Skip to main content
U.S. flag
An official website of the United States government
Dot gov
The .gov means it’s official. 
Federal government websites often end in .gov or .mil. Before sharing sensitive information, make sure you’re on a federal government site.
Https
The site is secure. 
The https:// ensures that you are connecting to the official website and that any information you provide is encrypted and transmitted securely.
Federal Register Publications

FDIC Federal Register Citations



Home > Regulation & Examinations > Laws & Regulations > FDIC Federal Register Citations




FDIC Federal Register Citations

Bank of America

May 28, 2004

Robert E. Feldman
Executive Secretary
Federal Deposit Insurance Corporation
550 17th Street, NW
Washington, DC 20429
Attention: RIN No. 3064-AC81

Public Information Room
Office of the Comptroller of the Currency
250 E Street, SW
Mail Stop 1-5
Washington, DC 20219
Attention: Docket No. 04-09

Jennifer J. Johnson
Secretary
Board of Governors of the Federal
Reserve System
20th Street and Constitution Avenue, NW
Washington, DC 20551
Attention: Docket No. R-1188

Re: Fair Credit Reporting Medical Information Regulations

Ladies and Gentlemen:

Bank of America Corporation (“Bank of America”) welcomes the opportunity to comment on the Notice and Request for Comment issued by the Federal Deposit Insurance Corporation (“FDIC”), Federal Reserve Board (“Board”), Office of the Comptroller of the Currency (“OCC”), Office of Thrift Supervision (“OTS”) and the National Credit Union Administration (“NCUA”) (collectively, the “Agencies”) regarding the notice of proposed rulemaking (“Proposed Rule”) for the medical privacy regulations under the Fair and Accurate Credit Transactions Act of 2003 (“FACT Act”). Bank of America is one of the world's largest financial institutions, serving individual consumers, small businesses and large corporations with a full range of banking, investing, asset management and other financial and risk-management products and services. The company provides unmatched convenience in the United States, serving 33 million consumer relationships with 5,700 retail banking offices, more than 16,000 ATMs and award-winning online banking with more than ten million active users.

Bank of America supports the Agencies in their effort to create regulations containing exemptions for obtaining, using and sharing medical information to allow institutions and lenders to continue to serve their customers while protecting against the concerns of using such sensitive information in inappropriate ways. At the same time, however, we are concerned that the scope of the Proposed Rule is too narrow and will negatively impact the availability of credit in the United States through creating an imbalance among various participants in the secondary market for financial products. In addition, we believe that the Proposed Rule permitting obtaining and using medical information in certain circumstances through a combination of definitions, rules of construction and outright exceptions is overly complex and could be simplified. We also have some concerns that the rules should be further clarified and in some situations expanded to ensure that legitimate and appropriate activities involving the receipt and use of medical information, in many cases for the purpose of directly benefiting borrowers, will continue to be permitted.

Scope

The prohibition on creditors obtaining and using medical information contained in Section 604(g)(5)(A) of the FCRA, as added by section 411(a) of the FACT Act is not limited in its applicability to certain entities subject to the jurisdiction of the Agencies. It covers all “creditors” as defined by the Equal Credit Opportunity Act (“ECOA”), including persons arranging credit, and certain assignees of a loan, as well as the actual creditor. In addition, it includes creditors generally subject to the jurisdiction of the Federal Trade Commission. If the exceptions set forth in the Proposed Rule are only available to the limited group of creditors subject to the usual jurisdiction of the Agencies, there will be many types of creditors that will not be able to obtain and use medical information under the same types of circumstances that the Agencies have identified as being “necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs.”1 This would include creditors that arrange credit and sell it to national banks and other institutions covered by the Proposed Rule, such as state-licensed lenders, mortgage brokers, auto dealers and medical care providers. If those creditors are not permitted to obtain medical information in the situations set forth in the Proposed Rule, the banks will also not be able to receive such information and will not be able to make informed purchase decisions about such loans. This will result in consumers having less credit available or making it more expensive. Moreover, the underlying products delivered by these parties may in some cases be securitized or otherwise sold to investors via the secondary market. If a class of assets is created under the Proposed Rule which is perceived to be of lesser credit quality, the marketability of these securities may be impaired.

In addition, section 604(g)(5)(A), which sets forth the rule and the Agencies’ direction to prescribe regulations setting forth exceptions, does not limit the applicability of the exceptions promulgated in such regulations to the types of entities over which the Agencies have general regulatory authority. If Congress had intended such a limitation, it could have clearly articulated that restriction. In fact, in section 604(g)(3)(C), which addresses the sharing of medical information among affiliates, Congress specifically limited the exception-making authority of the Agencies to those entities over which they had jurisdiction. Thus, the statute does not restrict the Agencies’ authority to grant exceptions that have broader applicability than the institutions they directly regulate and such a limitation is inconsistent with the direction of Congress that the Agencies must specify appropriate exceptions. Bank of America strongly urges the Agencies to remove the restriction on the applicability of the Proposed Rule.

Exceptions from Coverage

The Proposed Rule uses several means to grant exceptions to permit creditors to obtain and use medical information. These include excluding certain activities from the definition of “eligibility or continued eligibility for credit,” a rule of construction for when a creditor “obtains” medical information under the rule, and outright exceptions. As stated above, Bank of America believes that this manner of providing for obtaining and using medical information under circumstances deemed permissible and appropriate, adds unnecessary complication to the rule. However, we will comment separately on the individual exceptions as they are proposed.

