. Accordingly, the
combined scope of the exceptions adopted pursuant to section 604(g)(5)
in the interim final rules is as broad as the prohibition to which it
applies, and is available to all creditors.
The final action is comprised of six rules. The applicability of
the section of each Agency's rule addressing the prohibition on and
exceptions for creditors obtaining or using medical information in
connection with credit eligibility determinations is set forth in Sec.
--.30(a) and covers transactions in which certain enumerated entities
participate as creditors. Under Sec. --.30(a)(2), other entities that
participate as creditors in transactions in which an enumerated entity
also participates as a creditor are also subject to that Agency's rule.
In addition, a separate rule, codified in part 232 of the Board's
chapter of the Code of Federal Regulations (hereafter ``separate
rule''), affords the exceptions to the prohibition against obtaining
and using medical information for credit eligibility determinations
generally to all creditors, except for creditors that are subject to
one of the other Agencies' rules. This combination of rules establishes
uniform coverage and exceptions for transactions involving any creditor
that is subject to the prohibition on obtaining or using medical
information in section 411. The separate rule has been located in the
Board's chapter of the Code of Federal Regulations as a matter of
convenience because many creditors are accustomed to looking to the
Board's regulations implementing other statutes, such as the Truth-in-
Lending Act and the Equal Credit Opportunity Act.
The Agencies believe it is important that rules prescribing
exceptions to the prohibitions from obtaining or using medical
information in connection with credit eligibility determinations be
consistent. Thus, in developing the proposed and interim final rules,
the Agencies have consulted and coordinated with each other to
establish identical rules. The Agencies will consult and coordinate
with each other regarding any amendments to the rules for the purpose
of assuring, to the extent possible, that the regulations prescribed by
each Agency remain consistent and comparable with the regulations
prescribed by the other Agencies.
These rules are being adopted on an interim final basis with a
delayed effective date. While a number of commenters urged
clarification of the scope of the availability of the exceptions, the
Agencies are concerned that uncertainty about this matter may have led
creditors that believed they could not avail themselves of the
exceptions not to comment on the appropriateness and details of the
exceptions.
B. General Prohibition on Obtaining or Using Medical Information
Proposed paragraph (a)(1) incorporated the statute's general rule
prohibiting creditors from obtaining or using medical information
pertaining to a consumer in connection with any determination of a
consumer's eligibility, or continued eligibility, for credit, except as
provided in the regulations under subpart D. The supplementary
information to the proposal noted the consumer's eligibility for credit
typically would be determined when an initial decision is made on
whether to grant or deny credit to the consumer, but could also include
decisions whether to terminate an account or adjust a credit limit
following an account review. The Agencies received no comments on this
restatement of the statutory prohibition in the proposal. Renumbered
paragraph (b)(1) in each Agency's rule and Sec. --.1(b) of the
separate rule contain this provision, which is adopted as proposed.
Proposed paragraph (a)(2) clarified the meaning of certain terms
used in the statutory prohibition and the proposed rule, including
``eligibility, or continued eligibility, for credit,'' ``credit,'' and
``creditor.'' Commenters had no comments on the definitions of
``credit'' and ``creditor,'' which tracked the FACT Act's definition of
those terms. In the interim final rule, renumbered paragraphs (b)(2)(i)
and (ii) of each Agency's rule and Sec. --.1(c)(2) and (3) of the
separate rule contain the definitions of ``credit'' and ``creditor,''
which are adopted as proposed.
The proposed rule interpreted the phrase ``eligibility, or
continued eligibility, for credit'' to mean the consumer's
qualification or fitness to receive, or continue to receive, credit,
including the terms on which credit is offered, primarily for personal,
family, or household purposes. The proposal further clarified that the
phrase ``eligibility, or continued eligibility, for credit'' did not
include the following: (1) The consumer's qualification or fitness to
be offered employment, insurance products, or other non-credit products
or services; (2) a determination of whether the provisions of a debt
cancellation contract, debt suspension agreement, credit insurance
product, or similar forbearance practice or program are triggered; (3)
authorizing, processing, or documenting a payment or transaction on
behalf of a consumer in a manner that does not involve a determination
of the consumer's eligibility, or continued eligibility, for credit; or
(4) maintaining or servicing a

[[Page 33964]]

consumer's account in a manner that does not involve a determination of
the consumer's eligibility, or continued eligibility, for credit.
Commenters offered a substantial number of suggestions regarding
the meaning of ``eligibility, or continued eligibility, for credit.''
Industry commenters supported limiting the term to credit primarily for
personal, family, or household purposes consistent with the traditional
scope of the FCRA. Privacy advocates, consumer and community groups,
and health care associations, on the other hand, objected to the
exclusion of business credit from the general prohibition on obtaining
or using medical information. These commenters argued that the proposed
limitation to consumer credit conflicted with the FCRA definitions of
``credit'' and ``creditor,'' which incorporate the ECOA definitions of
those terms. Moreover, these commenters noted that Congress initially
used the Truth in Lending Act (TILA) definitions of ``credit'' and
``creditor'' in the draft FACT Act legislation, but subsequently
adopted the ECOA definitions of those terms. ECOA applies to business
purpose credit, whereas TILA does not.
The Federal banking agencies (OCC, Board, FDIC, and OTS) have
previously taken the position that a creditor has a permissible purpose
to obtain a consumer report on a consumer in connection with a business
credit transaction under section 604(a)(3)(A) of the FCRA if the
consumer is or will be personally liable on the loan, such as in the
case of a guarantor, co-signer, or, in most instances, an individual
proprietor. An informal FTC staff opinion letter concurred with the
banking agencies' position. See Letter from Joel Winston to Julie L.
Williams, J. Virgil Mattingly, William F. Kroener, III, and Carolyn
Buck, June 22, 2001. A copy of this letter is available from the FTC's
Internet Web site at http://www.ftc.gov/os/statutes/fcra/tatelbaum2.htm.
To ensure consistency with the prior interpretation,

