# Prohibition on Creditors and Consumer Reporting Agencies Concerning Medical Information (Regulation V)

> Briefs, arguments, decisions, and more.

URL: https://www.frixlaw.com/law-library/documents/fr%3A2024-30824

## Record

- **Collection:** Federal Register
- **Document type:** Rule
- **Published:** January 14, 2025
- **Citation:** 90 FR 3276

## Text

CONSUMER FINANCIAL PROTECTION BUREAU
12 CFR Part 1022
[Docket No. CFPB-2024-0023]
RIN 3170-AA54
Prohibition on Creditors and Consumer Reporting Agencies Concerning Medical Information (Regulation V)

AGENCY:

Consumer Financial Protection Bureau.

ACTION:

Final rule.

SUMMARY:

The Consumer Financial Protection Bureau (CFPB) is issuing a final rule amending Regulation V, which implements the Fair Credit Reporting Act (FCRA), concerning medical information. The FCRA prohibits creditors from considering medical information in credit eligibility determinations. The CFPB is removing a regulatory exception that had permitted creditors to obtain and use information on medical debts notwithstanding this statutory limitation. The final rule also provides that a consumer reporting agency generally may not furnish to a creditor a consumer report containing information on medical debt that the creditor is prohibited from using.

DATES:

This final rule is effective March 17, 2024.

FOR FURTHER INFORMATION CONTACT:

George Karithanom, Regulatory Implementation & Guidance Program Analyst, Office of Regulations, at 202-435-7700 or
https://reginquiries.consumerfinance.gov/.
If you require this document in an alternative electronic format, please contact
CFPB_Accessibility@cfpb.gov.

SUPPLEMENTARY INFORMATION:

I. Overview

A. Summary of the Final Rule

Information about a person's medical history and health is sacrosanct and among the most intimate and sensitive categories of data. Recognizing the uniquely sensitive nature of such information, Congress acted to limit the use and sharing of medical information in the financial system by amending the Fair Credit Reporting Act (FCRA) through the Fair and Accurate Credit Transactions Act of 2003 (FACT Act).
1

In doing so, Congress “establish[ed] strong privacy protections for consumers' sensitive medical information,”
2

in line with the overarching privacy protection purpose of the FCRA.
3

As part of these protections, Congress generally limited a creditor's ability to obtain or use a consumer's medical information in connection with any determination of the consumer's eligibility, or continued eligibility, for credit (creditor prohibition), subject to certain exceptions.
4

One of these exceptions required the Federal financial banking agencies and the National Credit Union Administration (Agencies) to prescribe regulations that permit transactions that are determined to be necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs (including administrative verification purposes), consistent with congressional intent to restrict the use of medical information for inappropriate purposes.
5

1
Fair and Accurate Credit Transactions Act of 2003 (FACT Act), Public Law 108-159, 117 Stat. 1952, 1999 (2003).

2
149 Cong. Rec. H8122-02, H8122 (daily ed. Sept. 10, 2003) (statement of Rep. Kanjorsky).

3
15 U.S.C. 1681
et seq.,
1681(a)(4).

4
15 U.S.C. 1681b(g)(2).

5
15 U.S.C. 1681b(g)(5).

In 2005, the Agencies issued a regulatory exception (financial information exception) to this statutory prohibition, permitting consumers' medical financial information to be obtained and used by creditors in connection with credit eligibility determinations if certain conditions were met.
6

Since the financial information exception was created, a number of concerns have been raised about whether a regulatory exception that permits creditors to consider sensitive medical information about a consumer's debts and certain other types of medical information is necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs, and consistent with the congressional intent to restrict the use of medical information for inappropriate purposes.

6
70 FR 70664 (Nov. 22, 2005).

First, when the Agencies issued the financial information exception to the statutory prohibition, they did so without providing evidence or reasoning to support their main conclusion that an exception from a congressionally created legal requirement was warranted.