Definition of “Eligibility, or Continued Eligibility, for Credit”

Section ___.30(a)(2)(i)(B) of the Proposed Rule specifically excludes “any determination of whether the provisions of a debt cancellation contract, debt suspension agreement, credit insurance product, or similar forbearance practices or programs are triggered.” While Bank of America agrees that institutions should be permitted to use medical information to make such determinations, we also believe that institutions need to be able to obtain and use medical information when determining eligibility or fulfillment of such products, programs or practices. To limit the provision only to “triggering” events would fail to adequately protect the use of medical information in connection with other aspects of debt cancellation contracts or debt suspension agreements that may affect the credit available to the consumer. This exception should be expanded to cover the granting and administration of debt cancellation contracts, debt suspension agreements, credit insurance or similar forbearance practices or programs. In addition, we would prefer to see this provision as an explicit exception in section ___.30(d) rather than a exclusion from the definition of “eligibility.”

We also believe that the Agencies should clarify in the final rule that “similar forbearance practice or program” includes informal forbearance practices by creditors. For example, consumers often request that a creditor defer collecting on a loan because of a health condition. Consumers would be disadvantaged if creditors could not take this information into account in exercising discretion on whether to provide additional credit or defer debt collection. Similarly, administrative costs would increase, thereby increasing the cost of credit to the consumer, if formal forbearance agreements would need to be executed in all such situations.

Section __.30(a)(2)(i)(C) of the Proposed Rule excludes from the definition of “eligibility, or continued eligibility, for credit” “[a]uthorizing, processing, or documenting a payment or transaction on behalf of the consumer in a manner that does not involve a determination of the consumer’s eligibility, or continued eligibility, for credit.” We understand that this exception is intended to include all aspects of the authorization and approval process for individual credit card transactions regardless of whether such authorization or approval would involve over-limit transactions. In over-limit transactions, a credit card issuer often cannot tell when the transaction is approved, or whether the transaction will actually result in exceeding the consumer’s credit limit. We believe that the final rule should clarify this point.

Rule of Construction for “Obtaining” Medical Information

Section __.30(b) of the Proposed Rule provides as a rule of construction regarding a situation that will not be treated as covered. As proposed, a creditor does not “obtain” medical information for purposes of the prohibition on obtaining and using medical information if the receipt of such information was unsolicited and the creditor “does not use that information in determining whether to extend or continue to extend credit to the consumer and the terms on which credit is offered or continued.” For practical purposes, it may be difficult for a creditor to demonstrate that it did not use the unsolicited medical information. We believe that this section should be clarified to place the burden of proof on the person who claims his or her information was used in a determination to extend or continue to extend credit

Exceptions

Section ___.30(d)(ii) permits obtaining and using medical information “to comply with applicable requirements of local, state, or federal laws.” Bank of America is concerned that this may not be sufficient to permit obtaining and using (as well as disclosing) medical information in connection with governmental (or quasi-governmental) programs such as the Federal Housing Administration, Department of Veteran Affairs or Government Sponsored Enterprise (such as Fannie Mae and Freddie Mac) loan programs. These agencies operate special programs requiring the creditor to obtain and use medical information in ways not necessarily covered by other exceptions. In addition, these are often set out as program requirements rather than as specific legal requirements.

Section ___.30(d)(vi) provides an exception for the consumer’s consent to obtain and/or use specific medical information for a specific purpose. The consent must be in writing and signed and must specify the medical information and the particular use. Many creditors include a section on their credit application for the consumer to describe special circumstances that the creditor should consider in reviewing the application. Often, the consumer may have experienced extenuating circumstances that can explain a period of bad credit in an otherwise good credit history. Often these special circumstances involve medical information. We believe that this exception should be expanded to permit a consumer to provide this information for the purpose of considering the credit application. Since this section of an application is often completed by the consumer, who may not understand exactly what they need to say to trigger such an exception, we recommend that this exception be loosened so that it is not dependent on use of specific language or restrictions. The fact that the customer has supplied the information together with the credit application should be sufficient to constitute consent to use the information in connection with consideration of that application.

Bank of America also believes that the Agencies should make it clear, either through an exception or as part of the definition of “medical information,” that coded medical information provided by the consumer reporting agencies does not come within the meaning of the rule and is not restricted as to use or sharing.

Sharing Medical Information with Affiliates

Bank of America believes that the exceptions proposed by the Agencies in the Proposed Rule, that would permit financial institutions to continue to share medical information with affiliates in the situations specified, should be retained in the final rule. As mentioned above, the Agencies’ ability to grant exceptions to this provision is limited to the institutions over which they have respective jurisdiction. Thus, some affiliates, such as insurance affiliates, may not be covered by the exceptions and thus may not be able to provide medical information to other affiliates, such as the banks.

Effective Date

The Agencies specifically requested comment on whether an effective date of 90 days after the publication of the final rules is appropriate, or whether a different effective date should be established. We believe that the proposed effective date should remain the same, but that the final rule should provide for a longer implementation period for full compliance with the rule, in order to permit covered entities to adequately assess their practices. The FACT Act provides that the prohibition on obtaining and using medical information shall not take effect until the implementing regulations become effective, or as otherwise provided by regulation. It is important that the Agencies synchronize the effective date for the prohibition on the using and obtaining of medical information with the effective date of the regulatory exceptions thereto.

Bank of America appreciates the opportunity to comment on the Agency’s proposal. If you have any questions regarding our comments, please contact Kathryn D. Kohler, Assistant General Counsel, at (704) 386-9644.

Very truly yours,

Kathryn D. Kohler
Assistant General Counsel
Bank of America
101 South Tryon Street
Charlotte, NC 28255

Last Updated 06/01/2004 regs@fdic.gov

Last Updated: August 4, 2024