Fair Credit Reporting Medical Information Regulations, 33958-33996 [05-11356]

Agencies

• FEDERAL DEPOSIT INSURANCE CORPORATION
• FEDERAL RESERVE SYSTEM
• National Credit Union Administration
• Office of the Comptroller of the Currency
• DEPARTMENT OF THE TREASURY
• Office of Thrift Supervision
• Comptroller of the Currency

[Federal Register Volume 70, Number 111 (Friday, June 10, 2005)]
[Rules and Regulations]
[Pages 33958-33996]
From the Federal Register Online via the Government Printing Office [www.gpo.gov]
[FR Doc No: 05-11356]



[[Page 33957]]

-----------------------------------------------------------------------

Part IIDepartment of the Treasury



Office of the Comptroller of the Currency



12 CFR Part 41



Office of Thrift Supervision

12 CFR Part 571



Federal Reserve System-------------------------------------------------

12 CFR Parts 222 and 232



Federal Deposit Insurance Corporation----------------------------------

12 CFR Part 334



National Credit Union Administration-----------------------------------

12 CFR Part 717



-----------------------------------------------------------------------



Fair Credit Reporting Medical Information Regulations; Interim Final 
Rule

Federal Register / Vol. 70, No. 111 / Friday, June 10, 2005 / Rules 
and Regulations

[[Page 33958]]


-----------------------------------------------------------------------

DEPARTMENT OF THE TREASURY

Office of the Comptroller of the Currency

12 CFR Part 41

[Docket No. 05-10]
RIN 1557-AC85

FEDERAL RESERVE SYSTEM

12 CFR Parts 222 and 232

[Regulation V and FF; Docket No. R-1188]

FEDERAL DEPOSIT INSURANCE CORPORATION

12 CFR Part 334

RIN 3064-AC81

DEPARTMENT OF THE TREASURY

Office of Thrift Supervision

12 CFR Part 571

[No. 2005-16]
RIN 1550-AB88

NATIONAL CREDIT UNION ADMINISTRATION

12 CFR Part 717


Fair Credit Reporting Medical Information Regulations

AGENCIES: Office of the Comptroller of the Currency, Treasury (OCC); 
Board of Governors of the Federal Reserve System (Board); Federal 
Deposit Insurance Corporation (FDIC); Office of Thrift Supervision, 
Treasury (OTS); National Credit Union Administration (NCUA).

ACTION: Interim final rules; request for public comments.

-----------------------------------------------------------------------

SUMMARY: The OCC, Board, FDIC, OTS, and NCUA (Agencies) are publishing 
interim final rules to implement section 411 of the Fair and Accurate 
Credit Transactions Act of 2003 (FACT Act). The interim final rules 
create exceptions to the statute's general prohibition on creditors 
obtaining or using medical information pertaining to a consumer in 
connection with any determination of the consumer's eligibility, or 
continued eligibility, for credit for all creditors. The exceptions 
permit creditors to obtain or use medical information in connection 
with credit eligibility determinations where necessary and appropriate 
for legitimate purposes, consistent with the Congressional intent to 
restrict the use of medical information for inappropriate purposes. The 
interim final rules also create limited exceptions to permit affiliates 
to share medical information with each other without becoming consumer 
reporting agencies.

DATES: This interim final rule is effective March 7, 2006. Comments 
must be received by July 11, 2005.

ADDRESSES: Comments should be directed to:
    OCC: You should include OCC and Docket Number 05-10 in your 
comment. You may submit comments by any of the following methods:
     Federal eRulemaking Portal: https://www.regulations.gov. 
Follow the instructions for submitting comments.
     OCC Web Site: https://www.occ.treas.gov. Click on ``Contact 
the OCC,'' scroll down and click on ``Comments on proposed 
regulations.''
     E-mail Address: regs.comments@occ.treas.gov.
     Fax: (202) 874-4448.
     Mail: Office of the Comptroller of the Currency, 250 E 
Street, SW., Mail Stop 1-5, Washington, DC 20219.
     Hand Delivery/Courier: 250 E Street, SW., Attn: Public 
Information Room, Mail Stop 1-5, Washington, DC 20219.
    Instructions: All submissions received must include the agency name 
(OCC) and docket number or Regulatory Information Number (RIN) for this 
rulemaking. In general, OCC will enter all comments received into the 
docket without change, including any business or personal information 
that you provide. You may review comments and other related materials 
by any of the following methods:
     Viewing Comments Personally: You may personally inspect 
and photocopy comments at the OCC's Public Information Room, 250 E 
Street, SW., Washington, DC. You can make an appointment to inspect 
comments by calling (202) 874-5043.
     Viewing Comments Electronically: You may request e-mail or 
CD-ROM copies of comments that the OCC has received by contacting the 
OCC's Public Information Room at regs.comments@occ.treas.gov.
     Docket: You may also request available background 
documents and project summaries using the methods described above.
    Board: You may submit comments, identified by Docket No. R-1188, by 
any of the following methods:
     Agency Web Site: https://www.federalreserve.gov. Follow the 
instructions for submitting comments at https://www.federalreserve.gov/generalinfo/foia/ProposedRegs.cfm.
     Federal eRulemaking Portal: https://www.regulations.gov. 
Follow the instructions for submitting comments.
     E-mail: regs.comments@federalreserve.gov. Include docket 
number in the subject line of the message.
     Fax: 202/452-3819 or 202/452-3102.
     Mail: Jennifer J. Johnson, Secretary, Board of Governors 
of the Federal Reserve System, 20th Street and Constitution Avenue, 
NW., Washington, DC 20551.
    All public comments are available from the Board's Web site at 
https://www.federalreserve.gov/generalinfo/foia/ProposedRegs.cfm as 
submitted, except as necessary for technical reasons. Accordingly, your 
comments will not be edited to remove any identifying or contact 
information. Public comments may also be viewed electronically or in 
paper in Room MP-500 of the Board's Martin Building (20th and C 
Streets, NW.) between 9 a.m. and 5 p.m. on weekdays.
    FDIC: You may submit comments, identified by RIN number by any of 
the following methods:
     Agency Web Site: https://www.fdic.gov/regulations/laws/federal/propose.html. Follow instructions for submitting comments on 
the Agency Web Site.
     E-Mail: Comments@FDIC.gov. Include the RIN number in the 
subject line of the message.
     Mail: Robert E. Feldman, Executive Secretary, Attention: 
Comments, Federal Deposit Insurance Corporation, 550 17th Street, NW., 
Washington, DC 20429.
     Hand Delivery/Courier: Guard station at the rear of the 
550 17th Street Building (located on F Street) on business days between 
7 a.m. and 5 p.m.
     Instructions: All submissions received must include the 
agency name and RIN for this rulemaking. All comments received will be 
posted without change to https://www.fdic.gov/regulations/laws/federal/propose.html including any personal information provided.
    OTS: You may submit comments, identified by number 2005-16, by any 
of the following methods:
     Federal eRulemaking Portal: https://www.regulations.gov. 
Follow the instructions for submitting comments.
     E-mail Address: regs.comments@ots.treas.gov. Please 
include number 2005-16 in the subject line of the message and include 
your name and telephone number in the message.
     Fax: (202) 906-6518.
     Mail: Regulation Comments, Chief Counsel's Office, Office 
of Thrift

