Skip Header

Federal Deposit
Insurance Corporation

Each depositor insured to at least $250,000 per insured bank

Home > Regulation & Examinations > Laws & Regulations > FDIC Federal Register Citations

FDIC Federal Register Citations

American Bankers Association

June 1, 2004

Office of the Comptroller of the Currency
250 E Street, S.W.
Public Information Room
Mail Stop 1-5
Washington, D.C. 20219
Attention: Docket No. 04-09

Jennifer J. Johnson
Board of Governors of the Federal Reserve
20th Street and Constitution Avenue, N.W.
Washington, D.C. 20551
Attention: Docket No. R-1188

Robert E. Feldman
Executive Secretary
Attention: Comments
Federal Deposit Insurance Corporation
550 17th Street, N.W.
Washington, D.C. 20429
Re: RIN 3064-AC81

Regulation Comments
Chief Counsel’s Office
Office of Thrift Supervision
1700 G Street, N.W.
Washington, D.C. 20552
Attention: Docket No. 2004-16

Becky Baker
Secretary of the Board
National Credit Union Administration
1775 Duke Street
Alexandria, Virginia 22314-3428
Re: 12 CFR Part 717

Re: Fair and Accurate Credit Transactions Act
Obtaining or Using Medical Information
69 Federal Register 23380, April 28, 2004

Dear Sir or Madam:

The American Bankers Association (“ABA”) is responding to the requests for comment from the Board of Governors of the Federal Reserve System (“FRB”), the Federal Deposit Insurance Corporation (“FDIC”), the Office of the Comptroller of the Currency (“OCC”), the Office of Thrift Supervision (“OTS”), and the National Credit Union Administration (“NCUA”) (collectively, the “Agencies”) on their proposal implementing the medical privacy requirements of Section 411 of the Fair and Accurate Credit Transactions Act (the “FACT Act”).

The ABA brings together all categories of banking institutions to best represent the interests of this rapidly changing industry. Its membership which includes community, regional and money center banks and holding companies, as well as savings associations, trust companies and savings banks makes ABA the largest banking trade association in the country. Our members necessarily obtain and use medical information in the ordinary course of their businesses. Accordingly, this rulemaking is of great importance to them.

Section 411 of the FACT Act broadly prohibits “creditors” as defined in Section 702 of the Equal Opportunity Credit Act (“ECOA”)1 from obtaining or using medical information of consumers when making a determination of eligibility, or continued eligibility, for credit. ABA supports the proposal and commends the Agencies for their diligence in determining how bankers and other creditors obtain and use medical information in connection with lending determinations. ABA is concerned, however, that the proposal does not extend the exemptions from the prohibition on using or obtaining consumers’ medical information to the full range of “creditors” as defined in ECOA.


Section 411 does two things. First, it broadly prohibits “creditors” from (1) obtaining, or (2) using “medical information”2 when making initial or continuing evaluations of consumers’ eligibility for credit. Second, it restricts the sharing of medical information among affiliates. The term “medical information” is defined broadly to include payments for medical services. Absent an exception, creditors may not obtain or use medical information even if it involves debts to medical services providers or is provided voluntarily by consumers. The proposal:

• Sets forth the statutory prohibition;
• Clarifies instances when medical information may be obtained or used that are not part of the credit evaluation process;
• Establishes a rule of construction for receiving unsolicited medical information;
• Establishes a broad exception for obtaining or using financial medical information;
• Delineates several more specific exceptions permitting the use of medical information; and
• Implements the statutory restrictions on sharing medical information among affiliates.

Our specific comments follow.


Definition of “Medical Information”

The Agencies have used the statutory definition of “medical information” as the definition of that term in Subpart A of the proposal. ABA is aware that creditors, particularly those financing medical procedures or devices, may aggregate information about their customers who borrow for such purposes to analyze the risks involved with particular types of lending. In such cases the data does not identify any particular borrower. For example, a company may compile a database of information relating to the repayment behavior of thousands of consumers, none of whom is personally identifiable. If such compilations of information are deemed to involve “medical information,” creditors might have difficulty using the data even for basic analytical purposes that have no bearing on any individual. Accordingly, ABA requests that the Agencies expressly clarify that the term “medical information” relates or pertains only to a “specifically identifiable” consumer.

Definition of “Creditor”

As required by the statute, the Agencies have defined “creditor” as having the same meaning as in Section 702 of ECOA. ECOA defines a “creditor” as “any person who regularly extends, renews, or continues credit; any person who regularly arranges for the extension, renewal, or continuation of credit; or any assignee of an original creditor who participates in the decision to extend, renew, or continue credit.” However, the Agencies have limited the applicability of the exemptions only to those entities under their specific jurisdictions, rather than including entities not related to banking organizations that are normally under the jurisdiction of the Federal Trade Commission. Thus, as proposed, such nonbanking entities will be prohibited from legitimately using or obtaining medical information. ABA strongly believes this construction fails to comport with the statute.

