CAPITAL ONE May 27, 2004 Office of the Comptroller of the Currency RE: Proposed Medical Privacy Regulations – Comments of Capital One Financial Corporation Dear Sirs and Madams: Capital One Financial Corporation (“Capital One”) appreciates the opportunity to comment on the Proposed Rules issued by the Board of Governors of the Federal Reserve System (the “FRB”), Federal Deposit Insurance Corporation (“FDIC”), National Credit Union Administration (“NCUA”), Office of the Comptroller of the Currency (“OCC”), and Office of Thrift Supervision (“OTS”) (collectively, the “Agencies”) with respect to the medical privacy requirements contained in Section 411 of the Fair and Accurate Credit Transactions Act (the “FACT Act”). Capital One had 46.7 million customers and $71.8 billion in managed loans outstanding, as of March 31, 2004. A Fortune 200 company, Capital One is one of the largest providers of MasterCard and Visa credit cards in the world. Capital One also offers medical financing for elective procedures, such as orthodontic procedures and corrective-vision surgery, through its Amerifee business. This business involves making unsecured loans to consumers who choose to undergo certain medical procedures that typically are not covered by health insurance. To conduct its medical lending in accordance with the decisions of our customers, our affiliates and medical network necessarily must obtain and use information that could be considered medical information. In support of both this business activity and consumer protection, we would like to offer the following comments on the Proposed Rules. I. Exceptions to the Restriction on Obtaining and Using Medical Information We Support the Agencies’ Efforts to Draft Exceptions that Will Allow Consumer-Friendly and Responsible Business Practices to Continue. Capital One appreciates the Agencies’ willingness to draft practical exceptions to the general statutory restriction on medical information contained in the FACT Act. Congress specifically recognized in section 411(b) of the FACT Act that exceptions would be necessary to allow creditors to continue ordinary business practices that do not raise the concerns addressed by the statutory restriction. In this regard, we especially appreciate the specific examples provided by the Agencies to guide compliance with the financial information exception and the fraud/confirmation of proceeds exception. As the Agencies continue to evaluate additional exceptions, we urge the Agencies to continue to balance consumer protection concerns with practical business realities. II. Rulemaking and Enforcement Authority Under Section 411 of the FACT Act A. We Believe the Final Rules Should Apply to a Broader Group of Creditors to Preserve Existing Medical Financing Practices that Benefit Consumers. The Agencies should apply the exceptions in the Proposed Rules to a broader group of creditors so that lenders may continue to work with doctors and other non-lenders to conduct existing financing practices. If the Agencies do not broaden the group of creditors to which these exceptions would apply, the statutory restriction on obtaining and using medical information will significantly interfere with current lending practices to the detriment of both consumers and lenders. Without broader exceptions, the statutory restriction will also adversely affect the availability of medical services to consumers, particularly consumers who do not have adequate medical insurance. We explain below our assessment that the Agencies have the authority to broaden the coverage of the exceptions to address these crucial public policy concerns. Section 411 of the FACT Act amends section 604 of the Fair Credit Reporting Act (“FCRA”) to limit the ability of creditors to obtain or use medical information.1 Section 604(g)(2) of the FCRA states that: “Except as permitted pursuant to paragraph (3)(C) or regulations prescribed under paragraph (5)(A), a creditor shall not obtain or use medical information . . . pertaining to a consumer in connection with any determination of the consumer’s eligibility, or continued eligibility, for credit.” This prohibition applies to any “creditor.” The FCRA defines the term “creditor” in section 603(r)(5), to have the same meaning as in section 702 of the Equal Credit Opportunity Act (“ECOA”). Section 702 of the ECOA defines “creditor” as “any person who regularly extends, renews, or continues credit; any person who regularly arranges for the extension, renewal, or continuation of credit; or any assignee of an original creditor who participates in the decision to extend, renew, or continue credit.” 2 Thus, the prohibition in section 604(g)(2) could be construed to apply to lenders and arrangers of credit that are neither banking institutions themselves, nor affiliated with banking institutions.