the Agencies are deleting the phrase ``primarily for personal, family,
or household purposes'' from the definition of ``eligibility, or
continued eligibility, for credit.'' In order for the prohibition in
section 604(g)(3) to apply, a creditor must obtain or use medical
information about a consumer in connection with a determination of a
consumer's eligibility, or continued eligibility, for credit.
Accordingly, the general prohibition would apply to business credit if
a consumer would be personally liable for repayment of a business loan.
Commenters also pointed to an ambiguity in the proposal: proposed
paragraph (a)(2)(i)(A) referred to insurance products while proposed
paragraph (a)(2)(i)(B) referred to credit insurance products. To
eliminate this ambiguity, the interim final rule has been revised so
that renumbered paragraph (b)(2)(iii)(A) of each Agency's rule and
section --.1(c)(4)(i) of the separate rule applies to insurance
products other than credit insurance products. Additional, non-
substantive changes have been made to these paragraphs for clarity.
Commenters made a number of suggestions regarding debt cancellation
contracts, debt suspension agreements, and credit insurance products,
which were addressed in proposed paragraph (a)(2)(i)(B). Most
commenters believed that these contracts, agreements, and products
should be addressed through an exception, rather than through an
interpretation. In the interim final rule, debt cancellation contracts,
debt suspension agreements, and credit insurance products are addressed
in two new exceptions, which are discussed below.
Forbearance practices or programs were also addressed in proposed
paragraph (a)(2)(i)(B). Most commenters believed that forbearance
practices and programs should be addressed through an exception, rather
than through an interpretation. In the interim final rule, forbearance
practices or programs are addressed in a new exception, which is
discussed below.
Under the proposal, the term ``eligibility, or continued
eligibility, for credit'' did not include authorizing, processing, or
documenting a payment or transaction on behalf of a consumer in a
manner that does not involve a determination of the consumer's
eligibility, or continued eligibility, for credit. The interim final
rule retains this interpretation in paragraph (b)(2)(iii)(B). See also
section --.1(c)(4)(ii) of the separate rule. A few commenters asked the
Agencies to clarify that over limit transactions or fees and the use of
transaction codes fall within this interpretation. Typically, the
routine processing of over limit transactions or the imposition of over
limit fees would not involve a determination of the consumer's
eligibility, or continued eligibility, for credit. If, however, a
creditor has medical information about the consumer and uses that
information to determine whether or not to raise the consumer's credit
limit, such use must fall within an exception in Sec. Sec. --.30(d) or
(e) of each Agency's rule or Sec. Sec. --.3 or --.4 of the separate
rule to be permissible. Similarly, the use of transaction codes that
identify payments to merchants of medical products or services
typically would not involve a determination of the consumer's
eligibility, or continued eligibility, for credit, unless the creditor
uses the medically related codes to make a judgment about whether, and
on what terms, to extend credit to the consumer.
Under the proposal, the term ``eligibility, or continued
eligibility, for credit'' did not include maintaining or servicing a
consumer's account in a manner that does not involve a determination of
the consumer's eligibility, or continued eligibility, for credit. The
interim final rule retains this interpretation in paragraph
(b)(2)(iii)(C) of each Agency's rule. See also section --.1(c)(4)(iii)
of the separate rule.
The FTC recommended adding a number of additional interpretations
and deleting or revising references suggesting that the proposed
interpretations and rule of construction were not statutory
interpretations. In the interim final rule, the Agencies have deleted
references that may have suggested that the interpretations are not
interpretations of the statute. Most of the additional interpretations
recommended by the FTC are addressed elsewhere in this preamble.
One FTC suggestion not addressed elsewhere is the recommendation to
interpret the statute to permit doctors and other providers of medical
goods and services to extend credit to consumers where the credit is
incidental to the provision of medical goods or services. The Agencies
agree that providers of medical goods and services ordinarily would
obtain medical information pertaining to a consumer in connection with
rendering medical care, and not in connection with credit eligibility
decisions. Moreover, if a provider did not use that medical information
in connection with determining the consumer's eligibility to receive
credit, then the provider clearly would not violate the prohibition.
For example, a doctor who treats a patient before billing the patient
for her services, without considering the patient's payment history or
other medical information relating to the patient, would not have
obtained and used medical information in connection with an eligibility
determination for credit.
As discussed above, the definition of medical information is very
broad and includes not only the health or condition of an individual,
but information relating to the payment for the provision of health
care. See section 603(i) of the FCRA (15 U.S.C. 1681a(i)). If a
provider uses medical information,

[[Page 33965]]