Second, research has shown that medical debt has limited predictive value in predicting future default for credit underwriting purposes. Questions about the reliability of information about medical debt, as compared to information about other types of consumer debt, have been raised based on research performed by the CFPB and others.
7

Medical debt may be less predictive of whether a consumer will pay a future loan, because medical debts can occur and are collected through unique circumstances and practices. For example, consumers often have limited ability to control the timing and types of medical services that are required.

7

See, e.g.,
Kenneth P. Brevoort & Michelle Kambara, Consumer Fin. Prot. Bureau,
Data point: Medical debt and credit scores
(May 2014),
https://files.consumerfinance.gov/f/201405_cfpb_report_data-point_medical-debt-credit-scores.pdf. See also
Mark Rukavina,
Medical Debt and Its Relevance When Assessing Creditworthiness,
46 Suffolk U. L. Rev. 967 (2013),
https://bpb-us-e1.wpmucdn.com/sites.suffolk.edu/dist/3/1172/files/2014/01/Rukavina_Lead.pdf.

Third, market participants, including in the consumer reporting industry and those most financially incentivized to assess the predictive value of medical debt, have reduced their reliance on medical debt in recognition of its limited utility. Consumer reporting agencies have removed certain medical debts from consumer reports.
8

Major credit scoring companies have accorded less weight to, or excluded entirely, medical debt information in their newer scoring models.
9

Similarly, some creditors have adjusted how their underwriting standards treat medical debt information.
10

8

See, e.g.,
Bus. Wire,
Equifax, Experian, and TransUnion Support U.S. Consumers With Changes to Medical Collection Debt Reporting
(Mar. 18, 2022),
https://www.businesswire.com/news/home/20220318005244/en/Equifax-Experian-and-TransUnion-Support-U.S.-Consumers-With-Changes-to-Medical-Collection-Debt-Reporting.

9

See
AnnaMaria Andriotis,
Major Credit-Score Provider to Exclude Medical Debts,
Wall St. J. (Aug. 10, 2022),
https://www.wsj.com/articles/major-credit-score-provider-to-exclude-medical-debts-11660102729
(VantageScore CEO quoted as saying that having medical debt is not necessarily reflective of a consumer's ability to pay back a loan); Ethan Dornhelm,
The Impact of Medical Debt on FICO Scores,
FICO Blog (July 13, 2015),
https://www.fico.com/blogs/impact-medical-debt-ficor-scores.

10

See, e.g.,
Fed. Nat'l Mortg. Ass'n,
Single Family Selling Guide,
B3-2-03 (2021),
https://selling-guide.fanniemae.com/#Public.20Records.2C.20Foreclosures.2C.20and.20Collection.20Accounts
(noting that “[c]ollection accounts reported as medical collections are not used in the DU [Desk Underwriter] risk assessment”); Fed. Home Loan Mortg. Corp.,
The Single-Family Seller/Servicer Guide,
5201.1 (2022),
https://guide.freddiemac.com/app/guide/section/5201.1;
U.S. Dep't of Hous. & Urban Dev.,
Single Family Housing Policy Handbook,
4000.1 (2021),
https://www.hud.gov/sites/dfiles/OCHCO/documents/4000.1hsgh-112021.pdf. See also
The White House,
Fact Sheet: The Biden Administration Announces New Actions to Lessen the Burden of Medical Debt and Increase Consumer Protection
(Apr. 11, 2022),
https://www.whitehouse.gov/briefing-room/statements-releases/2022/04/11/fact-sheet-the-biden-administration-announces-new-actions-to-lessen-the-burden-of-medical-debt-and-increase-consumer-protection/
(announcing changes to certain Federal government underwriting standards to remove medical debt from evaluations of whether a consumer will repay a loan, including those for the U.S. Department of Agriculture's rural housing

service loans and the Small Business Administration's loan programs and the Federal Housing Finance Authority's review of credit models).

Key Changes

Given the developments over the past decade in its understanding of how consumer medical debt differs from other types of consumer debt and its uses in credit underwriting, the CFPB, now with primary regulatory authority over the FCRA, is updating the non-statutory exceptions in Regulation V to ensure the use of medical information is consistent with the congressional intent to safeguard consumers' privacy and restrict the use of medical information for inappropriate purposes. To do so, the CFPB is finalizing changes to how creditors and consumer reporting agencies treat medical information concerning a consumer's medical debt in §§ 1022.3, 1022.30, and 1022.38, as outlined below and discussed in further detail in part IV,
Discussion of the Final Rule.