The Proposed Rule would adopt the general rule of section 604(g)(2) prohibiting creditors from obtaining or using medical information in connection with credit eligibility determinations, and that proposes to adopt the FCRA definition of “creditor.” 3 In addition, the Agencies each propose substantially identical exceptions to the general prohibition against creditors obtaining or using medical information in connection with credit eligibility determinations.4 The Agencies’ proposed regulations differ in one significant respect. Each of the Agencies’ regulations would only apply to the creditors that the Agency views as being subject to its jurisdiction. Typically, the institutions subject to the Agencies’ rules appear to be limited to institutions chartered as a bank, savings association or credit union and the affiliates of these institutions. The statutory basis for these jurisdictional determinations is unclear. For example, the FDIC proposal refers to “other entities or persons with respect to which the FDIC may exercise its enforcement authority under any provision of law,” but this language does not appear in the other Agencies’ proposals.5 As a result of the broad statutory prohibition and the limitation of the proposed exception rules to banking institutions and some affiliated or related entities, many creditors would be prohibited from obtaining or using medical information in connection with credit eligibility determinations, but only a limited group of creditors would rely on the exceptions. In many cases, the persons that would be unable to rely on the exceptions would be the nonaffiliated businesses that assist banks with medical financing. The unavailability of these exceptions to non-banking entities could have a significant effect on banks and on the availability of medical services to consumers, particularly consumers that lack or have limited medical insurance. B. The Agencies Should Apply the Exceptions to a Broader Group of Creditors Because of the Practical Realities and Public Policy Concerns Associated with Financing Medical Procedures. Medical financing depends on the participation of parties other than financial institutions. Doctors, and other non-bank entities, play a crucial role in the process of making financing options available in medical transactions in that they are best able to inform consumers about options related to paying for health care. As the first link in the chain for determining health care options, it is critical that doctors be able to present patients not only with options for a course of treatment or elective medical procedures, but payment options as well, so that consumers can make informed, intelligent decisions regarding their required or desired course of action. Insurance is frequently unavailable for certain treatments or elective procedures. Because doctors know that payment concerns are sometimes a significant determinant in individual decisions regarding whether to pursue certain options, particularly elective procedures, doctors will present a patient with several options on how to pay for the recommended treatment or procedure. Among the options doctors may choose to present are payment plans to the office and third-party payment plans designed specifically for medical services. By limiting the exceptions for obtaining and using medical information under the FACT Act to banking institutions and their affiliates, the Proposed Rule would reduce access to quality medical care as consumers choose to forgo important treatments or procedures because of the mistaken belief that they will not be able to finance them. Insufficient information may also lead to suboptimal medical decisions not only in doctors’ offices, but in other medical businesses as well. For example, if a medical device store owner is unable to inform consumers of financing options for equipment such as wheelchairs, consumers may be forced to make do without needed medical devices due to the mistaken belief that they have no way to pay for their care. C. We Believe the Agencies Have the Authority to Broaden the Scope of the Proposed Rules to Address these Public Policy Concerns. The Agencies have the authority to extend the Proposed Rules to cover additional creditors, thereby addressing the public policy concerns discussed above. Section 604(g)(5)(A) does not limit the persons that may rely on the exceptions created by any of the Agencies under that provision. Accordingly, read literally, the exceptions created by the rules of each Agency can apply to all creditors unless the Agencies limit the scope of the exceptions more narrowly. We believe this interpretation is particularly reasonable in light of the references to “creditors” in section 604(g)(2) – the general prohibition on obtaining and using medical information – and the double reference in section 604(g)(5)(A) to section 604(g)(2) itself. In the area of regulation of financial institutions, it is common for a statute to designate a particular agency to prescribe rules that apply to a broad array of entities even though that agency may not have any other relationship to some of the entities that are subject to those rules. In many cases, in a separate section, these statutes designate other agencies to enforce the provisions of the statute, often according to the jurisdiction of the relevant federal agency under other law and relying on the enforcement powers specified by that other law. This model is followed by many other federal laws, including