such as a consumer's history of not paying medical bills promptly, in
determining whether and on what terms to extend credit to the consumer,
then the provider, as a creditor, has used medical information in
connection with a credit eligibility determination in contravention of
the general prohibition. Thus, the Agencies conclude that an
interpretation that excludes incidental credit from the statutory
prohibition is not supported by the statute because medical service
providers that extend incidental credit may, in some instances, use
medical information to determine the consumer's eligibility for such
credit.
C. Receiving Unsolicited Medical Information and Coded and Uncoded
Information from a Consumer Reporting Agency
Section --.30(b) of the proposal contained a rule of construction
regarding the receipt of unsolicited medical information in recognition
of the fact that creditors may receive medical information without
specifically asking for it. A creditor may receive unsolicited medical
information, for example, when a consumer informs the loan officer that
she needs a loan to pay for treatment for a particular medical
condition, or when a consumer, in response to a general request on a
credit application for information about outstanding debts, lists debts
owed to hospitals and doctors for medical services. The Agencies
proposed a rule of construction to make clear that a creditor would not
violate the prohibition on obtaining medical information if the
creditor received medical information without specifically asking for
or requesting such information and did not use it.
Commenters generally supported the rule of construction for
unsolicited medical information. Industry commenters generally favored
a rule of construction over an exception.
In addition, the Agencies solicited comment on how to treat
information in consumer reports containing information described in
section 604(g)(1) of the FCRA. The Agencies solicited comment on three
options for allowing creditors to obtain and use coded information
contained in a consumer report pursuant to section 604(g)(1)(C). One
approach was to interpret ``medical information'' to exclude coded
information that may be furnished under section 604(g)(1)(C) of the
Act. Another approach was to interpret the prohibition on obtaining or
using medical information in section 604(g)(2) as qualified by the
provisions in section 604(g)(1) that authorize consumer reporting
agencies to furnish consumer reports containing medical information
under certain circumstances. A final approach was to require creditors
that intend to obtain and use coded medical information in connection
with credit eligibility determinations to do so in accordance with the
financial information exception in proposed Sec. --.30(c).
Industry commenters generally believed that coded information
should be excluded from the definition of ``medical information.''
Privacy advocates, consumer and community groups, and health care
associations, on the other hand, maintained that coded information fell
within the definition of ``medical information'' and opposed the
creation of a separate consumer report exception as in proposed
paragraph (d)(1)(iii). These commenters believed that the other
proposed exceptions were sufficient to protect legitimate uses of both
coded and uncoded medical information obtained from a consumer report.
The FTC urged the Agencies to interpret the general prohibition on
creditors obtaining and using medical information in section 604(g)(2)
as qualified by the provisions in section 604(g)(1) applicable to
consumer reporting agencies that furnish consumer reports containing
medical information.
As noted above, the Agencies interpret coded information provided
pursuant to section 604(g)(1)(C) as meeting the broad statutory
definition of ``medical information.'' Under the interim final rules, a
creditor that receives medical information from a consumer reporting
agency, whether coded or uncoded, without specifically requesting that
information does not obtain medical information in violation of the
prohibition. Such information, however, may be used only in accordance
with the exceptions contained in renumbered paragraphs 30(d) or (e) of
each Agency's rule or Sec. Sec. --.3 or --.4 of the separate rule.
The proposal also included a separate exception for uncoded medical
information furnished by a consumer reporting agency in a consumer
report pursuant to section 604(g)(1)(B) in proposed paragraph
(d)(1)(iii). The proposed exception has been omitted from the interim
final rule as unnecessary. Commenters generally did not support this
exception. A number of these commenters believed that the other
exceptions were sufficient and that no separate exception should be
created for consumer reports. The FTC urged the Agencies to treat coded
and uncoded medical information furnished by consumer reporting
agencies the same by interpreting the general statutory prohibition as
inapplicable to such information.
The Agencies believe that the exceptions in renumbered paragraphs
(d) and (e) of each Agency's rule and in Sec. Sec. --.3 and --.4 of the
separate rule provide creditors sufficient flexibility with respect to
the use of medical information contained in consumer reports. The rule
of construction for unsolicited medical information adequately protects
creditors that receive coded or uncoded medical information in consumer
reports furnished by consumer reporting agencies without specifically
requesting medical information. If, however, a creditor specifically
requests medical information from a consumer reporting agency in
connection with a credit eligibility determination, the creditor must
meet one of the exceptions in renumbered paragraphs (d) and (e) of each
Agency's rule or Sec. Sec. --.3 and --.4 of the separate rule in order
to obtain and use that information.
Renumbered paragraph (c) of the interim final rule adopts the rule
of construction for unsolicited medical information with certain
revisions. Section --.2 of the separate rule contains the identical
provision. The interim final rule provides that a creditor does not
obtain medical information in violation of the prohibition if it
receives such information from a consumer, a consumer reporting agency,
or any other person in connection with any determination of the
consumer's eligibility, or continued eligibility, for credit without
specifically requesting medical information. The rule of construction
is retained as an interpretation, rather than as an exception because
it interprets the statutory language regarding when a creditor
``obtains'' medical information in violation of the prohibition.
The introductory language to the rule of construction has been
revised for clarity to provide that a creditor does not obtain medical
information ``in violation of the prohibition'' if it meets the
specified criteria. In addition, the cross-reference to the general
prohibition has been deleted because the rule of construction is an
interpretation of the statute.
Proposed paragraph (b)(1)(ii), which prohibited the use of
unsolicited medical information, has been deleted because the rule of
construction focuses on when a creditor does not obtain medical
information in violation of the statute. The Agencies believe that
incorporating a use limitation in the rule of construction would be

[[Page 33966]]