[[Page 33959]]

Supervision, 1700 G Street, NW., Washington, DC 20552, Attention: No. 
2005-16.
     Hand Delivery/Courier: Guard's Desk, East Lobby Entrance, 
1700 G Street, NW., from 9 a.m. to 4 p.m. on business days, Attention: 
Regulation Comments, Chief Counsel's Office, Attention: No. 2005-16.
    Instructions: All submissions received must include the agency name 
and docket number or Regulatory Information Number (RIN) for this 
rulemaking. All comments received will be posted without change to the 
OTS Internet Site at https://www.ots.treas.gov/pagehtml.cfm?catNumber=67&an=1, including any personal information 
provided.
    Docket: For access to the docket to read background documents or 
comments received, go to https://www.ots.treas.gov/pagehtml.cfm?catNumber=67&an=1. In addition, you may inspect comments 
at the Public Reading Room, 1700 G Street, NW., by appointment. To make 
an appointment for access, call (202) 906-5922, send an e-mail to 
public.info@ots.treas.gov">public.info@ots.treas.gov, or send a facsimile transmission to (202) 
906-7755. (Prior notice identifying the materials you will be 
requesting will assist us in serving you.) We schedule appointments on 
business days between 10 a.m. and 4 p.m. In most cases, appointments 
will be available the next business day following the date we receive a 
request.
    NCUA: You may submit comments by any of the following methods 
(Please send comments by one method only):
     Federal eRulemaking Portal: https://www.regulations.gov. 
Follow the instructions for submitting comments.
     NCUA Web Site: https://www.ncua.gov/RegulationsOpinionsLaws/proposed_regs/proposed_regs.html. Follow the 
instructions for submitting comments.
     E-mail: Address to regcomments@ncua.gov. Include ``[Your 
name] Comments on Interim Final Rule Part 717, Fair Credit Reporting--
Medical Information'' in the e-mail subject line.
     Fax: (703) 518-6319. Use the subject line described above 
for e-mail.
     Mail: Address to Mary Rupp, Secretary of the Board, 
National Credit Union Administration, 1775 Duke Street, Alexandria, 
Virginia 22314-3428.
     Hand Delivery/Courier: Address to Mary Rupp, Secretary of 
the Board, National Credit Union Administration. Deliver to guard 
station in the lobby of 1775 Duke Street, Alexandria, Virginia 22314-
3428, on business days between 8 a.m. and 5 p.m.
    All public comments are available on the agency's Web site at 
https://www.ncua.gov/RegulationsOpinionsLaws/comments as submitted, 
except as may not be possible for technical reasons. Public comments 
will not be edited to remove any identifying or contact information. 
Paper copies of comments may be inspected in NCUA's law library, at 
1775 Duke Street, Alexandria, Virginia 22314, by appointment weekdays 
between 9 a.m. and 3 p.m. To make an appointment, call (703) 518-6546 
or send an e-mail to OGCMail@ncua.gov.

FOR FURTHER INFORMATION CONTACT: OCC: Amy Friend, Assistant Chief 
Counsel, (202) 874-5200; Michael Bylsma, Director, or Stephen Van 
Meter, Assistant Director, Community and Consumer Law, (202) 874-5750; 
Patrick T. Tierney, Senior Attorney, Legislative and Regulatory 
Activities Division, (202) 874-5090; or Carol Turner, Compliance 
Specialist, Compliance Department, (202) 874-4858, Office of the 
Comptroller of the Currency, 250 E Street, SW., Washington, DC 20219.
    Board: David A. Stein, Counsel; Minh-Duc T. Le, Ky Tran-Trong, or 
Krista P. DeLargy, Senior Attorneys, Division of Consumer and Community 
Affairs, (202) 452-3667 or (202) 452-2412; or Andrew Miller, Counsel, 
Legal Division, (202) 452-3428, Board of Governors of the Federal 
Reserve System, 20th and C Streets, NW., Washington, DC 20551.
    FDIC: Richard M. Schwartz, Counsel, Legal Division, (202) 898-7424; 
David Lafleur, Policy Analyst, (202) 898-6569, or Patricia Cashman, 
Senior Policy Analyst, Division of Supervision and Consumer Protection, 
(202) 898-6534, Federal Deposit Insurance Corporation, 550 17th Street, 
NW., Washington, DC 20429.
    OTS: Elizabeth Baltierra, Program Analyst (Compliance), Compliance 
Policy, (202) 906-6540; Richard Bennett, Counsel, (202) 906-7409; 
Judith A. McCormick, Director, Consumer Protection and Specialty 
Programs, (202) 906-5636, Office of Thrift Supervision, 1700 G Street, 
NW., Washington, DC 20552.
    NCUA: Regina M. Metz, Staff Attorney, Office of General Counsel, 
(703) 518-6540, National Credit Union Administration, 1775 Duke Street, 
Alexandria, VA 22314-3428.

SUPPLEMENTARY INFORMATION:

I. Background

    The FACT Act became law on December 4, 2003. Pub. L. 108-159, 117 
Stat. 1952. In general, the FACT Act amends the Fair Credit Reporting 
Act (FCRA or Act) to enhance the ability of consumers to combat 
identity theft, increase the accuracy of consumer reports, and allow 
consumers to exercise greater control regarding the type and amount of 
marketing solicitations they receive. Section 411 of the FACT Act 
generally limits the ability of creditors to obtain or use medical 
information in connection with credit eligibility determinations, 
consumer reporting agencies to disclose medical information, and all 
persons to share medical information and other medical-related 
information with affiliates.
    Section 411(a) of the FACT Act adds a new section 604(g)(1) to the 
FCRA to restrict the circumstances under which consumer reporting 
agencies may furnish consumer reports that contain medical information 
about consumers. Under section 604(g)(1), a consumer reporting agency 
may not furnish a consumer report that contains medical information 
about a consumer unless:
    (1) The report is furnished in connection with an insurance 
transaction, and the consumer affirmatively consents to the furnishing 
of the report;
    (2) The report is furnished for employment purposes or in 
connection with a credit transaction, the information to be furnished 
is relevant to process or effect the employment or credit transaction, 
and the consumer provides specific written consent for the furnishing 
of the report that describes in clear and conspicuous language the use 
for which the information will be furnished; or
    (3) The information to be furnished pertains solely to 
transactions, accounts, or balances relating to debts arising from the 
receipt of medical services, products, or devices, where such 
information, other than account status or amounts, is restricted or 
reported using codes that do not identify, or do not provide 
information sufficient to infer, the specific provider or the nature of 
such services, products, or devices.
    Section 411(c) of the FACT Act revises the definition of ``medical 
information'' in section 603(i) to mean information or data, whether 
oral or recorded, in any form or medium, created by or derived from a 
health care provider or the consumer, that relates to the past, 
present, or future physical, mental, or behavioral health or condition 
of an individual, the provision of health care to an individual, or the 
payment for the provision of health care to an individual. The term 
``medical