the Electronic Fund Transfer Act6 (consumer electronic banking transactions), the Equal Credit Opportunity Act7 (discrimination in credit), the Expedited Funds Availability Act8 (availability of funds deposited in bank accounts and the collection and return of checks) and the Truth in Lending Act9 (credit disclosures). Section 604(g)(5)(A) of the FCRA follows this same model. Rule writing is authorized under section 604(g)(5)(A) and enforcement by the rule writing and other agencies is specified in section 621. Other statutes delegate rule writing authority to a particular agency and rely on other law for the enforcement of those rules against entities over which the rule writing agency does not have direct enforcement authority without ever referring directly to that enforcement authority. For example, both the reserve requirements imposed on depository institutions by the Federal Reserve and the margin requirements for loans for the purpose of purchasing or carrying securities follow this model. (More detailed descriptions of these and other statutes where the rule writing authority and the enforcement authority do not coincide are included in Attachment A.) D. Section 604 of the FCRA Allows the Agencies to Write Exceptions that Apply to a Broader Set of Creditors than Federally Regulated Financial Institutions and Their Affiliates. Section 604(g)(5)(A) of the FCRA requires the Agencies to provide exceptions to the general prohibition that creditors may not obtain or use medical information in making credit eligibility determinations. Applying the exceptions established under section 604(g)(5) to a broader set of creditors would be consistent with the other rule writing authorizations in the FCRA, such as those noted above, that are not limited by the enforcement jurisdiction provisions in section 621 of the FCRA. The structure of section 604(g) of the FCRA reinforces the view that the section 604(g)(5)(A) exceptions should apply to a broader set of creditors. As noted above, section 604(g)(2) of the FCRA refers to exceptions under both section 604(g)(5)(A) and section 604(g)(3)(C). In stark contrast to section 604(g)(5)(A), which does not limit the applicability of the exceptions established under that paragraph, section 604(g)(3)(C) specifically delineates the coverage of the exceptions under the Agencies’ regulations. Section 604(g)(3)(C) provides an exception to the FCRA’s limitations on affiliate sharing of medical information if the information is disclosed “as otherwise determined to be necessary and appropriate, by regulation or order . . . by the Commission, any Federal banking agency or the National Credit Union Administration (with respect to any financial institution subject to the jurisdiction of such agency or Administration under paragraph (1), (2), or (3) of section 621(b)).” Thus section 604(g) of the FCRA itself includes rule writings that fit in both categories—rule writings where the rules apply to entities for which the rule writer has enforcement authority under the FCRA and rule writings where the enforcement authority of the rule writer under the FCRA is irrelevant. Where Congress intended to limit the coverage of the Agencies’ rule writing authority in the FCRA, the FCRA indicates the Congressional intent to do so.10 There is no evidence in section 604(g)(5)(A) of Congressional intent to limit the entities to which the Agencies’ rule writing authority under section 604(g)(5)(A) applies. Consequently, the Agencies are authorized to write rules under section 604(g)(5)(A) that would apply to creditors that are beyond the Agencies’ limited administrative enforcement jurisdiction. E. Application of the Exceptions to a Broader Group of Creditors Would Not Affect the FTC’s Enforcement Authority with Respect to Certain Creditors under the FCRA. If the Agencies write regulations that provide exceptions for certain creditors that are beyond the Agencies’ administrative enforcement jurisdiction, these creditors still will be covered by the administrative enforcement jurisdiction of the FTC under the FCRA. Section 621(a) of the FCRA provides that the FTC shall enforce the provisions of the FCRA “with respect to consumer reporting agencies and all other persons subject thereto, except to the extent that enforcement of the requirements imposed under this title is specifically committed to some other governmental agency under subsection (b).” As a result, if an entity has duties under the FCRA, the entity will be under the FTC’s enforcement authority, unless specifically covered by another agency under section 621(b). Sections 604(g)(2) and 604(g)(5)(A) do not limit the FTC’s general enforcement authority and do not provide an enforcement structure that differs from sections 621(a) and (b). Accordingly, the FTC is required by section 621(a) to enforce compliance with section 604(g)(2) and with regulations providing exceptions to section 604(g)(2) with respect to any creditors under its jurisdiction. As a result of the foregoing analysis, we believe that the Agencies should broaden the scope of the Proposed Rule to cover a larger group of creditors to address the crucial public policy concerns outlined earlier in this letter, and that section 621 of the FCRA grants the FTC enforcement authority regarding these regulations with respect to creditors that are not regulated by the Agencies. III. Inclusion of Doctors within the Scope of the Final Rule If the Agencies Do Not Believe that the Exceptions Should Apply