inconsistent with the exceptions in renumbered paragraphs (d) and (e).
Instead, the Agencies have added a new paragraph (c)(2) to clarify that
a creditor that receives unsolicited medical information may use that
information in connection with any determination of the consumer's
eligibility, or continued eligibility, for credit only to the extent
the creditor can rely on one of the exceptions in renumbered paragraphs
(d) or (e).
The examples of the rule of construction have been moved to
renumbered paragraph (c)(3) in the interim final rules and all
references to restrictions on the use of unsolicited medical
information have been deleted from the examples consistent with the
changes discussed above. In addition, paragraph (c)(3)(iii) adds a new
example to illustrate how the rule of construction applies to medical
information furnished by a consumer reporting agency.
Commenters had several other comments concerning the rule of
construction. Privacy advocates, consumer and community groups, and
health care associations suggested that the Agencies clarify that the
phrase ``without specifically requesting medical information'' means
information obtained voluntarily without any pressure, prompting, or
direct or indirect solicitation by the creditor. These commenters also
sought an additional requirement that creditors destroy unsolicited
medical information as soon as reasonably practicable and suggested
making the rule of construction an exception. Some industry commenters
suggested that consumers should have the burden of proving that
unsolicited medical information was used in a credit eligibility
determination because it may be difficult for creditors to prove that
unsolicited medical information was not used. Some industry commenters
suggested permitting a creditor to use unsolicited medical information
in a manner no less favorably than it would use comparable medical
information.
The statute does not specifically address the burden of proof to be
applied when disputes arise regarding the use of medical information.
The Agencies find it unnecessary to address this issue because the
interim final rule allows unsolicited medical information to be used as
permitted by the exceptions in renumbered paragraphs (d) and (e). The
Agencies thus decline to impose on consumers the burden of proving that
unsolicited medical information was used in a credit eligibility
determination. Furthermore, even if the consumer requests that a
creditor use unsolicited medical information in connection with a
credit eligibility determination, the creditor is not required to do
so. The phrase ``without specifically requesting medical information''
along with the examples makes clear that the rule of construction does
not apply to medical information obtained through a specific request or
solicitation for such information. No further clarification is
necessary. The destruction of unsolicited medical information would not
be appropriate in many circumstances, thus the Agencies decline to
adopt such a rule.
D. Financial Information Exception for Obtaining and Using Medical
Information
As noted above, section 604(g)(5)(A) of the Act gives the Agencies
the authority to prescribe regulations, after notice and opportunity
for comment, to permit transactions in which creditors may obtain and
use medical information in connection with determinations of credit
eligibility that the Agencies determine to be necessary and appropriate
to protect legitimate operational, transactional, risk, consumer, and
other needs (including actions necessary for administrative
verification purposes), consistent with the intent of the statute to
restrict the use of medical information for inappropriate purposes.
Applying this standard, the Agencies proposed a number of exceptions to
the general prohibition on creditors obtaining or using medical
information in connection with credit eligibility determinations. The
exceptions were contained in proposed paragraphs (c)-(d). In the
interim final rule, these exceptions are contained in renumbered
paragraphs (d) and (e) of each Agency's rule and in Sec. Sec. --.3 and
--.4 of the separate rule.
Section --.30(c) of the proposal contained the proposed financial
information exception. Proposed paragraph (c)(1) provided that a
creditor may obtain and use medical information pertaining to a
consumer in connection with any determination of the consumer's
eligibility, or continued eligibility, for credit so long as the
following three elements were met. First, the information must relate
to debts, expenses, income, benefits, collateral, or the purpose of the
loan, including the use of proceeds. Second, the creditor must use the
information in a manner and to an extent no less favorable than it
would use comparable information that is not medical information in a
credit transaction. Third, the creditor must not take the consumer's
physical, mental, or behavioral health, condition or history, type of
treatment, or prognosis into account as part of any such determination
of credit eligibility.
Commenters generally supported the proposed three-part test for the
financial information exception. Privacy advocates, consumer and
community groups, and health care associations suggested limiting the
exception to circumstances where the creditor has not specifically
requested medical information on its application for credit, but rather
has made a generic request for financial information. These commenters
also suggested including the phrase ``financial information'' in the
text of the rule. Industry commenters suggested revising the first
prong to apply to a non-exclusive list of information routinely used in
the underwriting process. These commenters noted that the Agencies may
have unintentionally omitted certain items, such as assets, that should
be included in the list. Commenters generally supported the second
prong of the test. One commenter suggested that the third prong of the
test was inconsistent with and undermined the ``no less favorable''
principle set forth in the second prong and could prove detrimental to
consumers. Another commenter found the three-part test complicated and
difficult to implement.
The interim final rule retains the three-part test for the
financial information exception, with certain modifications. The
Agencies agree with those commenters that believe the better approach
is to have a non-exclusive list of types of information that are
routinely used in making credit eligibility determinations. The first
prong of the test, therefore, has been revised to include all
information of the type routinely used in making credit eligibility
determinations and provides a non-exclusive list of such types of
information (i.e., information relating to debts, expenses, income,
benefits, assets, collateral, or the purpose of the loan, including the
use of proceeds). The Agencies do not believe it would be helpful to
include the words ``financial information'' in the text of the
exception because there is no bright line between financial information
and medical information.
The second prong of the test is adopted as proposed. Commenters
appeared comfortable with requiring a creditor to use medical
information in a manner and to an extent no less favorable than it
would use comparable non-medical information in a credit transaction.
As noted in the proposal, a creditor may deny credit to the

[[Page 33967]]