These amendments apply to any person that participates as a creditor in a transaction, except for a person excluded from coverage by section 1029 of the Consumer Financial Protection Act of 2010 (CFPA)
11

(
i.e.,
certain auto dealers). According to existing Regulation V, the term “creditor” has the same meaning as in section 702 of the Equal Credit Opportunity Act (ECOA).
12

The amendments also apply to a consumer reporting agency as defined in section 603(f) of the FCRA.
13

11
Public Law 111-203, 124 Stat. 1955, 2004 (2010).

12
12 CFR 1022.30(b)(2)(ii);
see also
15 U.S.C. 1681a(r)(5). ECOA is codified at 15 U.S.C. 1691
et seq.;
ECOA section 702 is codified at 15 U.S.C. 1691a(e). The term creditor means any person who regularly extends, renews, or continues credit; any person who regularly arranges for the extension, renewal, or continuation of credit; or any assignee of an original creditor who participates in the decision to extend, renew, or continue credit.

13
15 U.S.C. 1681a(f). The term consumer reporting agency means any person which, for monetary fees, dues, or on a cooperative nonprofit basis, regularly engages in whole or in part in the practice of assembling or evaluating consumer credit information or other information on consumers for the purpose of furnishing consumer reports to third parties, and which uses any means or facility of interstate commerce for the purpose of preparing or furnishing consumer reports.

Removal of the Financial Information Exception

Under this final rule, a creditor will no longer be able to consider medical information related to a consumer's medical debt in connection with any determination of the consumer's eligibility, or continued eligibility, for credit, unless one of the specific exceptions in final § 1022.30(e) applies. Specifically, the CFPB is finalizing its interpretation as set forth in the proposed rule that for information about a consumer's debt to be “medical information” under FCRA section 603(i), the information must relate to a debt the consumer owes, or at one time owed, directly to a health care provider or to the health care provider's agent or assignee for the provision of the health care underlying the payment obligation.

As discussed in further detail in part IV.B.1,
Medical Information Related to Debts,
the CFPB finalizes its definition of medical debt information in final § 1022.3(j), as medical information that pertains to a debt owed by a consumer to a person whose primary business is providing medical services, products, or devices (also referred to herein as a health care provider), or to the person's agent or assignee, for the provision of such medical services, products, or devices. The definition also provides that medical debt information includes, but is not limited to, medical bills that are not past due or that have been paid.

The CFPB is removing the financial information exception to the creditor prohibition in current § 1022.30(d). This non-statutory exception provides that a creditor may generally obtain and use medical information pertaining to a consumer in connection with any determination of the consumer's eligibility, or continued eligibility, for credit subject to certain exceptions. With respect to information concerning a consumer's medical debts, the CFPB has concluded that it generally is neither “necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs,” nor consistent with Congress's intent “to restrict the use of medical information for inappropriate purposes,” for creditors to consider such sensitive financial information in underwriting. Because of the CFPB's elimination of the financial information exception, the FCRA will return to its original restrictions on creditors considering, in connection with credit eligibility determinations, certain medical information related to consumers' medical debts.

The final rule is also removing the financial information exception for expenses, assets, and collateral and related examples at current § 1022.30(d). As discussed in more detail in part IV.B.2,
Medical Information Related to Expenses, Assets, and Collateral,
the CFPB has determined that the financial information exception for a creditor to consider medical information relating to a consumer's expenses, assets, and collateral is also not warranted to protect legitimate operational, transactional, risk, or consumer needs and is not consistent with the intent of the creditor prohibition to restrict the use of medical information for inappropriate purposes as required under FCRA section 604(g)(5).

