|
American Bankers Association
June 1, 2004
Office of the Comptroller of the Currency
250 E Street, S.W.
Public Information Room
Mail Stop 1-5
Washington, D.C. 20219
Attention: Docket No. 04-09
Jennifer J. Johnson
Secretary
Board of Governors of the Federal Reserve
System
20th Street and Constitution Avenue, N.W.
Washington, D.C. 20551
Attention: Docket No. R-1188
Robert E. Feldman
Executive Secretary
Attention: Comments
Federal Deposit Insurance Corporation
550 17th Street, N.W.
Washington, D.C. 20429
Re: RIN 3064-AC81
Regulation Comments
Chief Counsel’s Office
Office of Thrift Supervision
1700 G Street, N.W.
Washington, D.C. 20552
Attention: Docket No. 2004-16
Becky Baker
Secretary of the Board
National Credit Union Administration
1775 Duke Street
Alexandria, Virginia 22314-3428
Re: 12 CFR Part 717
Re: Fair and Accurate Credit Transactions Act
Obtaining or Using Medical Information
69 Federal Register 23380, April 28, 2004
Dear Sir or Madam:
The American Bankers Association (“ABA”) is responding to the
requests for comment from the Board of Governors of the Federal Reserve
System (“FRB”), the Federal Deposit Insurance Corporation (“FDIC”), the
Office of the Comptroller of the Currency (“OCC”), the Office of Thrift
Supervision (“OTS”), and the National Credit Union Administration (“NCUA”)
(collectively, the “Agencies”) on their proposal implementing the
medical privacy requirements of Section 411 of the Fair and Accurate
Credit Transactions Act (the “FACT Act”).
The ABA brings together all categories of banking institutions to
best represent the interests of this rapidly changing industry. Its
membership which includes community, regional and money center banks and
holding companies, as well as savings associations, trust companies and
savings banks makes ABA the largest banking trade association in the
country. Our members necessarily obtain and use medical information in
the ordinary course of their businesses. Accordingly, this rulemaking is
of great importance to them.
Section 411 of the FACT Act broadly prohibits “creditors” as defined
in Section 702 of the Equal Opportunity Credit Act (“ECOA”)1 from
obtaining or using medical information of consumers when making a
determination of eligibility, or continued eligibility, for credit. ABA
supports the proposal and commends the Agencies for their diligence in
determining how bankers and other creditors obtain and use medical
information in connection with lending determinations. ABA is concerned,
however, that the proposal does not extend the exemptions from the
prohibition on using or obtaining consumers’ medical information to the
full range of “creditors” as defined in ECOA.
Background
Section 411 does two things. First, it broadly prohibits “creditors”
from
(1) obtaining, or (2) using “medical information”2 when making initial or
continuing evaluations of consumers’ eligibility for credit. Second, it
restricts the sharing of medical information among affiliates. The term
“medical information” is defined broadly to include payments for medical
services. Absent an exception, creditors may not obtain or use medical
information even if it involves debts to medical services providers or
is provided voluntarily by consumers. The proposal:
• Sets forth the statutory prohibition;
• Clarifies instances when medical information may be obtained or used
that are not part of the credit evaluation process;
• Establishes a rule of construction for receiving unsolicited medical
information;
• Establishes a broad exception for obtaining or using financial medical
information;
• Delineates several more specific exceptions permitting the use of
medical information; and
• Implements the statutory restrictions on sharing medical information
among affiliates.
Our specific comments follow.
Discussion
Definition of “Medical Information”
The Agencies have used the statutory definition of “medical
information” as the definition of that term in Subpart A of the
proposal. ABA is aware that creditors, particularly those financing
medical procedures or devices, may aggregate information about their
customers who borrow for such purposes to analyze the risks involved
with particular types of lending. In such cases the data does not
identify any particular borrower. For example, a company may compile a
database of information relating to the repayment behavior of thousands
of consumers, none of whom is personally identifiable. If such
compilations of information are deemed to involve “medical information,”
creditors might have difficulty using the data even for basic analytical
purposes that have no bearing on any individual. Accordingly, ABA
requests that the Agencies expressly clarify that the term “medical
information” relates or pertains only to a “specifically identifiable”
consumer.