consumer because the consumer owes a debt to a hospital if the creditor
would have denied credit to the consumer if the consumer had owed the
same amount of debt with the same payment history to a retailer.
Nothing in the rule prevents the creditor from treating information
about medical debts (or expenses or income) more favorably than non-
medical debts.
The third prong of the test is also adopted as proposed. Other,
more narrowly focused exceptions, such as the medical accommodation
exception, permit a creditor to take the consumer's physical, mental,
or behavioral health, condition, or history, type of treatment, or
prognosis into account in limited circumstances as part of a consumer's
credit eligibility determination. For this type of core medical
information, the Agencies believe it is appropriate to more strictly
limit the circumstances in which creditors may obtain or use this
information.
Since creditors generally are prohibited from obtaining medical
information in connection with any determination of the consumer's
eligibility, or continued eligibility, for credit, a creditor
ordinarily would not specifically request medical information on an
application, but would obtain such information in response to a generic
question on an application about debts, income, and other information
routinely used in credit eligibility determinations. Thus, except where
a creditor has a specific application for the financing of medical
procedures, a creditor generally would be prohibited from specifically
asking for medical information on a credit application.
Proposed paragraph (c)(2) provided several non-exclusive examples
to illustrate when creditors may obtain and use medical information
under the financial information exception. Commenters generally
supported the proposed examples. One commenter requested a
clarification of the example in proposed paragraph (c)(2)(iii)(B). In
that example, a consumer meets with a loan officer of a creditor to
apply for a mortgage loan. While filling out the loan application, the
consumer informs the loan officer orally that she has a potentially
terminal disease. The consumer meets the creditor's established
requirements for the requested mortgage loan. The loan officer
recommends to the credit committee that the consumer be denied credit
because the consumer has that disease. The commenter recommended adding
a statement that the bank acted on the loan officer's recommendation
and denied the application because the consumer had a potentially
terminal disease to clarify that the creditor, in fact, used medical
information in a manner inconsistent with the exception. The Agencies
believe this clarification is helpful and, in the interim final rule,
have revised the example in renumbered paragraph (d)(2)(iii)(B) of each
Agency's rule accordingly. See also section --.3(b)(3)(ii) of the
separate rule.
In addition, a new example has been added in paragraph
(d)(2)(iii)(C) of each Agency's rule and Sec. --.3(b)(3)(iii) of the
separate rule to illustrate that a creditor cannot use a consumer's
apparent medical condition as the basis for requiring the consumer to
obtain debt cancellation, debt suspension, or credit insurance coverage
as a condition for the extension of credit. Even though the use of
medical information to determine the consumer's eligibility for a debt
cancellation contract, debt suspension agreement, or credit insurance
product generally is subject to an exception to the general prohibition
pursuant to paragraphs (e)(1)(viii) or (e)(1)(ix), a creditor may not
condition an extension of credit to the consumer on the consumer
obtaining debt cancellation, debt suspension, or credit insurance
coverage based on the consumer's physical, mental, or behavioral
health, condition or history, type of treatment, or prognosis.
In addition, the heading of renumbered paragraph (d)(2)(i) has been
revised in the interim final rule to reflect changes made to the first
prong of the test to encompass the type of information routinely used
in making credit eligibility determinations. Non-substantive revisions
have also been made to the examples in renumbered paragraphs
(d)(2)(ii)(A) and (C) for clarity. Aside from these changes, the
examples are adopted as proposed.
E. Specific Exceptions for Obtaining and Using Medical Information
Section --.30(d) of the proposal contained a number of specific
exceptions to the general prohibition. These exceptions would allow
creditors to obtain and use medical information for a limited number of
particular purposes in connection with a determination of the
consumer's eligibility, or continued eligibility, for credit. A
creditor that obtains medical information pursuant to one of these
specific exceptions may not subsequently use the information in
connection with determining the consumer's eligibility, or continued
eligibility, for credit unless an exception applies. In the interim
final rule, the specific exceptions are contained in renumbered
paragraph (e) of each Agency's rule. Section --.4 of the separate rule
contains the identical exceptions in paragraphs (a)(1)-(9).
Determination of power of attorney, legal representative and legal
capacity. Proposed paragraph (d)(1)(i) provided that a creditor may
obtain and use medical information to determine whether the use of a
power of attorney or legal representative is necessary and appropriate.
This exception was designed to permit a creditor to verify, in
connection with a credit eligibility determination, that the exercise
of a power of attorney or legal representative is necessary and
appropriate. Some industry commenters suggested that the exception
clarify that creditors may obtain and use medical information to
determine the consumer's competency or legal capacity to contract.
Privacy advocates, consumer and community groups, and health care
associations suggested limiting the power of attorney exception to
circumstances where a power of attorney is triggered by a medical
condition or where there is a legitimate question about the consumer's
legal capacity to contract when a person asserts the exercise of a
power or attorney or claims to act as a legal representative on behalf
of a consumer. The FTC commented that the limited circumstances where
medical information may be obtained and used to determine whether a
power of attorney is necessary and appropriate would not be in
connection with a credit eligibility determination, and therefore
should be addressed through an interpretation of the statute, rather
than through an exception.
The interim final rule revises the exception for the use of a power
of attorney or legal representative. Renumbered paragraph (e)(1)(i) of
the interim final rule permits a creditor to obtain and use medical
information in connection with determining the consumer's credit
eligibility to determine whether the use of a power of attorney or
legal representative that is triggered by a medical event or condition
is necessary and appropriate or whether the consumer has the legal
capacity to contract when a person seeks to exercise a power of
attorney or act as legal representative for a consumer based on an
asserted medical event or condition. The interim final rule makes two
substantive changes in response to the comments received. First, the
exception has been narrowed to permit a creditor to obtain and use
medical information only when the power of attorney or legal
representative is triggered by a medical event or condition. Second,
the exception has been revised to permit a creditor to

[[Page 33968]]