Section 411 provides that “Except as permitted pursuant to . . . regulations prescribed under paragraph (5)(A), a creditor shall not obtain or use medical information pertaining to a consumer in connection with any determination of the consumer’s eligibility, or continued eligibility, for credit.” It further provides that “[e]ach Federal banking agency and the National Credit Union Administration shall . . . prescribe regulations that permit transactions under paragraph (2) that are determined to be necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs (and which shall include permitting actions necessary for administrative verification purposes), consistent with the intent of paragraph (2) to restrict the use of medical information for inappropriate purposes.

ABA believes the statutory language is plain on its face. Section 411 contains no restrictions that would limit the applicability of the exemptions to entities under the jurisdiction of the agencies that were given rulemaking authority. Neither is there any legislative history demonstrating such Congressional intent. The Agencies should not, without strong indication of such legislative intent, construe Section 411 to achieve the absurd result that an entire segment of creditors will be prohibited from obtaining or using medical information. Accordingly, the Agencies should replace the language of Proposed § ___ .1(b)(2) with the statement that “These regulations apply to creditors as defined in [Proposed § ___] .30(a)(2)(ii)(B).”

There is ample evidence that Congress often provides rulemaking authority to one or more agencies that lack enforcement authority over the parties covered by a rule.3 Indeed, the Fair Credit Reporting Act (“FCRA”), as amended by the FACT Act, contains numerous models ranging from rule writing authorities that are limited to those entities that are subject to the rule writing agency’s enforcement authority under the FCRA, to provisions that authorize a single agency to write rules that apply to entities regardless of the enforcement scheme specified in the FCRA or any other law.4 That Congress chose the latter model in Section 411 does not indicate that creditors under the jurisdiction of the FTC were intended to be excluded from the exemptions. The FTC has residual enforcement authority under Section 621 of the FCRA, so there would be no lack of enforcement if the Agencies extend the exemptions to all creditors.

Should the Agencies nonetheless conclude that the exceptions must be limited to the entities subject to their jurisdictions, ABA strongly believes that Proposed § ___ .1(b)(2) should be broadened to cover providers of medical products and services that arrange credit for or on behalf of financial institutions already covered by the exemptions. This result could be achieved by adding at the end of Proposed
§ ___ .1(b)(2), the phrase “, and any person arranging credit with these institutions.” These providers are an important link in the chain to providing consumers with financing for certain medical treatments, procedures and products because they are often in the best position to inform consumers of options that the consumers might not otherwise have known about.

If such providers were subject to the Section 411 prohibition, consumers with health insurance but without available funds could be denied access to medical products and services not covered by insurance (such as orthodontics). Even worse, consumers with limited or no health insurance and limited resources to afford medical treatment could be denied access to vital medical products and services (such as wheelchairs). Such a result would clearly have a disproportionate impact on low- and moderate-income consumers.

Alternatively, because such providers generally do not make the credit eligibility decisions, but merely arrange for the financing to occur, the Agencies could provide that such providers who assist with medical financing are not covered by the rule. As a practical matter, providers provide patients with applications for various plans to which the patients may apply, but do not review income or credit reports and do not advise the financial institution on the credit decision. This result could be achieved by adding a new subparagraph (E) to Proposed § ___ .30 as follows:

“Arranging for credit for financial institutions covered by section ___.1(b)(2) if the arranger does not participate in the credit decision of the financial institution other than by providing information to the consumer about the availability, nature, and terms of the credit being offered by the financial institution or by providing general administrative assistance to the consumer, including with respect to the submission of the application to the financial institution.”

Eligibility or Continued Eligibility for Credit

The proposal defines the term “eligibility, or continued eligibility, for credit” to mean “the consumer’s qualification or fitness to receive, or continue to receive, credit, including the terms on which credit is offered, primarily for personal, family, or household purposes.” The proposal excludes from that definition:

• Evaluations of consumers for employment, insurance products, or other non-credit products or services;
• Any determination of whether the provisions of a debt cancellation/ suspension agreement, credit insurance product, or similar forbearance practices or programs are triggered;
• Actions in connection with authorizing or processing consumers’ payments or transactions or account servicing that do not involve a credit determination; and
• Account maintenance or servicing that does not involve a credit determination.

ABA requests that the insurance/debt cancellation and forbearance circumstances in Proposed § ___ .30(a)(2)(B) be clarified to ensure that the definition extends to circumstances beyond the “triggering” event that involve obtaining or using medical information. For example, evaluations of a consumer’s medical condition may continue beyond the initial event, as in the case of a determination that the particular event is concluded or that a medical condition has been reactivated. ABA further requests
clarification that the term “forbearance practice or program” includes both formal and informal programs.

Proposed § ___ .30(a)(2)(C) would apply to “authorizing, processing, or documenting” credit card transactions. ABA requests that the Agencies clarify that this provision applies to all aspects of such transactions, including the imposition of overlimit fees.

Finally, the Agencies have asked for comment on whether should be the subject of an explicit exception. ABA supports a specific exception because we believe it would provide greater certainty to creditors concerning the legal authority for their actions.