Definition of “Creditor”
As required by the statute, the Agencies have defined “creditor” as
having the same meaning as in Section 702 of ECOA. ECOA defines a
“creditor” as “any person who regularly extends, renews, or continues
credit; any person who regularly arranges for the extension, renewal, or
continuation of credit; or any assignee of an original creditor who
participates in the decision to extend, renew, or continue credit.”
However, the Agencies have limited the applicability of the exemptions
only to those entities under their specific jurisdictions, rather than
including entities not related to banking organizations that are
normally under the jurisdiction of the Federal Trade Commission.
Thus, as proposed, such nonbanking entities will be prohibited from
legitimately using or obtaining medical information. ABA strongly
believes this construction fails to comport with the statute.
Section 411 provides that “Except as permitted pursuant to . . .
regulations prescribed under paragraph (5)(A), a creditor shall not
obtain or use medical information pertaining to a consumer in connection
with any determination of the consumer’s eligibility, or continued
eligibility, for credit.” It further provides that “[e]ach Federal
banking agency and the National Credit Union Administration shall . . .
prescribe regulations that permit transactions under paragraph (2) that
are determined to be necessary and appropriate to protect legitimate
operational, transactional, risk, consumer, and other needs (and which
shall include permitting actions necessary for administrative
verification purposes), consistent with the intent of paragraph (2) to
restrict the use of medical information for inappropriate purposes.
ABA believes the statutory language is plain on its face. Section 411
contains no restrictions that would limit the applicability of the
exemptions to entities under the jurisdiction of the agencies that were
given rulemaking authority. Neither is there any
legislative history demonstrating such Congressional intent. The
Agencies should not, without strong indication of such legislative
intent, construe Section 411 to achieve the absurd result that an entire
segment of creditors will be prohibited from obtaining or using medical
information. Accordingly, the Agencies should replace the language of
Proposed § ___ .1(b)(2) with the statement that “These regulations apply
to creditors as defined in [Proposed § ___] .30(a)(2)(ii)(B).”
There is ample evidence that Congress often provides rulemaking
authority to one or more agencies that lack enforcement authority over
the parties covered by a rule.3 Indeed, the Fair Credit Reporting Act (“FCRA”),
as amended by the FACT Act, contains numerous models ranging from rule
writing authorities that are limited to those entities that are subject
to the rule writing agency’s enforcement authority under the FCRA, to
provisions that authorize a single agency to write rules that apply to
entities regardless of the enforcement scheme specified in the FCRA or
any other law.4 That Congress chose the latter model in Section 411 does
not indicate that creditors under the jurisdiction of the FTC were
intended to be excluded from the exemptions. The FTC has residual
enforcement authority under Section 621 of the FCRA, so there would be
no lack of enforcement if the Agencies extend the exemptions to all
creditors.
Should the Agencies nonetheless conclude that the exceptions must be
limited to the entities subject to their jurisdictions, ABA strongly
believes that Proposed
§ ___ .1(b)(2) should be broadened to cover providers of medical
products and services that arrange credit for or on behalf of financial
institutions already covered by the exemptions. This result could be
achieved by adding at the end of Proposed
§ ___ .1(b)(2), the phrase “, and any person arranging credit with these
institutions.” These providers are an important link in the chain to
providing consumers with financing for certain medical treatments,
procedures and products because they are often in the best position to
inform consumers of options that the consumers might not otherwise have
known about.
If such providers were subject to the Section 411 prohibition, consumers
with health insurance but without available funds could be denied access
to medical products and services not covered by insurance (such as
orthodontics). Even worse, consumers with limited or no health insurance
and limited resources to afford medical treatment could be denied access
to vital medical products and services (such as wheelchairs). Such a
result would clearly have a disproportionate impact on low- and
moderate-income consumers.