determine whether the consumer has the legal capacity to contract where
a person seeks to exercise a power of attorney or act as a legal
representative based on an asserted medical event or condition. This
revision is designed to clarify that creditors may obtain and use
medical information to verify that the asserted medical event or
condition triggering the power of attorney or legal representative has,
in fact, occurred and renders the consumer legally incapable of
contracting. Where use of a power of attorney or legal representative
is triggered by non-medical events or conditions, creditors should not
need to obtain or use medical information.
In response to the FTC's comments, the Agencies recognize that a
power of attorney or legal representative may be used in a variety of
circumstances, many of which have no connection with a determination of
a consumer's eligibility, or continued eligibility, for credit. For
example, a power of attorney or legal representative may be used in
connection with establishing a deposit or other asset account. In those
circumstances, the general prohibition on obtaining or using medical
information would not apply because the information would not be
obtained or used in connection with any determination of the consumer's
eligibility, or continued eligibility, for credit. The introductory
language to renumbered paragraph (e) of the interim final rules makes
clear that the specific exceptions apply to a creditor that ``may
obtain and use medical information pertaining to a consumer in
connection with any determination of the consumer's eligibility, or
continued eligibility, for credit.'' A creditor that obtains and uses
medical information in circumstances not connected with a credit
eligibility determination is not subject to the general statutory
prohibition and does not have to rely upon the power of attorney or any
other exception.
Compliance with applicable law. Proposed paragraph (d)(1)(ii)
provided an exception to permit a creditor to obtain and use medical
information to comply with applicable requirements of local, state, or
Federal laws. The Agencies received only a few comments on this
proposed exception. One commenter asked the Agencies to clarify that
this exception covered laws that prohibit unfair and deceptive acts or
practices. The FTC suggested that the financial abuse statutes
referenced in the preamble as an example do not involve credit
eligibility determinations, and therefore a statutory interpretation
was more appropriate than an exception.
In the interim final rule, renumbered paragraph (e)(1)(ii) is
adopted as proposed. Although many legal requirements do not have any
connection with credit eligibility, other laws may have such a
connection. As noted above, a creditor that obtains and uses medical
information to comply with applicable laws in circumstances that are
not connected with a credit eligibility determination is not subject to
the general statutory prohibition and does not have to rely upon the
exception. However, the exception is retained to cover those
circumstances where it may be needed to protect creditors from
inconsistent legal obligations.
Special credit program or credit-related assistance program. One
commenter suggested that the proposed compliance with applicable laws
exception would not be sufficient to permit creditors to obtain and use
medical information in connection with special credit or credit-related
programs, such as programs established by government-sponsored
enterprises. Such programs may require creditors as part of the program
requirements to obtain and use medical information in ways not covered
by the other exceptions. Consistent with the policy goals established
by Congress, the prohibition on creditors obtaining or using medical
information should not interfere with the ability of creditors to
assist consumers to qualify for beneficial special programs established
by government-sponsored enterprises, not-for-profit organizations, or
others.
To address this concern, the interim final rule contains a new
exception in renumbered paragraph (e)(1)(iii) that permits creditors to
obtain and use medical information in connection with a determination
of the consumer's eligibility, or continued eligibility, for credit, to
determine, at the consumer's request, whether the consumer qualifies
for a legally permissible special credit program or credit-related
assistance program that is: (a) Designed to meet the special needs of
consumers with medical conditions and (b) established and administered
pursuant to a written plan of the plan sponsor that identifies the
class of persons that the program is designed to benefit and sets forth
the procedures and standards for extending credit or providing other
credit-related assistance under the program. Because not all
potentially eligible consumers may seek to qualify for a special credit
or credit assistance program, this exception applies only when the
consumer requests to be considered for the program. A creditor,
however, may provide consumers with information about such programs to
educate consumers about their options. In addition, any special credit
or credit assistance program must meet the requirements of all
applicable fair lending laws. The plan sponsor may include a government
agency, charitable organization, the creditor, or any other person.
This exception is modeled after the provisions relating to special
purpose credit programs in the ECOA and the Board's Regulation B, 12
CFR part 202. What programs are permissible and what inquiries to
determine medical eligibility are permissible, however, are governed by
other laws, including applicable fair lending laws, and are beyond the
scope of this rule.
Renumbered paragraph (e)(2) of the interim final rule provides an
example to illustrate this exception. In the example, a not-for-profit
organization establishes a credit assistance program pursuant to a
written plan that is designed to assist disabled veterans purchase
homes by subsidizing the down payment for the home purchase mortgage
loans of qualifying veterans. The organization works through mortgage
lenders and requires mortgage lenders to obtain medical information
about the disability of any consumer that seeks to qualify for the
program, use that information to verify the consumer's eligibility for
the program, and forward that information to the organization. A
consumer who is a veteran applies to a creditor for a home purchase
mortgage loan. The creditor informs the consumer about the credit
assistance program for disabled veterans and the consumer seeks to
qualify for the program. The example states that, assuming that the
program complies with all applicable law, including applicable fair
lending laws, the creditor may obtain and use medical information about
the medical condition and disability, if any, of the consumer to
determine whether the consumer qualifies for the credit assistance
program.
Fraud prevention or detection. Proposed paragraph (d)(1)(iv)
provided that a creditor may obtain and use medical information for
purposes of fraud prevention and detection. Industry commenters
supported the proposed exception. Privacy advocates, consumer and
community groups, and health care associations believed the proposed
exception was overbroad and unnecessary in light of the other
exceptions.
The interim final rule retains the fraud prevention or detection
exception in renumbered paragraph (e)(1)(iv), although the language has
been revised to make clear that the exception is

[[Page 33969]]