[[Page 33960]]

information'' does not include the age or gender of a consumer, 
demographic information about the consumer, including a consumer's 
residence address or e-mail address, or any other information about a 
consumer that does not relate to the physical, mental, or behavioral 
health or condition of a consumer, including the existence or value of 
any insurance policy.
    Section 411(a) also amends the FCRA by adding new section 604(g)(2) 
to prohibit creditors from obtaining or using medical information 
pertaining to a consumer in connection with any determination of the 
consumer's eligibility, or continued eligibility, for credit. Section 
604(g)(2) contains two independent prohibitions--a prohibition on 
obtaining medical information and a prohibition on using medical 
information. The statute contains no prohibition, however, on creditors 
obtaining or using medical information other than in connection with a 
determination of the consumer's eligibility, or continued eligibility, 
for credit. For example, section 604(g)(2) does not prohibit a creditor 
from obtaining medical information in connection with employment 
purposes. Nevertheless, a creditor that obtains medical information in 
connection with employment purposes may not subsequently use that 
information in connection with any determination of the consumer's 
eligibility, or continued eligibility, for credit. Section 604(g)(5)(A) 
requires the Agencies to prescribe regulations that permit transactions 
that are determined to be necessary and appropriate to protect 
legitimate operational, transactional, risk, consumer, and other needs 
(including administrative verification purposes), consistent with 
Congressional intent to restrict the use of medical information for 
inappropriate purposes.
    Section 411(b) of the FACT Act adds a new section 603(d)(3) to the 
FCRA to restrict the sharing of medically related information with 
affiliates if that information meets the definition of ``consumer 
report'' in section 603(d)(1) of the FCRA. Specifically, section 
603(d)(3) provides that the standard exclusions from the definition of 
``consumer report'' contained in section 603(d)(2)--such as sharing 
transaction or experience information among affiliates or sharing other 
information among affiliates after notice and an opportunity to opt-
out--do not apply if medically related information is disclosed to an 
affiliate. Medically related information includes medical information, 
as described above, as well as an individualized list or description 
based on payment transactions for medical products or services, and an 
aggregate list of identified consumers based on payment transactions 
for medical products or services.
    Section 604(g)(3), however, provides several exceptions that allow 
institutions to share medically related information with affiliates in 
accordance with the standard exclusions that apply to the sharing of 
non-medically related information. These exceptions provide that an 
institution may share medically related information with an affiliate 
without having the communication categorically treated as a consumer 
report if the information is disclosed to an affiliate:
    (1) In connection with the business of insurance or annuities 
(including the activities described in section 18B of the model Privacy 
of Consumer Financial and Health Information Regulation issued by the 
National Association of Insurance Commissioners, as in effect on 
January 1, 2003);
    (2) For any purpose permitted without authorization under the 
Standards for Individually Identifiable Health Information promulgated 
by the Department of Health and Human Services (HHS) pursuant to the 
Health Insurance Portability and Accountability Act of 1996 (HIPAA);
    (3) For any purpose referred to under section 1179 of HIPAA;
    (4) For any purpose described in section 502(e) of the Gramm-Leach-
Bliley Act; or
    (5) As otherwise determined to be necessary and appropriate, by 
regulation or order, by the Federal Trade Commission (FTC), the 
Agencies, or an applicable State insurance authority.
    Section 604(g)(4), as added by section 411(a)(4) of the FACT Act, 
also provides that any person that receives medical information from an 
affiliate pursuant to an exception in section 604(g)(3) or from a 
consumer reporting agency under section 604(g)(1) must not disclose 
such information to any other person, except as necessary to carry out 
the purpose for which the information was initially disclosed, or as 
otherwise permitted by statute, regulation, or order.

II. Overview of Comments Received

    On April 28, 2004, the Agencies published a notice of proposed 
rulemaking in the Federal Register (69 FR 23380) to implement the 
provisions of section 411 of the FACT Act. The Agencies proposed to 
create exceptions to the general prohibition against creditors 
obtaining or using medical information in connection with credit 
eligibility determinations, as required by section 604(g)(5)(A), to 
permit transactions necessary and appropriate to protect legitimate 
operational, transactional, risk, consumer, and other needs (including 
administrative verification purposes), consistent with the intent of 
Congress to restrict the use of medical information for inappropriate 
purposes. In addition, the Agencies proposed to create additional 
exceptions to the special restrictions in section 603(d)(3) on sharing 
medically related information with affiliates, as permitted by section 
604(g)(3)(C).
    Each of the Agencies received up to 40 comment letters in response 
to the proposal, although many commenters sent copies of the same 
letter to more than one Agency. Comments were received from a variety 
of industry commenters, including banks, thrifts, credit unions, credit 
card companies, mortgage lenders and other non-bank creditors, and 
industry trade associations. Comments were also received from insurance 
companies and insurance industry trade associations. Other comments 
were received from consumer and community groups, privacy advocates, 
and health care associations. A comment letter was received from two 
Members of Congress, and another comment letter was received from the 
Federal Trade Commission.
    Most commenters supported the proposed rule. Commenters offered a 
number of suggested changes, with the most common suggestions 
including: broadening the scope of coverage to apply to all creditors; 
broadening the scope of coverage to apply to an individual's credit 
eligibility made in connection with business credit; clarifying the 
definition of ``medical information'; implementing the statute by 
relying primarily on interpretations of the statute rather than 
exceptions; addressing debt cancellation contracts, debt suspension 
agreements, and credit insurance products through an exception; and 
revising the language and scope of various exceptions to the general 
prohibition on obtaining and using medical information.
    The Agencies have modified the proposed rule in light of the 
comments received. These comments, and the Agencies' responses to the 
comments, are discussed in the following section-by-section analysis. 
As discussed below, the Agencies are adopting these rules as interim 
final rules so that interested parties may comment on the expanded 
scope of the exceptions for obtaining and using medical information in 
connection with credit eligibility determinations.

[[Page 33961]]

III. Section-by-Section Analysis

Section --.2 Examples

    Section --.2 of the proposal discussed the scope and effect of the 
examples included in the proposed rule. Commenters supported the 
provision regarding the scope and effect of examples. Section --.2 is 
therefore adopted as proposed.