As discussed in more detail in part IV.B.3,
Medical Information Related to Income, Benefits, or the Purpose of the Loan,
the CFPB is retaining certain elements of the financial information exception related to income, benefits, and the purpose of the loan in current § 1022.30(d) by moving relevant provisions to the list of specific exceptions to the creditor prohibition at § 1022.30(e)(1)(x), with technical edits for renumbering, and is finalizing proposed § 1022.30(e)(7) (Example 7) which is an example that illustrates a use of medical information related to long-term disability income.

This final rule is also modifying the text of proposed § 1022.30(e)(1)(x)(A) to add a new provision at final § 1022.30(e)(1)(x)(A)(
1
), as to medical information included in the transaction information of an account for a consumer financial product or service described in 12 CFR 1033.111(b)(1) through (3), and accessed with the consumer's authorization. As discussed in more detail in part VI.A,
Consumer-Authorized Transaction History,
the CFPB has determined that including medical information included in the transaction history of a consumer's account in this exception is necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs, including permitting actions necessary for administrative verification purposes, consistent with FCRA's intent to restrict the use of medical information for inappropriate purposes.

Limits on a Consumer Reporting Agency's Disclosure of Medical Debt Information

Under the final rule, new § 1022.38 to subpart D addresses how a consumer reporting agency's medical debt information reporting responsibilities are impacted when creditors are prohibited from obtaining or using medical debt information. As discussed in more detail in part IV.C,
Limits on a Consumer Reporting Agency's Disclosure of Medical Debt Information,
final § 1022.38 provides that a consumer reporting agency is permitted to include medical debt information in a consumer report furnished to a creditor for credit eligibility purposes only if the following criteria are met: (1) the consumer reporting agency has reason to believe the creditor intends to use the medical debt information in a manner not prohibited by § 1022.30; and (2) the

consumer reporting agency has reason to believe the creditor is not otherwise legally prohibited from obtaining or using the medical debt information, including by a State law that prohibits a creditor from obtaining or using medical debt information. The CFPB has determined that a creditor who is prohibited from obtaining or using medical debt information does not have a permissible purpose for a consumer report containing medical debt information. The CFPB has also determined that limiting the circumstances under which consumer reporting agencies may furnish medical debt information is necessary or appropriate to administer and carry out the purposes and objectives of the FCRA to protect consumers' privacy, and to prevent evasions or to facilitate compliance.

Example To Comply With Applicable Requirements of Local, State, or Federal Laws

The CFPB is finalizing a specific example for obtaining and using medical information as proposed in new § 1022.30(e)(6) (Example 6) concerning the ability-to-repay or pay requirements in Regulation Z with respect to mortgages and credit card accounts, with one clarification as discussed below. The CFPB has determined that Example 6 does not conflict with the ability-to-repay or pay requirements in Regulation Z and provides sufficient information for how creditors may comply with both the ability-to-repay or pay requirements in Regulation Z and the changes in this final rule with respect to use of medical information. The CFPB has determined it would not be necessary or appropriate to protect legitimate operational, transactional, risk, consumer, and other needs, including permitting actions necessary for administrative verification purposes, nor consistent with Congress's intent to restrict the use of medical information for inappropriate purposes, for a creditor or card issuer under § 1022.30(e)(1)(ii) to use medical information contained in a consumer report in order to comply with the applicable laws because a creditor or card issuer can comply with the applicable laws using the information provided by the consumer, including any medical information received from the consumer on the application in response to a general inquiry about debts or obligations.

The final rule revises Example 6 from the proposal, however, to make clear that this example only relates to the exception under § 1022.30(e)(1)(ii), and a creditor or card issuer may obtain and use medical information for purposes of Regulation Z's ability-to-repay or pay determinations pursuant to other exceptions in § 1022.30(e), as applicable. With respect to the ability-to-repay requirements in Regulation Z § 1026.43(c), final Example 6 also contains additional information on the interplay between the ability-to-repay requirement in Regulation Z § 1026.43(c) and final § 1022.30(e)(1)(ii).

Effective Date

The final rule will take effect sixty days after the date the rule is published in the
Federal Register
.