Alternatively, because such providers generally do not make the
credit eligibility decisions, but merely arrange for the financing to
occur, the Agencies could provide that such providers who assist with
medical financing are not covered by the rule. As a practical matter,
providers provide patients with applications for various plans to which
the patients may apply, but do not review income or credit reports and
do not advise the financial institution on the credit decision. This
result could be achieved by adding a new subparagraph (E) to Proposed §
___ .30 as follows:
“Arranging for credit for financial institutions covered by
section ___.1(b)(2) if the arranger does not participate in the
credit decision of the financial institution other than by
providing information to the consumer about the availability,
nature, and terms of the credit being offered by the financial
institution or by providing general administrative assistance
to the consumer, including with respect to the submission of
the application to the financial institution.”
Eligibility or Continued Eligibility for Credit
The proposal defines the term “eligibility, or continued eligibility,
for credit” to mean
“the consumer’s qualification or fitness to receive, or continue to
receive, credit, including the terms on which credit is offered,
primarily for personal, family, or household purposes.” The proposal
excludes from that definition:
• Evaluations of consumers for employment, insurance products, or other
non-credit products or services;
• Any determination of whether the provisions of a debt cancellation/
suspension agreement, credit insurance product, or similar forbearance
practices or programs are triggered;
• Actions in connection with authorizing or processing consumers’
payments or transactions or account servicing that do not involve a
credit determination; and
• Account maintenance or servicing that does not involve a credit
determination.
ABA requests that the insurance/debt cancellation and forbearance
circumstances in Proposed § ___ .30(a)(2)(B) be clarified to ensure that
the definition extends to circumstances beyond the “triggering” event
that involve obtaining or using medical information. For example,
evaluations of a consumer’s medical condition may continue beyond the
initial event, as in the case of a determination that the particular
event is concluded or that a medical condition has been reactivated. ABA
further requests
clarification that the term “forbearance practice or program” includes
both formal and informal programs.
Proposed § ___ .30(a)(2)(C) would apply to “authorizing, processing,
or documenting” credit card transactions. ABA requests that the Agencies
clarify that this provision applies to all aspects of such transactions,
including the imposition of overlimit fees.
Finally, the Agencies have asked for comment on whether should be the
subject of an explicit exception. ABA supports a specific exception
because we believe it would provide greater certainty to creditors
concerning the legal authority for their actions.
Unsolicited Medical Information
Under the rule of construction in Proposed § ___ .30(b), a creditor
would not violate the prohibition if, in connection with making a credit
determination, the creditor:
• Receives but has not specifically requested medical information;
and
• Does not use that information in making the credit determination.
ABA believes that in a legal challenge alleging a violation of this
provision, a creditor would find it difficult at best to demonstrate
that it did not use medical information in making the credit
determination. Accordingly, the consumer should have the burden of
proving that the medical information was actually used in the credit
decision.
Again, ABA believes this provision should be crafted as an exception
rather than a rule of construction to provide greater certainty to
creditors concerning the legal authority for their actions.
Financial Information Exception
This exception would permit creditors to obtain and use medical
information when making credit determinations so long as:
• The information relates to debts, expenses, income, benefits,
collateral, or the purpose of the loan (including the use of the
proceeds);
• The information is used in a manner no less favorable than comparable
non-medical information would be used; and
• The creditor does not consider the consumer’s physical, mental, or
behavioral health, condition or history, type of treatment, or prognosis
when making the credit determination.
ABA supports this exception.
Specific Exemptions
In addition to the broad exception for obtaining and using financial
medical information, the agencies have crafted exceptions to cover
specific situations that they have been made aware of. As proposed, the
specific exceptions cover:
• Powers of attorney. It is permissible to use medical information to
determine whether is it appropriate to use a power of attorney or legal
representative (i.e., because the consumer is incapacitated).