Section --.3 Definitions

    Section --.3 of the proposal contained definitions for the terms 
``affiliate'' (as well as the related terms ``company'' and 
``control''), ``consumer,'' ``medical information,'' and ``you.'' The 
proposed definition of ``you'' has not been included in the interim 
final rule as unnecessary.\1\
---------------------------------------------------------------------------

    \1\ The OTS previously added a definition of ``you'' to Sec.  
571.3(o) in connection with its disposal rule. See 69 FR 77610, 
77621 (Dec. 28, 2004). That definition remains in the OTS's rule.
---------------------------------------------------------------------------

Affiliate

    Several FCRA provisions apply to information sharing with persons 
``related by common ownership or affiliated by corporate control,'' 
``related by common ownership or affiliated by common corporate 
control,'' or ``affiliated by common ownership or common corporate 
control.'' E.g., FCRA, sections 603(d)(2), 615(b)(2), and 624(b)(2). 
Each of these provisions was enacted as part of the 1996 amendments to 
the FCRA. Similarly, section 2 of the FACT Act defines the term 
``affiliate'' to mean persons that are related by common ownership or 
affiliated by corporate control.
    Under the proposal, the Agencies proposed to define ``affiliate'' 
to mean any company that controls, is controlled by, or is under common 
control with another company, which is identical to the definition of 
``affiliate'' in section 509 of the GLB Act and the GLB Act privacy 
regulations. The Agencies received very few comments on the definition 
of ``affiliate'' and none that suggested changes to the definition.
    In the interim final rules, the Agencies have revised the 
definition of ``affiliate'' to track more closely the definition 
contained in section 2 of the FACT Act. Section --.3(b) of the interim 
final rules defines ``affiliate'' to mean any company that is related 
by common ownership or common corporate control with another 
company.\2\
---------------------------------------------------------------------------

    \2\ For purposes of the regulation, an ``affiliate'' includes an 
operating subsidiary of a bank or savings association, and a credit 
union service organization that is controlled by a Federal credit 
union.
---------------------------------------------------------------------------

    The Agencies believe there is no substantive difference between the 
FACT Act definition of ``affiliate'' and the definition of 
``affiliate'' in section 509 of the GLB Act. The Agencies are not aware 
of any circumstances in which two entities would be affiliates for 
purposes of the FCRA but not for purposes of the GLB Act privacy rules, 
or vice versa. Furthermore, even though affiliated entities have had to 
comply with different formulations of the ``affiliate'' definition 
under the FCRA and the GLB Act since 1999, the Agencies are not aware 
of any compliance difficulties or disputes resulting from the two 
statutes using somewhat different wording to describe what constitutes 
an affiliate.
    Under the GLB Act privacy rules, the definition of ``control'' 
determines whether two or more entities meet the definition of 
``affiliate.'' \3\ The Agencies included the same definition of 
``control'' in the proposal. The Agencies received no comments on the 
proposed definition of ``control.'' Accordingly, the Agencies interpret 
the phrase ``related by common ownership or common corporate control'' 
as used in the FACT Act to have the same meaning as ``control'' in the 
GLB Act privacy rules. For example, if an individual owns 25 percent of 
two companies, the companies would be affiliates under both the GLB Act 
and FCRA definitions. However, the individual would not be considered 
an affiliate of the companies because the definition of ``affiliate'' 
is limited to companies.
---------------------------------------------------------------------------

    \3\ See 12 CFR 40.3(g), 216.3(g), 332.3(g), 573.3(g), and 
716.3(g).
---------------------------------------------------------------------------

    For purposes of clarity, the Agencies are revising the defined term 
from ``control'' (as in the proposal) to ``common ownership or common 
corporate control'' in order to track more closely the terminology used 
in the FACT Act.\4\ In addition, the Agencies believe that certain 
types of persons, for example, governments or governmental agencies or 
individuals are not subject to control, as that term is defined in the 
interim final rules, for purposes of defining an affiliate.
---------------------------------------------------------------------------

    \4\ For purposes of the regulation, NCUA presumes that a Federal 
credit union has a controlling influence over the management or 
policies of a credit union service organization if it is 67 percent 
owned by credit unions.
---------------------------------------------------------------------------

    The proposal also included a definition of ``company,'' which was 
defined to include any corporation, limited liability company, business 
trust, general or limited partnership, association, or similar 
organization. Omitted from the definition of ``company'' are some 
entities that are ``persons'' under the FCRA, including estates, 
cooperatives, and governments or governmental subdivisions or agencies, 
as well as individuals. The Agencies received no comments on the 
proposed definition of ``company,'' which is adopted as proposed.
    The interim final rule includes a definition of ``person'' to 
reflect that the definition of ``affiliate'' now refers to a ``person'' 
rather than to a ``company.'' The definition of ``person'' tracks the 
statutory definition and means any individual, partnership, 
corporation, trust, estate, cooperative, association, government or 
governmental subdivision or agency, or other entity.

Medical Information

    Under the proposed rule, paragraph (k) defined the term ``medical 
information'' to mean information or data, whether oral or recorded, in 
any form or medium, created by or derived from a health care provider 
or the consumer, that relates to (1) the past, present, or future 
physical, mental, or behavioral health or condition of an individual; 
(2) the provision of health care to an individual; or (3) the payment 
for the provision of health care to an individual. Proposed paragraph 
(k) also made clear that the term ``medical information'' did not 
include the age or gender of a consumer, demographic information about 
the consumer, including a consumer's residence address or e-mail 
address, or any other information about a consumer that does not relate 
to the physical, mental, or behavioral health or condition of a 
consumer, including the existence or value of any insurance policy. The 
definition in the proposal tracked the statutory definition of 
``medical information.''
    The Agencies requested comment on whether coded information 
furnished by a consumer reporting agency in accordance with section 
604(g)(1)(C) of the FCRA should be deemed to fall outside the 
definition of ``medical information.'' Industry commenters generally 
believed that coded information should be excluded from the definition 
of ``medical information'' because Congress, by requiring coding by 
consumer reporting agencies, determined the appropriate protection for 
this information. Privacy advocates, consumer and community groups, and 
health care associations urged the Agencies not to exclude coded 
information from the definition of ``medical information'' because they 
believed it would be an inappropriate narrowing of the statutory 
definition and would effectively remove such information from the anti-
discrimination protections of proposed Sec.  --.30(c) by allowing 
creditors to treat medical debts, if coded, differently than non-
medical debts. Based on the