available only to the extent necessary to prevent or detect fraud. The
Agencies anticipate that creditors would find it necessary to obtain
and use medical information for purposes of fraud prevention and
detection in limited circumstances. Creditors relying on this exception
should have the systems in place to demonstrate the necessity for
obtaining and using medical information to prevent or detect fraud.
Creditors that actually use medical information in legitimate fraud
prevention or detection programs should be able to make this
demonstration. Blanket assertions of a fraud prevention or detection
purpose alone, however, are not sufficient to justify the collection of
medical information about consumers under the anti-fraud exception.
Financing medical products or services. Proposed paragraph
(d)(1)(v) provided that a creditor may obtain and use medical
information in connection with credit eligibility determinations in the
case of credit for the purpose of financing medical products or
services to determine and verify the medical purpose of a loan and the
use of proceeds. As noted in the proposal, certain creditors have
established specialized loan programs that finance specific medical
procedures, such as vision correction surgery, but not others. In such
cases, the creditor may need to obtain and use medical information in
connection with determining whether the purpose of the loan is within
the scope of the creditor's established loan program. The proposal also
provided examples of this exception.
Commenters generally supported the medical financing exception.
Several commenters suggested revising the example in proposed paragraph
(d)(2)(i) to permit the creditor to verify that the procedure to be
financed will be performed, in conformance with the language of the
exception, rather than permitting a creditor to confirm the consumer's
medical eligibility.
Renumbered paragraph (e)(1)(v) of the interim final rule retains
the medical financing exception as proposed. The examples of the
medical financing exception have been moved to paragraph (e)(3) in the
interim final rule. The example in paragraph (e)(3)(i) of the interim
final rule has been revised from the proposal in accordance with the
commenters' suggestions.
Medical accommodation. Section --.30(d)(1)(vi) of the proposal
provided that a creditor may obtain and use medical information if the
consumer or the consumer's legal representative requested in writing,
on a separate document signed by the consumer or the consumer's legal
representative, that the creditor use specific medical information for
a specific purpose in determining the consumer's eligibility, or
continued eligibility, for credit, to accommodate the consumer's
particular circumstances. Under the proposal, the signed, written
request had to describe the specific medical information that the
consumer requested the creditor to use and the specific purpose for
which the information would be used. The proposal contemplated an
individualized process in which the consumer would inform the creditor
about the specific medical information that the consumer would like the
creditor to use and for what purpose. As noted in the preamble to the
proposal, this exception was not intended to allow creditors to obtain
consent on a routine basis or as a part of loan applications or
documentation. The proposal provided examples of the medical
accommodation exception.
Commenters had a number of recommendations regarding the medical
accommodation exception. Privacy advocates, consumer and community
groups, and health care associations suggested that the regulation
should explicitly state that creditors may not request medical
information or consent to obtain medical information on a routine basis
or as part of a loan application. Several commenters also suggested
clarifying that the request must be voluntary and initiated by the
consumer. In addition, commenters suggested including language in the
regulation to clarify that the exception is not met by a form that
contains a pre-printed description of various types of medical
information and the uses to which it might be put. Some commenters
urged the Agencies to add a disposal requirement on creditors that
obtain information that is not needed. Consumer and community groups
also suggested eliminating the forbearance interpretation, folding that
interpretation into the medical accommodation exception, and adding
anti-discrimination protections to the provision, similar to the ``no
less favorable'' standard used in renumbered paragraph (d).
Industry commenters generally believed that the medical
accommodation was too restrictive. Some industry commenters suggested
that the use of pre-printed consent forms or other routine form of
consent should be sufficient to trigger the exception. Other commenters
suggested that the consumer should be able to request the use of
medical information through oral and electronic means, not simply
through a signed writing. One commenter noted that many creditors
include a section on their credit applications where the consumer may
describe special circumstances or other information that the consumer
would like the creditor to consider. This commenter recommended
relaxing the requirements of the medical accommodation exception to
enable the exception to apply in this circumstance. Another commenter
noted that the medical accommodation exception was drafted so narrowly
that it may prohibit a creditor from obtaining or using additional
medical information to verify or corroborate the facts necessary to
support a consumer's medical accommodation request.
In the interim final rule, the medical accommodation exception in
renumbered paragraph (e)(1)(vi) has been revised to address commenters'
concerns. Paragraph (e)(1)(vi) provides an exception for circumstances
where the consumer or the consumer's legal representative specifically
requests that the creditor use medical information in determining the
consumer's eligibility, or continued eligibility, for credit, to
accommodate the consumer's particular circumstances, and such request
is documented by the creditor. Any such accommodation must be
consistent with safe and sound practices. The requirement for a
separate signed writing by the consumer that describes the specific
medical information and the specific purpose for which it is to be used
has been deleted in the interim final rule. Instead, the interim final
rule focuses on the specific request of the consumer and the creditor's
documentation of that request. As revised, the interim final rule
permits the medical accommodation exception to be triggered by the
consumer's oral, electronic, or written request. A consumer may make a
specific request by responding to a generic inquiry on a credit
application that invites the consumer to describe any special
circumstances or other information (not limited to medical information)
that the consumer would like the creditor to consider in evaluating the
consumer's application. The disposal of records connected with a
specific request for a medical accommodation is beyond the scope of
this rule and may not be appropriate in certain circumstances.
The proposal contained examples to illustrate the medical
accommodation exception. In the interim final rule, the examples have
been moved to paragraph (e)(4) and revised and expanded to address
commenters' concerns.
By its terms, the medical accommodation exception incorporates a
non-discrimination provision, because

[[Page 33970]]

a creditor may only use medical information to ``accommodate'' or favor
the consumer's particular circumstances. Using medical information to
discriminate against or disadvantage the consumer would not meet the
requirements of the exception. Nothing in this rule, however, requires
a creditor to consider medical information at the consumer's request or
to provide an accommodation to the consumer. Under this rule, a
creditor may disregard medical information obtained in connection with
a consumer's specific request for an accommodation and evaluate the
consumer in accordance with the creditor's otherwise applicable
underwriting criteria. Other applicable laws, including applicable fair
lending laws, may require creditors to consider such requests in
certain circumstances. Consideration of circumstances governed by other
applicable laws is beyond the scope of this rule. The example in
renumbered paragraph (e)(4)(i) has been revised to clarify the
creditor's options when presented with a specific request from a
consumer for a medical accommodation.
The example in renumbered paragraph (e)(4)(ii) has been revised to
apply to a specific request made by telephone and documented by the
creditor. The example in paragraph (e)(4)(iii) is new and illustrates
how a specific request may be made by the consumer on a credit
application.
A consumer who specifically requests a medical accommodation may
not provide sufficient information to enable a creditor to determine
whether such an accommodation is warranted. In that case, a creditor
may request additional information as necessary to verify or
corroborate the information provided or to enable the creditor to
determine whether to make a medical accommodation for the consumer's
particular circumstances. The consumer at any time may decline to
provide further medical information, withdraw the request for an
accommodation, and choose to be evaluated according to the creditor's
otherwise applicable underwriting criteria. The example in paragraph
(e)(4)(iv) is new and illustrates how creditor requests for additional
information may be handled.
As noted in the proposal, creditors may not rely on the medical
accommodation exception to routinely obtain and use medical information
about consumers in connection with credit eligibility determinations.
This exception is triggered when the consumer specifically requests an
accommodation. The requirement for a specific request from the consumer
is not satisfied by a creditor routinely including boilerplate language
in a credit application which indicates that by applying for credit the
consumer authorizes or consents to the creditor obtaining and using
medical information in connection with credit eligibility
determinations. The example in paragraph (e)(4)(v) is new and
illustrates that routine requests by creditors do not fall within the
exception.
Forbearance. In the proposal, forbearance practices and programs
were addressed as an interpretation, rather than as an exception.
Industry commenters believed that the proposed interpretation was too
narrow because it only covered the triggering of forbearance practices
and programs. These commenters believed that medical information should
be available for use in determining whether to offer forbearance
practices or programs to the consumer. Several industry commenters also
requested clarification that informal forbearance practices would be
covered by this interpretation. Privacy advocates, consumer and
community groups, and health care associations suggested limiting the
proposed interpretation to forbearance practices and programs triggered
by a medically related event.
In the interim final rule, forbearance practices and programs are
addressed in a new exception in paragraph (e)(1)(vii). Forbearance
practices and programs may be established to address both medical and
non-medical events. The exception, however, applies only to forbearance
practices and programs that are triggered by medical events or
conditions. Accordingly, paragraph (e)(1)(vii) of the interim final
rule creates an exception to permit creditors to obtain and use medical
information ``consistent with safe and sound practices, to determine
whether the provisions of a forbearance practice or program that is
triggered by a medical event or condition apply to a consumer.'' This
exception is flexible enough to cover both formal and informal
forbearance practices and programs. Application of a forbearance
practice or program may or may not be based on the request of the
consumer. Paragraph (e)(5) provides an example of a forbearance
practice or program.
Debt cancellation contracts, debt suspension agreements, or credit
insurance products. As noted above, the proposal addressed debt
cancellation contracts, debt suspension agreements, and credit
insurance products through an interpretation. Most commenters believed
that it was more appropriate to address these contracts, agreements,
and products through an exception. The FTC, however, recommended that
the Agencies continue to address debt cancellation contracts, debt
suspension agreements, and credit insurance products through an
interpretation. The Agencies believe that the better approach is to
create exceptions and, thus, have created two new exceptions in
paragraphs (e)(1)(viii) (covering debt cancellation contracts and debt
suspension agreements) and (e)(1)(ix) (covering credit insurance
products) for the reasons discussed below.
Industry commenters believed that the proposed interpretation was
too narrow because it only covered the triggering of debt cancellation
contracts, debt suspension agreements, and credit insurance products.
These commenters believed that medical information should be available
for use in determining the consumer's eligibility for, the triggering
of, or the reactivation of those contracts, agreements, or products.
Privacy advocates, consumer and community groups, and health care
associations believed that the proposed interpretation was too broad
because debt cancellation contracts and debt suspension agreements are
often triggered by events such as loss of employment or divorce that
have no connection with medical information. Privacy advocates,
consumer and community groups, and health care associations urged the
Agencies to delete credit insurance from the proposed provision,
maintaining that creditors typically do not offer credit insurance
directly. Industry commenters had various suggestions regarding credit
insurance, including creating a separate exception for credit
insurance, referencing credit insurance in the preceding paragraph
(a)(2)(i)(A) (now paragraph (b)(2)(iii)(A)), or broadening the proposed
interpretation to cover eligibility and reactivation determinations.
In the interim final rule, debt cancellation contracts and debt
suspension agreements are addressed in one exception (paragraph
(e)(1)(viii)) and credit insurance products are addressed in a separate
exception (paragraph (e)(1)(ix)) in recognition of the distinct
character of those products. See also sections --.4(a)(8) and (9) of
the separate rule.
Under this rule, a creditor may not use medical information about a
consumer to determine whether the consumer will be required to obtain a
debt cancellation contract, debt suspension agreement, or credit
insurance product. For example, a consumer who is in a wheelchair
cannot be required to obtain credit insurance