• Compliance with state/local laws. For example, some state laws require
that creditors provide medical information to state agencies concerning
possible financial abuses of consumers.
• Credit reports. It is permissible to use medical information included
in a credit report if it is used for the purpose for which the consumer
provided specific written consent.
• Fraud. It is permissible to use medical information for the purposes
of fraud prevention and detection.
• Medical products/services. It is permissible to determine and verify
the medical purpose of a loan and the use of loan proceeds when the
credit is to finance medical products or services.
• Consumer requests. It is permissible to use medical information at the
request of the consumer (or legal representative) if the request is in
the form of a separate, written, signed request describing the specific
medical information to be used for a specific purpose.
ABA supports these specific exemptions. We further believe than an
additional exception is warranted in connection with programs for
reimbursing the cost of health-related products or services that are
eligible under flexible spending accounts. For example, we are aware of
some programs in which the employer provides its employees with special
credit cards that are to be used only for reimbursable expenses. In such
cases, the persons administering the program on behalf of the employer
must be able to review the credit card purchases to ensure that they are
appropriate under the employer’s program.
Restrictions on Sharing Medical Information among Affiliates
With respect to sharing medical information, Section 411 eliminates
the current exemption of the Fair Credit Reporting Act that permits
sharing information with affiliates that is (1) transaction or
experience information or (2) for which the customer has not opted out
of sharing. The proposal incorporates the following statutory exceptions
that permit sharing medical information:
• In connection with the business or insurance or annuities;
• For any purpose permitted without authorization under the Health
Insurance Portability and Accountability Act or under the financial
institutions exemption from that Act; or
• For any purpose described in Section 502(e) of the Gramm-Leach-Bliley-Act.
ABA supports this provision. However, we believe that for the sake of
clarity, the Agencies should specify that purposes described in Section
502(e) are “necessary and appropriate to protect legitimate operational,
transactional, risk, consumer and other needs.”
Effective Date
ABA believes that the effective date of the final rules should, at a
minimum, be 90 days after the rule is issued and that in no case should
the statutory prohibition go into effect prior to the effective date of
the exemptions.
Christeena Naser, Senior Counsel
American Bankers Association
1120 Connecticut Avenue, NW
Washington, DC 20036
1 Section 702 of the ECOA defines as a “creditor”
“any person who regularly extends, renews, or continues credit; any
person who regularly arranges for the extension, renewal, or
continuation of credit; or any assignee of an original creditor who
participates in the decision to extend, renew, or continue credit.” 15
U.S.C. § 1691a(e).
2 “Medical information” is defined as information or
data in any form or medium that is created by or derived from a health
care provider or the consumer relating to the (1) past, present, or
future physical, mental, or behavioral health or condition of an
individual; (2) provision of health care to an individual; or (3)
payment for health care services to an individual. Medical information
does not include the consumer’s age, gender, residence or e-mail
address, although other laws may restrict the use of such information.
3 The following statutes are but some examples of
this split authority: Children’s On-Line Privacy Protection Act, CANSPAM
Act, Electronic Funds Transfer Act, Equal Credit Opportunity Act,
Expedited Funds Availability Act, Federal Reserve Act (reserve
requirements), Home Mortgage Disclosure Act, Securities Exchange Act of
1934 (margin requirements), Truth in Lending Act, and Truth in Savings
Act.
4 These FCRA rule writing authorizations can be
categorized into two categories. The first category authorizes or
requires multiple agencies to write rules that apply to the entities
that fall under those agencies’ administrative enforcement jurisdiction
in section 621 of the FCRA. See, i.e., Sections 615(e), 605(h), 623(e)
and 628 and a note to Section 624. The second category authorizes or
requires an agency or agencies to write rules that cover entities that
are both within, and beyond, the agency’s or agencies’ administrative
enforcement jurisdiction under the FCRA. See, i.e., Section 615(h).
|
