Bank of America
May 28, 2004
Robert E. Feldman
Executive Secretary
Federal Deposit Insurance Corporation
550 17th Street, NW
Washington, DC 20429
Attention: RIN No. 3064-AC81
Public Information Room
Office of the Comptroller of the Currency
250 E Street, SW
Mail Stop 1-5
Washington, DC 20219
Attention: Docket No. 04-09
Jennifer J. Johnson
Secretary
Board of Governors of the Federal
Reserve System
20th Street and Constitution Avenue, NW
Washington, DC 20551
Attention: Docket No. R-1188
Re: Fair Credit Reporting Medical Information Regulations
Ladies and Gentlemen:
Bank of America Corporation (“Bank of America”) welcomes the
opportunity to comment on the Notice and Request for Comment issued by
the Federal Deposit Insurance Corporation (“FDIC”), Federal Reserve
Board (“Board”), Office of the Comptroller of the Currency (“OCC”),
Office of Thrift Supervision (“OTS”) and the National Credit Union
Administration (“NCUA”) (collectively, the “Agencies”) regarding the
notice of proposed rulemaking (“Proposed Rule”) for the medical privacy
regulations under the Fair and Accurate Credit Transactions Act of 2003
(“FACT Act”). Bank of America is one of the world's largest financial
institutions, serving individual consumers, small businesses and large
corporations with a full range of banking, investing, asset management
and other financial and risk-management products and services. The
company provides unmatched convenience in the United States, serving 33
million consumer relationships with 5,700 retail banking offices, more
than 16,000 ATMs and award-winning online banking with more than ten
million active users.
Bank of America supports the Agencies in their effort to create
regulations containing exemptions for obtaining, using and sharing
medical information to allow institutions and lenders to continue to
serve their customers while protecting against the concerns of using
such sensitive information in inappropriate ways. At the same time,
however, we are concerned that the scope of the Proposed Rule is too
narrow and will negatively impact the availability of credit in the
United States through creating an imbalance among various participants
in the secondary market for financial products. In addition, we believe
that the Proposed Rule permitting obtaining and using medical
information in certain circumstances through a combination of
definitions, rules of construction and outright exceptions is overly
complex and could be simplified. We also have some concerns that the
rules should be further clarified and in some situations expanded to
ensure that legitimate and appropriate activities involving the receipt
and use of medical information, in many cases for the purpose of
directly benefiting borrowers, will continue to be permitted.
Scope
The prohibition on creditors obtaining and using medical information
contained in Section 604(g)(5)(A) of the FCRA, as added by section
411(a) of the FACT Act is not limited in its applicability to certain
entities subject to the jurisdiction of the Agencies. It covers all
“creditors” as defined by the Equal Credit Opportunity Act (“ECOA”),
including persons arranging credit, and certain assignees of a loan, as
well as the actual creditor. In addition, it includes creditors
generally subject to the jurisdiction of the Federal Trade Commission.
If the exceptions set forth in the Proposed Rule are only available to
the limited group of creditors subject to the usual jurisdiction of the
Agencies, there will be many types of creditors that will not be able to
obtain and use medical information under the same types of circumstances
that the Agencies have identified as being “necessary and appropriate to
protect legitimate operational, transactional, risk, consumer, and other
needs.”1 This would include creditors that arrange credit and
sell it to national banks and other institutions covered by the Proposed
Rule, such as state-licensed lenders, mortgage brokers, auto dealers and
medical care providers. If those creditors are not permitted to obtain
medical information in the situations set forth in the Proposed Rule,
the banks will also not be able to receive such information and will not
be able to make informed purchase decisions about such loans. This will
result in consumers having less credit available or making it more
expensive. Moreover, the underlying products delivered by these parties
may in some cases be securitized or otherwise sold to investors via the
secondary market. If a class of assets is created under the Proposed
Rule which is perceived to be of lesser credit quality, the
marketability of these securities may be impaired.
In addition, section 604(g)(5)(A), which sets forth the rule and the
Agencies’ direction to prescribe regulations setting forth exceptions,
does not limit the applicability of the exceptions promulgated in such
regulations to the types of entities over which the Agencies have
general regulatory authority. If Congress had intended such a
limitation, it could have clearly articulated that restriction. In fact,
in section 604(g)(3)(C), which addresses the sharing of medical
information among affiliates, Congress specifically limited the
exception-making authority of the Agencies to those entities over which
they had jurisdiction. Thus, the statute does not restrict the Agencies’
authority to grant exceptions that have broader applicability than the
institutions they directly regulate and such a limitation is
inconsistent with the direction of Congress that the Agencies must
specify appropriate exceptions. Bank of America strongly urges the
Agencies to remove the restriction on the applicability of the Proposed
Rule.
Exceptions from Coverage
The Proposed Rule uses several means to grant exceptions to permit
creditors to obtain and use medical information. These include excluding
certain activities from the definition of “eligibility or continued
eligibility for credit,” a rule of construction for when a creditor
“obtains” medical information under the rule, and outright exceptions.
As stated above, Bank of America believes that this manner of providing
for obtaining and using medical information under circumstances deemed
permissible and appropriate, adds unnecessary complication to the rule.
However, we will comment separately on the individual exceptions as they
are proposed.