B. Market Background

Unique Characteristics of Medical Debt in the United States

A significant number of Americans have medical debt.
14

According to one nationally representative survey, in 2022 around 41 percent of adults stated that they had some kind of medical debt, including debt that they were unable to pay, that was on credit cards, that was being paid over time, directly to a provider, or that they owed to family members, or to a bank, collection agency, or other lender.
15

14
For more information about medical debt in the United States, including population disparities, impacts on consumers, and COVID-19 impacts,
see
Consumer Fin. Prot. Bureau,
Medical Debt Burden in the United States
(Feb. 2022),
https://files.consumerfinance.gov/f/documents/cfpb_medical-debt-burden-in-the-united-states_report_2022-03.pdf.

15
Lunna Lopes et al., Kaiser Fam. Found.,
Health Care Debt In The U.S.: The Broad Consequences Of Medical And Dental Bills
(June 16, 2022),
https://www.kff.org/report-section/kff-health-care-debt-survey-main-findings/
(reporting results of 2022 Kaiser Family Foundation Health Care Debt Survey, which polled 2,375 adults).

Several characteristics of medical debt pose special risks to consumers and distinguish it from other types of debt.
16

The need for medical care can be unexpected,
17

and medical debt often results from bills for a one-time or short-term medical expense due to an unforeseen event such as an accident or sudden illness.
18

Consumers are rarely informed of the costs of medical treatment in advance, and because of price opacity and an often immediate need for medical care, consumers have little or no ability to “shop around.”
19

Americans that live in rural communities may also experience limited choices when trying to access health care,
20

which may impact the amount of their medical debt in ways that are not reflective of their other debts.

16

See generally
Consumer Fin. Prot. Bureau,
Bulletin 2022-01: Medical Debt Collection and Consumer Reporting Requirements in Connection with the No Surprises Act,
87 FR 3025 (Jan. 20, 2022),
https://www.govinfo.gov/content/pkg/FR-2022-01-20/pdf/2022-01012.pdf;
Consumer Fin. Prot. Bureau,
Consumer credit reports: A study of medical and non-medical collections,
at 15-16, 38-42 (Dec. 2014),
https://files.consumerfinance.gov/f/201412_cfpb_reports_consumer-credit-medical-and-non-medical-collections.pdf.

17

See
Consumer Fin. Prot. Bureau,
Complaint Bulletin: Medical billing and collection issues described in consumer complaints,
at 7 (Apr. 2022),
https://files.consumerfinance.gov/f/documents/cfpb_complaint-bulletin-medical-billing_report_2022-04.pdf
(describing consumer complaints received by the CFPB about unexpected medical care).

18

See
Lunna Lopes et al., Kaiser Fam. Found.,
Health Care Debt in the U.S.: The Broad Consequences of Medical and Dental Bills
(June 16, 2022),
https://www.kff.org/report-section/kff-health-care-debt-survey-main-findings/
(reporting survey results that 7 in 10 adults with health care debt say the debt arose from bills for a one-time or short-term medical expense).
But see
Sara R. Collins et al., Commonwealth Fund,
Paying for It: How Health Care Costs and Medical Debt Are Making Americans Sicker and Poorer—Findings from the Commonwealth Fund 2023 Health Care Affordability Survey
(Oct. 2023),
https://www.commonwealthfund.org/publications/surveys/2023/oct/paying-for-it-costs-debt-americans-sicker-poorer-2023-affordability-survey
(about half of adults with medical debt say it is from treatment received for an ongoing condition).

19
Consumer Fin. Prot. Bureau,
Bulletin 2022-01: Medical Debt Collection and Consumer Reporting Requirements in Connection with the No Surprises Act,
87 FR 3025 (Jan. 20, 2022),
https://www.govinfo.gov/content/pkg/FR-2022-01-20/pdf/2022-01012.pdf. See also
Consumer Fin. Prot. Bureau,
Complaint Bulletin: Medical billing and collection issues described in consumer complaints,
at 7-8 (Apr. 20, 2022),
https://www.consumerfinance.gov/data-research/research-reports/complaint-bulletin-medical-billing-and-collection-issues-described-in-consumer-complaints/
(detailing consumer complaints received by the CFPB).