[[Page 33971]]

because of the consumer's disability. An example in paragraph
(d)(2)(iii)(C) of each Agency's rule and in Sec. --.3(b)(3)(iii) of
the separate rule illustrates this limitation. Also, a creditor would
not violate this particular rule if it requires all consumers who seek
a particular type of credit, such as credit to finance the purchase of
a home with a small down payment, to obtain credit insurance or a
similar product.
The rule makes clear that creditors may use medical information to
underwrite credit insurance, or to underwrite related credit products,
such as debt cancellation contracts and debt suspension agreements, if
a medical condition or event is a triggering event for the provision of
benefits. However, denial of these products cannot be used as a
subterfuge to consider medical information in making a determination
about eligibility or continued eligibility for the underlying loan.
In addition, other laws and regulations, including applicable anti-
tying rules and fair lending laws, may prohibit or otherwise restrict a
creditor from requiring a consumer to obtain a debt cancellation
contract, debt suspension agreement, or credit insurance product in
connection with an extension of credit.\10\ A discussion of the
circumstances prohibited by other laws and regulations is beyond the
scope of this rule.
---------------------------------------------------------------------------

\10\ For example, banks are prohibited from conditioning an
extension of credit on the consumer obtaining some additional
credit, property or service from the bank or its affiliate other
than a loan, discount, deposit or trust service, see Bank Holding
Company Amendments of 1970 Sec. 106(b) (12 U.S.C. 1972); see also
12 CFR 37.3(a) (providing that a national bank may not extend credit
nor alter the terms or conditions of an extension of credit
conditioned upon the customer entering into a debt cancellation
contract or debt suspension agreement with the bank).
---------------------------------------------------------------------------

Finally, creditors are reminded that when a creditor offers a
consumer a debt cancellation contract, debt suspension agreement, or
credit insurance product that is related to a credit product that the
consumer obtains or seeks to obtain from the creditor, it may not be
clear to the consumer why the creditor is seeking to obtain medical
information. As discussed below, creditors generally would be
prohibited from specifically asking for medical information on a credit
application, except where a creditor has a specific application for the
financing of medical procedures. Whether medical information is
collected on the credit application or through other means, creditors
should make it clear to consumers that the purpose for obtaining
medical information relates to debt cancellation contracts, debt
suspension agreements, or credit insurance products, rather than to the
credit itself. Moreover, where obtaining those products is voluntary,
the consumer should be told that it is not necessary to provide medical
information and that the failure to answer medically related questions
will have no impact on the credit decision.
Deleted exceptions and additional exceptions requested by
commenters. Proposed paragraph (d)(1)(iii) provided that a creditor may
obtain and use uncoded medical information included in a consumer
report furnished by a consumer reporting agency in accordance with
section 604(g)(1)(B) of the FCRA, if such information is used for the
purpose for which the consumer provided specific written consent. As
discussed above, this proposed exception has been eliminated.
Proposed paragraph (d)(1)(vii) provided that a creditor may obtain
and use medical information as otherwise permitted by order of the
appropriate agency. Privacy advocates, consumer and community groups,
and health care associations objected to this provision. The Agencies
believe this paragraph is unnecessary and have omitted it from the
interim final rule because the Agencies are ad