[[Page 33962]]

comments received and an analysis of the terms and structure of the 
FACT Act, the Agencies have determined to treat coded information as 
``medical information'' for purposes of the Agencies'' rules. The 
statutory definition of ``medical information'' is quite broad. In 
addition, the wording of section 604(g)(1) indicates that ``medical 
information about a consumer'' includes both coded and uncoded 
information from a consumer report. How creditors may obtain and use 
this information is discussed below.
    A number of commenters asked the Agencies to clarify that ``medical 
information'' must relate or pertain to a specific consumer. Commenters 
requested this clarification to ensure that creditors can continue to 
use databases containing aggregate, non-personally identifiable 
information about consumers to analyze consumer behavior patterns 
without violating the restrictions on obtaining or using medical 
information. The FTC recommended that the Agencies clarify that 
information about collateral is not ``medical information'' because 
information about collateral does not pertain to an individual.
    The Agencies believe that the statutory definition of ``medical 
information'' applies only to information that is associated with a 
specific consumer because such information must relate to the condition 
``of an individual'' or the provision of health care or payment for the 
provision of health care ``to an individual.'' In the interim final 
rule, the Agencies have clarified that the term ``medical information'' 
does not include information that does not identify a specific 
consumer. Section --.3(k)(2)(iv) contains this clarification. The 
interim final rule does not categorically exclude information about 
collateral from the definition of medical information because the 
relationship between information about collateral and medical 
information about an individual may depend upon the facts and 
circumstances.
    One commenter asked the Agencies to clarify that information about 
the death of an individual is not medical information. The Agencies 
believe that the fact that a consumer is deceased generally is not 
``medical information.'' However, certain information associated with 
the death of a consumer, such as information about the medical 
condition that resulted in the consumer's death, may be medical 
information.
    Creditors are reminded that other laws, such as the Americans with 
Disabilities Act, the Fair Housing Act (FHA), the GLB Act, the Health 
Insurance Portability and Accountability Act (HIPAA), and other parts 
of the FCRA, may limit or regulate the use, collection, and sharing of 
consumer information, including medical information. These and other 
laws, such as the Equal Credit Opportunity Act (ECOA), also may 
prohibit creditors from using certain information that is excluded from 
the restrictions on obtaining or using medical information, such as age 
or gender information, in determining eligibility for credit or for 
other purposes. The exceptions created by this rule do not override or 
modify, or in any way limit the responsibility of creditors to comply 
with all applicable Federal and state fair lending laws. The OTS 
reminds creditors subject to its rules that they must comply with the 
requirements of the OTS's anti-discrimination rules when seeking to 
obtain and use medical information in reliance on the exceptions in 
this rule.\5\
---------------------------------------------------------------------------

    \5\ The OTS's anti-discrimination regulations are found at 12 
CFR part 528.
---------------------------------------------------------------------------

Section --.30 Obtaining or Using Medical Information in Connection With 
a Determination of Eligibility for Credit

    Section 411(a) of the FACT Act adds a new section 604(g)(2) to the 
FCRA, which contains a broad new limitation on the ability of creditors 
to either obtain or use medical information in connection with credit 
eligibility determinations.
A. Scope of Rules on Obtaining or Using Medical Information
    Section 604(g)(2) (as added by section 411 of the FACT Act) 
prohibits any ``creditor'' from obtaining or using ``medical 
information'' in connection with any determination of the consumer's 
eligibility, or continued eligibility, for credit.\6\ The definition of 
``medical information'' adopted in the FACT Act broadly includes 
information or data, whether oral or recorded, in any form or medium, 
created by or derived from a health care provider or a consumer that 
relates to the past, present, or future physical, mental, or behavioral 
health or condition of an individual, the provision of health care to 
an individual, or the payment for the provision of health care to an 
individual.\7\ The definition encompasses important financial 
information about consumers that is typically used in the credit 
underwriting process, such as information about the payment history and 
status of medical debts and the amount of a consumer's disability 
income.
---------------------------------------------------------------------------

    \6\ 15 U.S.C. 1681b(g)(2).
    \7\ Id. at Sec.  1681a(i). ``Medical information'' does not 
include the age or gender of a consumer, demographic information 
about the consumer, including a consumer's residence address or e-
mail address, or any other information about a consumer that does 
not relate to the physical, mental, or behavioral health or 
condition of a consumer, including the existence or value of any 
insurance policy. Id.
---------------------------------------------------------------------------

    Section 111 of the FACT Act added a definition of ``creditor'' to 
the FCRA that is also very broad and includes any person who regularly 
extends, renews, or continues credit, any person who regularly arranges 
for the extension, renewal, or continuation of credit, or any assignee 
of an original creditor who participates in the decision to extend, 
renew, or continue credit.\8\ A ``creditor'' includes depository 
institutions as well as entities that are neither depository 
institutions nor affiliates of depository institutions, such as 
independent finance companies, loan brokers, health care providers, and 
automobile dealers. Accordingly, section 604(g)(2) prohibits all 
creditors from obtaining or using key financial information that is 
also medical information in the credit underwriting process.
---------------------------------------------------------------------------

    \8\ The meaning of ``creditor'' in the FCRA has the same meaning 
as in the Equal Credit Opportunity Act (``ECOA''). Id. at Sec. Sec.  
1681a(r)(5) and 1691a(e).
---------------------------------------------------------------------------

    Section 604(g) does not contain any specific statutory exception to 
this broad prohibition. Instead, section 604(g)(5) directs the Agencies 
to prescribe regulations to permit ``transactions'' in which creditors 
obtain or use medical information that are ``necessary and appropriate 
to protect legitimate operational, transactional, risk, consumer, and 
other needs consistent with the intent of paragraph (2) to restrict the 
use of medical information for inappropriate purposes.'' \9\ Section 
604(g)(5) does not by its terms limit the scope of the creditors that 
may rely on exceptions granted by the Agencies.
---------------------------------------------------------------------------

    \9\ Id. at Sec.  1681b(g)(5)(A).
---------------------------------------------------------------------------

    Proposed Sec.  --.1(b)(2) identified the persons to which the rules 
relating to obtaining and using medical information in proposed 
Sec. Sec.  --.30(a)-(d) applied. As proposed, each Agency's rule and 
the exceptions created by those rules applied to creditors subject to 
the regulatory jurisdiction of the respective Agency. The most 
significant issue raised by commenters in connection with the proposal 
related to the classes of creditors to which the exceptions to the 
statutory prohibition in section 604(g)(2) would apply. Many commenters 
strongly urged the Agencies to make clear that the regulatory 
exceptions apply to all creditors that are subject to the statutory 
prohibition on