to All Creditors, the Agencies Should Adopt a Narrower Exception to Address the Public Policy Concerns Raised by this Issue. If the Agencies do not believe the exceptions should cover certain types of creditors, we believe the Agencies should include in the scope of the Final Rule doctors and other persons that arrange credit for financial institutions that are already covered by the scope of the Proposed Rule. This inclusion would allow these creditors to continue to help patients, particularly patients without health insurance, locate financing for their medical treatments and procedures. As previously discussed in this letter, our concern emanates from the fact that the Proposed Rule does not cover individuals such as doctors who are an important link in the chain to providing consumers with financing for certain medical treatments, procedures and products. In this provision of the law, we believe it was Congress’ intent to allow the use of medical information in order to permit certain types of medical lending. Congress intended to have the exceptions cover individuals and entities such as doctors that are critical to the medical lending process. Doctors and other medical professionals play a crucial role in making financing available for medical transactions. They are often in the best position to inform consumers of options that they may not otherwise have known about. In this instance, doctors do not make the credit eligibility decision, but they do assist in informing consumers of their financing options and in arranging for that financing to occur. Not allowing the exceptions to cover these individuals and entities would have an extremely detrimental effect on consumers. Indeed, consumers would be denied access to certain funding sources needed to assist them in meeting their medical needs. Of even greater importance, such an approach will have a disproportionate impact on low and moderate income workers, with limited or no health insurance and limited resources to afford medical treatment. As a result, we believe the doctors and other medical providers that assist financial institutions with the financing of medical treatments and procedures in the manner described above should reasonably fall within the scope of the Final Rule. For instance, the Agencies could add the following language to the end of section ___.1(b)(2) of the Proposed Rules: “, and any person arranging credit with these institutions.” This revision would allow parties that work with financial institutions, such as doctors, to continue their crucial role in financing medical procedures by applying the exceptions in the Proposed Rule to those parties. The FTC could then enforce the rule and the exceptions against those parties pursuant to its authority under section 621 of the FCRA. We believe this outcome would be fully consistent with both the FACT Act and FCRA. IV. Rule of Construction: Persons Who Assist Banks with Medical Financing The Agencies Should Clarify that Doctors and Other Medical Providers Who Assist Patients with Medical Financing Are Not Obtaining or Using Medical Information to Determine Eligibility for Credit. As discussed above, we respectfully request that the Agencies include doctors and other medical providers who assist with medical financing within the scope of the Final Rule. We also request that the Agencies clarify in the Final Rule that the activities described above do not constitute “obtaining or using medical information” for the purposes of determining eligibility for credit. As a result of this exception, the doctors and other parties who help patients finance their medical treatments and procedures by referring them to financial institutions already covered by the Proposed Rule would be able to continue this important practice. As a practical matter, doctors generally do not participate in determining a consumer’s eligibility for credit. Doctors provide patients with applications for various plans to which the patients may apply, but doctors do not review income or credit reports and they do not advise the financial institution on the credit decision. Thus, we do not believe that Congress intended to include this activity in the phrase “obtain or use medical information pertaining to a consumer in connection with any determination of the consumer’s eligibility, or continued eligibility, for credit.” See Section 604(g)(2) of the FCRA. The Agencies could address this concern by adding the following rule of construction in section ___.30(b) of the Proposed Rules: “a person that arranges credit for financial institutions covered by section ___.1(b)(2) shall not be considered to obtain or use medical information pertaining to a consumer in connection with any determination of the consumer’s eligibility, or continued eligibility, for credit if such person does not participate in the credit decision of the financial institution other than by providing information to the consumer about the availability, nature, and terms of the credit being offered by the financial institution or by providing general administrative assistance to the consumer, including with respect to the submission of the application to the financial institution.” We appreciate the Agencies’ attention to this important public policy issue. V. Definition of Medical Information The Agencies Should Further Clarify the Definition of “Medical Information” with Respect to Aggregated Data. We believe it would be appropriate for the Agencies to provide clarification