Definition of “Eligibility, or Continued Eligibility, for Credit”
Section ___.30(a)(2)(i)(B) of the Proposed Rule specifically excludes
“any determination of whether the provisions of a debt cancellation
contract, debt suspension agreement, credit insurance product, or
similar forbearance practices or programs are triggered.” While Bank of
America agrees that institutions should be permitted to use medical
information to make such determinations, we also believe that
institutions need to be able to obtain and use medical information when
determining eligibility or fulfillment of such products, programs or
practices. To limit the provision only to “triggering” events would fail
to adequately protect the use of medical information in connection with
other aspects of debt cancellation contracts or debt suspension
agreements that may affect the credit available to the consumer. This
exception should be expanded to cover the granting and administration of
debt cancellation contracts, debt suspension agreements, credit
insurance or similar forbearance practices or programs. In addition, we
would prefer to see this provision as an explicit exception in section
___.30(d) rather than a exclusion from the definition of “eligibility.”
We also believe that the Agencies should clarify in the final rule
that “similar forbearance practice or program” includes informal
forbearance practices by creditors. For example, consumers often request
that a creditor defer collecting on a loan because of a health
condition. Consumers would be disadvantaged if creditors could not take
this information into account in exercising discretion on whether to
provide additional credit or defer debt collection. Similarly,
administrative costs would increase, thereby increasing the cost of
credit to the consumer, if formal forbearance agreements would need to
be executed in all such situations.
Section __.30(a)(2)(i)(C) of the Proposed Rule excludes from the
definition of “eligibility, or continued eligibility, for credit”
“[a]uthorizing, processing, or documenting a payment or transaction on
behalf of the consumer in a manner that does not involve a determination
of the consumer’s eligibility, or continued eligibility, for credit.” We
understand that this exception is intended to include all aspects of the
authorization and approval process for individual credit card
transactions regardless of whether such authorization or approval would
involve over-limit transactions. In over-limit transactions, a credit
card issuer often cannot tell when the transaction is approved, or
whether the transaction will actually result in exceeding the consumer’s
credit limit. We believe that the final rule should clarify this point.
Rule of Construction for “Obtaining” Medical Information
Section __.30(b) of the Proposed Rule provides as a rule of
construction regarding a situation that will not be treated as covered.
As proposed, a creditor does not “obtain” medical information for
purposes of the prohibition on obtaining and using medical information
if the receipt of such information was unsolicited and the creditor
“does not use that information in determining whether to extend or
continue to extend credit to the consumer and the terms on which credit
is offered or continued.” For practical purposes, it may be difficult
for a creditor to demonstrate that it did not use the unsolicited
medical information. We believe that this section should be clarified to
place the burden of proof on the person who claims his or her
information was used in a determination to extend or continue to extend
credit
Exceptions
Section ___.30(d)(ii) permits obtaining and using medical information
“to comply with applicable requirements of local, state, or federal
laws.” Bank of America is concerned that this may not be sufficient to
permit obtaining and using (as well as disclosing) medical information
in connection with governmental (or quasi-governmental) programs such as
the Federal Housing Administration, Department of Veteran Affairs or
Government Sponsored Enterprise (such as Fannie Mae and Freddie Mac)
loan programs. These agencies operate special programs requiring the
creditor to obtain and use medical information in ways not necessarily
covered by other exceptions. In addition, these are often set out as
program requirements rather than as specific legal requirements.
Section ___.30(d)(vi) provides an exception for the consumer’s
consent to obtain and/or use specific medical information for a specific
purpose. The consent must be in writing and signed and must specify the
medical information and the particular use. Many creditors include a
section on their credit application for the consumer to describe special
circumstances that the creditor should consider in reviewing the
application. Often, the consumer may have experienced extenuating
circumstances that can explain a period of bad credit in an otherwise
good credit history. Often these special circumstances involve medical
information. We believe that this exception should be expanded to permit
a consumer to provide this information for the purpose of considering
the credit application. Since this section of an application is often
completed by the consumer, who may not understand exactly what they need
to say to trigger such an exception, we recommend that this exception be
loosened so that it is not dependent on use of specific language or
restrictions. The fact that the customer has supplied the information
together with the credit application should be sufficient to constitute
consent to use the information in connection with consideration of that
application.
Bank of America also believes that the Agencies should make it clear,
either through an exception or as part of the definition of “medical
information,” that coded medical information provided by the consumer
reporting agencies does not come within the meaning of the rule and is
not restricted as to use or sharing.
Sharing Medical Information with Affiliates
Bank of America believes that the exceptions proposed by the Agencies
in the Proposed Rule, that would permit financial institutions to
continue to share medical information with affiliates in the situations
specified, should be retained in the final rule. As mentioned above, the
Agencies’ ability to grant exceptions to this provision is limited to
the institutions over which they have respective jurisdiction. Thus,
some affiliates, such as insurance affiliates, may not be covered by the
exceptions and thus may not be able to provide medical information to
other affiliates, such as the banks.
Effective Date
The Agencies specifically requested comment on whether an effective
date of 90 days after the publication of the final rules is appropriate,
or whether a different effective date should be established. We believe
that the proposed effective date should remain the same, but that the
final rule should provide for a longer implementation period for full
compliance with the rule, in order to permit covered entities to
adequately assess their practices. The FACT Act provides that the
prohibition on obtaining and using medical information shall not take
effect until the implementing regulations become effective, or as
otherwise provided by regulation. It is important that the Agencies
synchronize the effective date for the prohibition on the using and
obtaining of medical information with the effective date of the
regulatory exceptions thereto.
Bank of America appreciates the opportunity to comment on the
Agency’s proposal. If you have any questions regarding our comments,
please contact Kathryn D. Kohler, Assistant General Counsel, at (704)
386-9644.
Very truly yours,
Kathryn D. Kohler
Assistant General Counsel
Bank of America
101 South Tryon Street
Charlotte, NC 28255