[[Page 33963]]

obtaining or using medical information, not just bank and thrift 
creditors and their affiliates and Federal credit unions. Many 
financial institution creditors indicated that, if the exceptions 
failed to apply to all creditors, the lending activities of financial 
institutions would be adversely affected because financial institutions 
often originate loans through, or purchase loans from, persons that are 
creditors for purposes of the FCRA but are not financial institutions. 
In particular, commenters noted that arrangers of credit (which are 
creditors for purposes of the FCRA) may include doctors and other 
health care providers that inform consumers of medical financing 
options and act as a liaison between the consumer and the creditor.
    Finally, commenters argued that, without clarification that the 
classes of creditors that could rely on the Agencies' regulatory 
exceptions were the same as the classes of creditors subject to the 
statutory prohibition, a significant number of creditors unaffiliated 
with banks, thrifts, or Federal credit unions would be in doubt about 
their ability to obtain and use excepted medical information in the 
same way and to the same extent as the Agencies' rules allow creditors 
that are banks, thrifts, Federal credit unions, or affiliates of those 
institutions to obtain and use the identical information. This result 
could reduce the availability of credit generally because of the 
breadth of the statute's definition of medical information. Two Members 
of Congress who sponsored section 411 of the FACT Act, submitted a 
comment letter supporting this view and indicating that it was their 
intention that the exceptions would apply to non-bank finance 
companies, state-chartered credit unions, and doctors, medical 
suppliers, and other medical professionals.
    The prohibition on creditors obtaining or using medical information 
in connection with credit eligibility determinations in section 
604(g)(2) applies to all creditors. As noted above, section 605(g)(5) 
does not, by its terms, limit the creditors that may rely on the 
exceptions granted by the Agencies. Moreover, that section, by its 
terms, applies to ``transactions'' for which the Agencies determine 
exceptions are necessary, not to ``creditors'' that the Agencies 
determine must be protected by the exceptions. Accordingly, the 
combined scope of the exceptions adopted pursuant to section 604(g)(5) 
in the interim final rules is as broad as the prohibition to which it 
applies, and is available to all creditors.
    The final action is comprised of six rules. The applicability of 
the section of each Agency's rule addressing the prohibition on and 
exceptions for creditors obtaining or using medical information in 
connection with credit eligibility determinations is set forth in Sec.  
--.30(a) and covers transactions in which certain enumerated entities 
participate as creditors. Under Sec.  --.30(a)(2), other entities that 
participate as creditors in transactions in which an enumerated entity 
also participates as a creditor are also subject to that Agency's rule.
    In addition, a separate rule, codified in part 232 of the Board's 
chapter of the Code of Federal Regulations (hereafter ``separate 
rule''), affords the exceptions to the prohibition against obtaining 
and using medical information for credit eligibility determinations 
generally to all creditors, except for creditors that are subject to 
one of the other Agencies' rules. This combination of rules establishes 
uniform coverage and exceptions for transactions involving any creditor 
that is subject to the prohibition on obtaining or using medical 
information in section 411. The separate rule has been located in the 
Board's chapter of the Code of Federal Regulations as a matter of 
convenience because many creditors are accustomed to looking to the 
Board's regulations implementing other statutes, such as the Truth-in-
Lending Act and the Equal Credit Opportunity Act.
    The Agencies believe it is important that rules prescribing 
exceptions to the prohibitions from obtaining or using medical 
information in connection with credit eligibility determinations be 
consistent. Thus, in developing the proposed and interim final rules, 
the Agencies have consulted and coordinated with each other to 
establish identical rules. The Agencies will consult and coordinate 
with each other regarding any amendments to the rules for the purpose 
of assuring, to the extent possible, that the regulations prescribed by 
each Agency remain consistent and comparable with the regulations 
prescribed by the other Agencies.
    These rules are being adopted on an interim final basis with a 
delayed effective date. While a number of commenters urged 
clarification of the scope of the availability of the exceptions, the 
Agencies are concerned that uncertainty about this matter may have led 
creditors that believed they could not avail themselves of the 
exceptions not to comment on the appropriateness and details of the 
exceptions.
B. General Prohibition on Obtaining or Using Medical Information
    Proposed paragraph (a)(1) incorporated the statute's general rule 
prohibiting creditors from obtaining or using medical information 
pertaining to a consumer in connection with any determination of a 
consumer's eligibility, or continued eligibility, for credit, except as 
provided in the regulations under subpart D. The supplementary 
information to the proposal noted the consumer's eligibility for credit 
typically would be determined when an initial decision is made on 
whether to grant or deny credit to the consumer, but could also include 
decisions whether to terminate an account or adjust a credit limit 
following an account review. The Agencies received no comments on this 
restatement of the statutory prohibition in the proposal. Renumbered 
paragraph (b)(1) in each Agency's rule and Sec.  --.1(b) of the 
separate rule contain this provision, which is adopted as proposed.
    Proposed paragraph (a)(2) clarified the meaning of certain terms 
used in the statutory prohibition and the proposed rule, including 
``eligibility, or continued eligibility, for credit,'' ``credit,'' and 
``creditor.'' Commenters had no comments on the definitions of 
``credit'' and ``creditor,'' which tracked the FACT Act's definition of 
those terms. In the interim final rule, renumbered paragraphs (b)(2)(i) 
and (ii) of each Agency's rule and Sec. --.1(c)(2) and (3) of the 
separate rule contain the definitions of ``credit'' and ``creditor,'' 
which are adopted as proposed.
    The proposed rule interpreted the phrase ``eligibility, or 
continued eligibility, for credit'' to mean the consumer's 
qualification or fitness to receive, or continue to receive, credit, 
including the terms on which credit is offered, primarily for personal, 
family, or household purposes. The proposal further clarified that the 
phrase ``eligibility, or continued eligibility, for credit'' did not 
include the following: (1) The consumer's qualification or fitness to 
be offered employment, insurance products, or other non-credit products 
or services; (2) a determination of whether the provisions of a debt 
cancellation contract, debt suspension agreement, credit insurance 
product, or similar forbearance practice or program are triggered; (3) 
authorizing, processing, or documenting a payment or transaction on 
behalf of a consumer in a manner that does not involve a determination 
of the consumer's eligibility, or continued eligibility, for credit; or 
(4) maintaining or servicing a