that “medical information” must “relate to” or “pertain to” a specific consumer. For example, a database of information relating to the repayment behavior of thousands of consumers, none of whom is personally identifiable, should not be deemed to be “medical information.” If such information were “medical information,” creditors may have difficulty in utilizing such data even for basic analytical purposes that have no bearing on any individual. We do not believe this was the intent of Congress or the Agencies, and we urge the Agencies to provide a clarification of this issue in the Final Rule or its commentary. VI. Debt Cancellation Contracts and Debt Suspension Agreements We respectfully recommend that debt cancellation contracts (“DCCs”) and debt suspension agreements (“DSAs”) be subject to a specific exception to the prohibition on the use of medical information, rather than an interpretation of what constitutes “eligibility for credit.” Such an exception would be consistent with the FACT Act and the legislative history of the FACT Act, and it would also eliminate operational and legal uncertainties associated with the Proposed Rules. The Proposed Rules interpret the phrase “eligibility, or continued eligibility, for credit” to exclude determinations of whether provisions of a DCC or DSA are triggered. In effect, this permits creditors to consider medical information when deciding whether or not a borrower is eligible for the protection afforded by a DCC or DSA. This exclusion is particularly important in the case of DCCs and DSAs that have triggering events related to the health of a borrower. Many DCCs and DSAs, for example, provide credit protection in the event that a borrower becomes disabled or dies. Access to medical information in that context is necessary and appropriate to the operation of the DCC and DSA. Indeed, without such information, it would be impossible to determine whether or not a borrower was entitled to receive the protection promised in the DCC or DSA. On the other hand, the proposed interpretation fails to address all circumstances in which medical information may be considered in connection with a DCC or DSA and creates some legal uncertainty regarding the application of the regulation to these products. Therefore, we respectfully recommend that proposed Section __.30(d) be revised to include the following specific exception for DCCs and DSAs: (d)(1)(viii) To determine the eligibility for, the triggering of, or the reactivation of a debt cancellation contract or debt suspension agreement. The Terms and Legislative History of the FACT Act Support Our Proposed Exception. The proposed exception is consistent with the terms of Section 411 of the FACT Act. New Section 604(g)(5)(A) of the FCRA (as added by Section 411) expressly empowers the federal banking agencies and the National Credit Union Administration to except from the prohibition on the use of medical information transactions that are “necessary and appropriate to protect the legitimate operational, transactional, risk, consumer, and other needs.” An exception for determining the eligibility for, the triggering of, and the reactivation of DCCs and DSAs falls within the ambit of this authority. As noted above, the consideration of medical information in such contexts is necessary and appropriate to the ability to (1) provide borrowers with promised protection (triggering and reactivation), and (2) control the risk and price of DCCs and DSAs (eligibility). The proposed exception also is supported by the legislative history accompanying the FACT Act. The House Report accompanying the Act (House Report 108-263) specifically states that the use of medical information in connection with “credit-related debt cancellation agreements” is “necessary and appropriate use of medical information”: The Committee recognizes that there are limited circumstances in which a creditor may require medical information in determining a consumer’s eligibility or continued eligibility for credit, for example, to confirm the use of loan proceeds in connection with loans to finance a specific medical procedure or device, or to verify a consumer’s death or disability in connection with credit-related debt cancellation agreements, and considers the limited use of medical information in these circumstances and any similar circumstances the financial regulators may identify, to be a necessary and appropriate use of medical information for purposes of this section. (at page 53) While the foregoing statement is limited to the verification of a death or disability, a section-by-section analysis of the Act introduced in the Congressional Record of December 8, 2003 by the Chairman of the House Financial Services Committee and the Chairman of the Financial Institutions and Consumer Credit Subcommittee (who was an original sponsor of the House version of the Act) indicates that Congress did not intend any part of a DCC or DSA transaction to be subject to the prohibition on the use of medical information: The Federal banking agencies and the NCUA are directed to prescribe regulations that are necessary and appropriate to protect legitimate business needs with respect to the use of medical information in the credit granting process, including allowing appropriate sharing for verifying certain transactions as well as for debt cancellation contracts, debt suspension agreements, and credit insurance that are not generally intended to be restricted by this provision. (at page 2518) emphasis added Thus, we urge the Agencies to establish a broader exception in the Final Rule for DCC and DSA transactions. Such an exception not only is consistent with the FACT Act and its legislative history, but it would also eliminate the operational and legal uncertainties associated with the Proposed Rules. * * * In conclusion, Capital One supports the Agencies’ proposed exceptions to the statutory restriction on obtaining or using medical information. We respectfully request that the Agencies make the following changes to the Proposed Rules:
We appreciate the opportunity to comment on the Proposed Rules. If you have any questions about this letter, please contact me at (703) 720-2266. [1] Section 411 of the FACT Act also amends section 603 of the FCRA to limit the ability of consumer reporting agencies to disclose medical information and to limit the ability of affiliates to share medical information. [2] 15 U.S.C. § 1691a(e). [3] Proposed § ___.30(a). [4] Proposed §§ ___.30(c)-(d). [5] Proposed § ___.1. Thus, the FDIC proposed rules may apply to institution affiliated parties of banking institutions in addition to banking institutions and their affiliates. Other agencies also have enforcement authority over institution affiliated parties, but their proposed rules do not include this language. [6] 15 U.S.C. §§ 1693-1693r. [7] 15 U.S.C. §§ 1691-1691f. [8] 12 U.S.C. §§ 4001-4010. [9] 15 U.S.C. §§ 1601-1615, 1631-1649, 1661-1665(b), 1666-1667f. [10] Please see Attachment B for an analysis of the types of rulemaking authority that Congress granted to varying federal regulatory agencies in the FACT Act. ATTACHMENT A Attachment A is a chart of federal laws that grant rulemaking authority to an agency or agencies that do not regulate all of the entities covered by the rule. Other agencies are charged with enforcing these rules against the entities they regulate, even though those agencies may not have written the rule itself.
ATTACHMENT B
Attachment B is an analysis of the different types of rulemaking authority that Congress granted to varying federal regulatory agencies in the FACT Act. We have provided attachment B. May 27, 2004
The FCRA Employs Approaches to this Issue that Vary by Topic. The FCRA itself, as amended by the FACT Act, includes an array of rule writing models ranging from rule writing authorities that are limited to those entities that are subject to the rule writing agency’s enforcement authority under the FCRA, to provisions that authorize a single agency to write rules that apply to entities regardless of the enforcement scheme specified in the FCRA or any other law. The rule writing authorizations in the FCRA can be categorized into two categories. The first category of rule writing authorizations authorizes or requires multiple agencies to write rules that apply to the entities that fall under those agencies’ administrative enforcement jurisdiction in section 621 of the FCRA. For example, section 615(e) of the FCRA directs the Agencies and the Federal Trade Commission (“FTC”) to establish “red flag” guidelines and prescribe regulations, “with respect to the entities that are subject to their respective enforcement authority under section 621” of the FCRA. Similarly, sections 605(h), 623(e) and 628 and a note to section 624 of the FCRA direct the Agencies and the FTC to write rules “with respect to the entities that are subject to their respective enforcement authority under section 621” of the FCRA.1
The second category of FACT Act rule writing authorizations authorizes or requires an agency or agencies to write rules that cover entities that are both within, and beyond, the agency’s or agencies’ administrative enforcement jurisdiction under the FCRA. For instance, section 615(h) of the FCRA directs the FRB and the FTC to jointly prescribe rules to implement the risk-based pricing notice requirement, including providing exceptions to the requirement. This notice requirement applies to any person that uses a consumer report in connection with an application for, or a grant, extension or other provision of, credit. Accordingly, the rules written under this provision will apply to national banks, federal savings associations and federal credit unions, even though these institutions are not under the enforcement jurisdiction of the FRB or the FTC under section 621 of the FCRA. Section 615(h) specifically provides that enforcement is committed exclusively to the Agencies and officials identified in section 621 of the FCRA.
Section 615(d)(2) of the FCRA requires the FTC, in consultation with the Agencies, to write rules requiring enhanced disclosure of pre-screening opt outs. This regulation applies to any user of a consumer report making a prescreened offer of credit or insurance, including banks and others that are not subject to the enforcement authority of the FTC under the FCRA or the Federal Trade Commission Act. Unlike section 615(h), section 615(d)(2) does not include a provision providing for the enforcement of its requirements. Similarly, section 623(a)(7) of the FCRA requires the Board to prescribe a model notice to be used by any financial institution that extends credit and regularly and in the ordinary course of business furnishes information to the national consumer reporting agencies without specifically providing for enforcement.
[1] In some instances, the Securities and Exchange Commission is also directed to write rules under these sections. |
| Last Updated 06/02/2004 | regs@fdic.gov |