Unsolicited Medical Information

Under the rule of construction in Proposed § ___ .30(b), a creditor would not violate the prohibition if, in connection with making a credit determination, the creditor:

• Receives but has not specifically requested medical information; and
• Does not use that information in making the credit determination.

ABA believes that in a legal challenge alleging a violation of this provision, a creditor would find it difficult at best to demonstrate that it did not use medical information in making the credit determination. Accordingly, the consumer should have the burden of proving that the medical information was actually used in the credit decision.

Again, ABA believes this provision should be crafted as an exception rather than a rule of construction to provide greater certainty to creditors concerning the legal authority for their actions.

Financial Information Exception

This exception would permit creditors to obtain and use medical information when making credit determinations so long as:

• The information relates to debts, expenses, income, benefits, collateral, or the purpose of the loan (including the use of the proceeds);
• The information is used in a manner no less favorable than comparable non-medical information would be used; and
• The creditor does not consider the consumer’s physical, mental, or behavioral health, condition or history, type of treatment, or prognosis when making the credit determination.

ABA supports this exception.

Specific Exemptions

In addition to the broad exception for obtaining and using financial medical information, the agencies have crafted exceptions to cover specific situations that they have been made aware of. As proposed, the specific exceptions cover:

Powers of attorney. It is permissible to use medical information to determine whether is it appropriate to use a power of attorney or legal representative (i.e., because the consumer is incapacitated).
Compliance with state/local laws. For example, some state laws require that creditors provide medical information to state agencies concerning possible financial abuses of consumers.
Credit reports. It is permissible to use medical information included in a credit report if it is used for the purpose for which the consumer provided specific written consent.
Fraud. It is permissible to use medical information for the purposes of fraud prevention and detection.
Medical products/services. It is permissible to determine and verify the medical purpose of a loan and the use of loan proceeds when the credit is to finance medical products or services.
Consumer requests. It is permissible to use medical information at the request of the consumer (or legal representative) if the request is in the form of a separate, written, signed request describing the specific medical information to be used for a specific purpose.

ABA supports these specific exemptions. We further believe than an additional exception is warranted in connection with programs for reimbursing the cost of health-related products or services that are eligible under flexible spending accounts. For example, we are aware of some programs in which the employer provides its employees with special credit cards that are to be used only for reimbursable expenses. In such cases, the persons administering the program on behalf of the employer must be able to review the credit card purchases to ensure that they are appropriate under the employer’s program.

Restrictions on Sharing Medical Information among Affiliates

With respect to sharing medical information, Section 411 eliminates the current exemption of the Fair Credit Reporting Act that permits sharing information with affiliates that is (1) transaction or experience information or (2) for which the customer has not opted out of sharing. The proposal incorporates the following statutory exceptions that permit sharing medical information:

• In connection with the business or insurance or annuities;
• For any purpose permitted without authorization under the Health Insurance Portability and Accountability Act or under the financial institutions exemption from that Act; or
• For any purpose described in Section 502(e) of the Gramm-Leach-Bliley-Act.

ABA supports this provision. However, we believe that for the sake of clarity, the Agencies should specify that purposes described in Section 502(e) are “necessary and appropriate to protect legitimate operational, transactional, risk, consumer and other needs.”

Effective Date

ABA believes that the effective date of the final rules should, at a minimum, be 90 days after the rule is issued and that in no case should the statutory prohibition go into effect prior to the effective date of the exemptions.

Christeena Naser, Senior Counsel
American Bankers Association
1120 Connecticut Avenue, NW
Washington, DC  20036

1  Section 702 of the ECOA defines as a “creditor” “any person who regularly extends, renews, or continues credit; any person who regularly arranges for the extension, renewal, or continuation of credit; or any assignee of an original creditor who participates in the decision to extend, renew, or continue credit.” 15 U.S.C. § 1691a(e).

2  “Medical information” is defined as information or data in any form or medium that is created by or derived from a health care provider or the consumer relating to the (1) past, present, or future physical, mental, or behavioral health or condition of an individual; (2) provision of health care to an individual; or (3) payment for health care services to an individual. Medical information does not include the consumer’s age, gender, residence or e-mail address, although other laws may restrict the use of such information.

3  The following statutes are but some examples of this split authority: Children’s On-Line Privacy Protection Act, CANSPAM Act, Electronic Funds Transfer Act, Equal Credit Opportunity Act, Expedited Funds Availability Act, Federal Reserve Act (reserve requirements), Home Mortgage Disclosure Act, Securities Exchange Act of 1934 (margin requirements), Truth in Lending Act, and Truth in Savings Act.

4  These FCRA rule writing authorizations can be categorized into two categories. The first category authorizes or requires multiple agencies to write rules that apply to the entities that fall under those agencies’ administrative enforcement jurisdiction in section 621 of the FCRA. See, i.e., Sections 615(e), 605(h), 623(e) and 628 and a note to Section 624. The second category authorizes or requires an agency or agencies to write rules that cover entities that are both within, and beyond, the agency’s or agencies’ administrative enforcement jurisdiction under the FCRA. See, i.e., Section 615(h).

Last Updated 06/01/2004

Skip Footer back to content