[[Page 33964]]

consumer's account in a manner that does not involve a determination of 
the consumer's eligibility, or continued eligibility, for credit.
    Commenters offered a substantial number of suggestions regarding 
the meaning of ``eligibility, or continued eligibility, for credit.'' 
Industry commenters supported limiting the term to credit primarily for 
personal, family, or household purposes consistent with the traditional 
scope of the FCRA. Privacy advocates, consumer and community groups, 
and health care associations, on the other hand, objected to the 
exclusion of business credit from the general prohibition on obtaining 
or using medical information. These commenters argued that the proposed 
limitation to consumer credit conflicted with the FCRA definitions of 
``credit'' and ``creditor,'' which incorporate the ECOA definitions of 
those terms. Moreover, these commenters noted that Congress initially 
used the Truth in Lending Act (TILA) definitions of ``credit'' and 
``creditor'' in the draft FACT Act legislation, but subsequently 
adopted the ECOA definitions of those terms. ECOA applies to business 
purpose credit, whereas TILA does not.
    The Federal banking agencies (OCC, Board, FDIC, and OTS) have 
previously taken the position that a creditor has a permissible purpose 
to obtain a consumer report on a consumer in connection with a business 
credit transaction under section 604(a)(3)(A) of the FCRA if the 
consumer is or will be personally liable on the loan, such as in the 
case of a guarantor, co-signer, or, in most instances, an individual 
proprietor. An informal FTC staff opinion letter concurred with the 
banking agencies' position. See Letter from Joel Winston to Julie L. 
Williams, J. Virgil Mattingly, William F. Kroener, III, and Carolyn 
Buck, June 22, 2001. A copy of this letter is available from the FTC's 
Internet Web site at https://www.ftc.gov/os/statutes/fcra/tatelbaum2.htm. To ensure consistency with the prior interpretation, 
the Agencies are deleting the phrase ``primarily for personal, family, 
or household purposes'' from the definition of ``eligibility, or 
continued eligibility, for credit.'' In order for the prohibition in 
section 604(g)(3) to apply, a creditor must obtain or use medical 
information about a consumer in connection with a determination of a 
consumer's eligibility, or continued eligibility, for credit. 
Accordingly, the general prohibition would apply to business credit if 
a consumer would be personally liable for repayment of a business loan.
    Commenters also pointed to an ambiguity in the proposal: proposed 
paragraph (a)(2)(i)(A) referred to insurance products while proposed 
paragraph (a)(2)(i)(B) referred to credit insurance products. To 
eliminate this ambiguity, the interim final rule has been revised so 
that renumbered paragraph (b)(2)(iii)(A) of each Agency's rule and 
section --.1(c)(4)(i) of the separate rule applies to insurance 
products other than credit insurance products. Additional, non-
substantive changes have been made to these paragraphs for clarity.
    Commenters made a number of suggestions regarding debt cancellation 
contracts, debt suspension agreements, and credit insurance products, 
which were addressed in proposed paragraph (a)(2)(i)(B). Most 
commenters believed that these contracts, agreements, and products 
should be addressed through an exception, rather than through an 
interpretation. In the interim final rule, debt cancellation contracts, 
debt suspension agreements, and credit insurance products are addressed 
in two new exceptions, which are discussed below.
    Forbearance practices or programs were also addressed in proposed 
paragraph (a)(2)(i)(B). Most commenters believed that forbearance 
practices and programs should be addressed through an exception, rather 
than through an interpretation. In the interim final rule, forbearance 
practices or programs are addressed in a new exception, which is 
discussed below.
    Under the proposal, the term ``eligibility, or continued 
eligibility, for credit'' did not include authorizing, processing, or 
documenting a payment or transaction on behalf of a consumer in a 
manner that does not involve a determination of the consumer's 
eligibility, or continued eligibility, for credit. The interim final 
rule retains this interpretation in paragraph (b)(2)(iii)(B). See also 
section --.1(c)(4)(ii) of the separate rule. A few commenters asked the 
Agencies to clarify that over limit transactions or fees and the use of 
transaction codes fall within this interpretation. Typically, the 
routine processing of over limit transactions or the imposition of over 
limit fees would not involve a determination of the consumer's 
eligibility, or continued eligibility, for credit. If, however, a 
creditor has medical information about the consumer and uses that 
information to determine whether or not to raise the consumer's credit 
limit, such use must fall within an exception in Sec. Sec. --.30(d) or 
(e) of each Agency's rule or Sec. Sec. --.3 or --.4 of the separate 
rule to be permissible. Similarly, the use of transaction codes that 
identify payments to merchants of medical products or services 
typically would not involve a determination of the consumer's 
eligibility, or continued eligibility, for credit, unless the creditor 
uses the medically related codes to make a judgment about whether, and 
on what terms, to extend credit to the consumer.
    Under the proposal, the term ``eligibility, or continued 
eligibility, for credit'' did not include maintaining or servicing a 
consumer's account in a manner that does not involve a determination of 
the consumer's eligibility, or continued eligibility, for credit. The 
interim final rule retains this interpretation in paragraph 
(b)(2)(iii)(C) of each Agency's rule. See also section --.1(c)(4)(iii) 
of the separate rule.
    The FTC recommended adding a number of additional interpretations 
and deleting or revising references suggesting that the proposed 
interpretations and rule of construction were not statutory 
interpretations. In the interim final rule, the Agencies have deleted 
references that may have suggested that the interpretations are not 
interpretations of the statute. Most of the additional interpretations 
recommended by the FTC are addressed elsewhere in this preamble.
    One FTC suggestion not addressed elsewhere is the recommendation to 
interpret the statute to permit doctors and other providers of medical 
goods and services to extend credit to consumers where the credit is 
incidental to the provision of medical goods or services. The Agencies 
agree that providers of medical goods and services ordinarily would 
obtain medical information pertaining to a consumer in connection with 
rendering medical care, and not in connection with credit eligibility 
decisions. Moreover, if a provider did not use that medical information 
in connection with determining the consumer's eligibility to receive 
credit, then the provider clearly would not violate the prohibition. 
For example, a doctor who treats a patient before billing the patient 
for her services, without considering the patient's payment history or 
other medical information relating to the patient, would not have 
obtained and used medical information in connection with an eligibility 
determination for credit.
    As discussed above, the definition of medical information is very 
broad and includes not only the health or condition of an individual, 
but information relating to the payment for the provision of health 
care. See section 603(i) of the FCRA (15 U.S.C. 1681a(i)). If a 
provider uses medical information,

[[Page 33965]]

such as a consumer's history of not paying medical bills promptly, in 
determining whether and on what terms to extend credit to the consumer, 
then the provider, as a creditor, has used medical information in 
connection with a credit eligibility determination in contravention of 
the general prohibition. Thus, the Agencies conclude that an 
interpretation that excludes incidental credit from the statutory 
prohibition is not supported by the statute because medical service 
providers that extend incidental credit may, in some instances, use 
medical information to determine the consumer's eligibility for such 
credit.
C. Receiving Unsolicited Medical Information and Coded and Uncoded 
Information from a Consumer Reporting Agency
    Section --.30(b) of the proposal contained a rule of construction 
regarding the receipt of unsolicited medical information in recognition 
of the fact that creditors may receive medical information without 
specifically asking for it. A creditor may receive unsolicited medical 
information, for example, when a consumer informs the loan officer that 
she needs a loan to pay for treatment for a particular medical 
condition, or when a consumer, in response to a general request on a 
credit application for information about outstanding debts, lists debts 
owed to hospitals and doctors for medical services. The Agencies 
proposed a rule of construction to make clear that a creditor would not 
violate the prohibition on obtaining medical information if the 
creditor received medical information without specifically asking for 
or requesting such information and did not use it.
    Commenters generally supported the rule of construction for 
unsolicited medical information. Industry commenters generally favored 
a rule of construction over an exception.
    In addition, the Agencies solicited comment on how to treat 
information in consumer reports containing information described in 
section 604(g)(1) of the FCRA. The Agencies solicited comment on three 
options for allowing creditors to obtain and use coded information 
contained in a consumer report pursuant to section 604(g)(1)(C). One 
approach was to interpret ``medical information'' to exclude coded 
information that may be furnished under section 604(g)(1)(C) of the 
Act. Another approach was to interpret the prohibition on obtaining or 
using medical information in section 604(g)(2) as qualified by the 
provisions in section 604(g)(1) that authorize consumer reporting 
agencies to furnish consumer reports containing medical information 
under certain circumstances. A final approach was to require creditors 
that intend to obtain and use coded medical information in connection 
with credit eligibility determinations to do so in accordance with the 
financial information exception in proposed Sec. --.30(c).
    Industry commenters generally believed that coded information 
should be excluded from the definition of ``medical information.'' 
Privacy advocates, consumer and community groups, and health care 
associations, on the other hand, maintained that coded information fell 
within the definition of ``medical information'' and opposed the 
creation of a separate consumer report exception as in proposed 
paragraph (d)(1)(iii). These commenters believed that the other 
proposed exceptions were sufficient to protect legitimate uses of both 
coded and uncoded medical information obtained from a consumer report. 
The FTC urged the Agencies to interpret the general prohibition on 
creditors obtaining and using medical information in section 604(g)(2) 
as qualified by the provisions in section 604(g)(1) applicable to 
consumer reporting agencies that furnish consumer reports containing 
medical information.
    As noted above, the Agencies interpret coded information provided 
pursuant to section 604(g)(1)(C) as meeting the broad statutory 
definition of ``medical information.'' Under the interim final rules, a 
creditor that receives medical information from a consumer reporting 
agency, whether coded or uncoded, without specifically requesting that 
information does not obtain medical information in violation of the 
prohibition. Such information, however, may be used only in accordance 
with the exceptions contained in renumbered paragraphs 30(d) or (e) of 
each Agency's rule or Sec. Sec. --.3 or --.4 of the separate rule.
    The proposal also included a separate exception for uncoded medical 
information furnished by a consumer reporting agency in a consumer 
report pursuant to section 604(g)(1)(B) in proposed paragraph 
(d)(1)(iii). The proposed exception has been omitted from the interim 
final rule as unnecessary. Commenters generally did not support this 
exception. A number of these commenters believed that the other 
exceptions were sufficient and that no separate exception should be 
created for consumer reports. The FTC urged the Agencies to treat coded 
and uncoded medical information furnished by consumer reporting 
agencies the same by interpreting the general statutory prohibition as 
inapplicable to such information.
    The Agencies believe that the exceptions in renumbered paragraphs 
(d) and (e) of each Agency's rule and in Sec. Sec. --.3 and --.4 of the 
separate rule provide creditors sufficient flexibility with respect to 
the use of medical information contained in consumer reports. The rule 
of construction for unsolicited medical information adequately protects 
creditors that receive coded or uncoded medical information in consumer 
reports furnished by consumer reporting agencies without specifically 
requesting medical information. If, however, a creditor specifically 
requests medical information from a consumer reporting agency in 
connection with a credit eligibility determination, the creditor must 
meet one of the exceptions in renumbered paragraphs (d) and (e) of each 
Agency's rule or Sec. Sec. --.3 and --.4 of the separate rule in order 
to obtain and use that information.
    Renumbered paragraph (c) of the interim final rule adopts the rule 
of construction for unsolicited medical information with certain 
revisions. Section --.2 of the separate rule contains the identical 
provision. The interim final rule provides that a creditor does not 
obtain medical information in violation of the prohibition if it 
receives such information from a consumer, a consumer reporting agency, 
or any other person in connection with any determination of the 
consumer's eligibility, or continued eligibility, for credit without 
specifically requesting medical information. The rule of construction 
is retained as an interpretation, rather than as an exception because 
it interprets the statutory language regarding when a creditor 
``obtains'' medical information in violation of the prohibition.
    The introductory language to the rule of construction has been 
revised for clarity to provide that a creditor does not obtain medical 
information ``in violation of the prohibition'' if it meets the 
specified criteria. In addition, the cross-reference to the general 
prohibition has been deleted because the rule of construction is an 
interpretation of the statute.
    Proposed paragraph (b)(1)(ii), which prohibited the use of 
unsolicited medical information, has been deleted because the rule of 
construction focuses on when a creditor does not obtain medical 
information in violation of the statute. The Agencies believe that 
incorporating a use limitation in the rule of construction would be

[[Page 33966]]

inconsistent with the exceptions in renumbered paragraphs (d) and (e). 
Instead, the Agencies have added a new paragraph (c)(2) to clarify that 
a creditor that receives unsolicited medical information may use that 
information in connection with any determination of the consumer's 
eligibility, or continued eligibility, for credit only to the extent 
the creditor can rely on one of the exceptions in renumbered paragraphs 
(d) or (e).
    The examples of the rule of construction have been moved to 
renumbered paragraph (c)(3) in the interim final rules and all 
references to restrictions on the use of unsolicited medical 
information have been deleted from the examples consistent with the 
changes discussed above. In addition, paragraph (c)(3)(iii) adds a new 
example to illustrate how the rule of construction applies to medical 
information furnished by a consumer reporting agency.
    Commenters had several other comments concerning the rule of 
construction. Privacy advocates, consumer and community groups, and 
health care associations suggested that the Agencies clarify that the 
phrase ``without specifically requesting medical information'' means 
information obtained voluntarily without any pressure, prompting, or 
direct or indirect solicitation by the creditor. These commenters also 
sought an additional requirement that creditors destroy unsolicited 
medical information as soon as reasonably practicable and suggested 
making the rule of construction an exception. Some industry commenters 
suggested that consumers should have the burden of proving that 
unsolicited medical information was used in a credit eligibility 
determination because it may be difficult for creditors to prove that 
unsolicited medical information was not used. Some industry commenters 
suggested permitting a creditor to use unsolicited medical information 
in a manner no less favorably than it would use comparable medical 
information.
    The statute does not specifically address the burden of proof to be 
applied when disputes arise regarding the use of medical information. 
The Agencies find it unnecessary to address this issue because the 
interim final rule allows unsolicited medical information to be used as 
permitted by the exceptions in renumbered paragraphs (d) and (e). The 
Agencies thus decline to impose on consumers the burden of proving that 
unsolic