20

See, e.g.,
U.S. Gov't Acct. Off.,
Health Care Capsule: Accessing Health Care in Rural America
(May 2023),
https://www.gao.gov/assets/gao-23-106651.pdf
(generally describing health care access challenges for rural populations).

There are significant concerns with the accuracy of medical bills. For example, 43 percent of all adults and 53 percent of adults with medical debt in a nationally representative survey believed they had received a medical or dental bill that included an error.
21

While the survey found that most of these adults had taken some action to dispute the mistake, 51 percent reported that they either did not dispute the bill or were unable to successfully resolve their dispute. This may be because medical billing and collections can be complicated and confusing since a consumer may have difficulty determining whether the amount is covered by insurance or a hospital's financial assistance program (if

applicable) and, if so, whether and to what extent the amount was already paid or reduced.
22

Also some health care providers and debt collectors exploit these complications and charge inflated or unearned bills.
23

21

See, e.g.,
Karen Pollitz & Kaye Pestaina, Kaiser Fam. Found.,
Could Consumer Assistance Be Helpful to People Facing Medical Debt?
(July 14, 2022),
https://www.kff.org/policy-watch/could-consumer-assistance-be-helpful-to-people-facing-medical-debt/
(analyzing results of 2022 Kaiser Family Foundation Health Care Debt Survey).

22

See, e.g.,
Consumer Fin. Prot. Bureau,
Medical Debt Burden in the United States,
at 9-14 (Feb. 2022),
https://files.consumerfinance.gov/f/documents/cfpb_medical-debt-burden-in-the-united-states_report_2022-03.pdf
(describing issues with medical billing and collections practices); Consumer Fin. Prot. Bureau,
Complaint Bulletin: Medical billing and collection issues described in consumer complaints
(Apr. 2022),
https://files.consumerfinance.gov/f/documents/cfpb_complaint-bulletin-medical-billing_report_2022-04.pdf.

23
Press Release, U.S. Dep't of Just.,
Hospital Chain Will Pay Over $260 Million to Resolve False Billing and Kickback Allegations; One Subsidiary Agrees to Plead Guilty
(Sept. 25, 2018),
https://www.justice.gov/opa/pr/hospital-chain-will-pay-over-260-million-resolve-false-billing-and-kickback-allegations-one;
Press Release, U.S. Atty's Off. for C.D. Cal.,
Prime Healthcare Services and its CEO Agree to Pay $65 Million to Settle Medicare Overbilling Allegations at 14 California Hospitals
(Aug. 3, 2018),
https://www.justice.gov/usao-cdca/pr/prime-healthcare-services-and-its-ceo-agree-pay-65-million-settle-medicare-overbilling;
Press Release, Off. of Pub. Affairs, U.S. Dep't of Just.,
Clinical Laboratory and Its Owner Agree to Pay an Additional $5.7 Million to Resolve Outstanding Judgement for Billing Medicare for Inflated Mileage-Based Lab Technician Travel Allowance Fees
(Aug. 1, 2023),
https://www.justice.gov/opa/pr/clinical-laboratory-and-its-owner-agree-pay-additional-57-million-resolve-outstanding;
Press Release, Off. of Pub. Affairs, U.S. Dep't of Just.,
Physician Partners of America to Pay $24.5 Million to Settle Allegations of Unnecessary Testing, Improper Remuneration to Physicians and a False Statement in Connection with COVID-19 Relief Funds
(Apr. 12, 2022),
https://www.justice.gov/opa/pr/physician-partners-america-pay-245-million-settle-allegations-unnecessary-testing-improper;
Erica Zucco,
Providence will refund medical bills for thousands of patients after agreement with attorney general,
King 5 News (Feb. 1, 2024),
https://www.king5.com/article/news/health/providence-forgive-137-million-medical-payments-refund-20m-patients-after-agreement/281-3063dd66-ab54-413a-893a-73463f213a5b;
Off. of the Att'y Gen. of Va.,
Common Health Care Fraud Schemes, https://www.oag.state.va.us/contact-us/frequently-asked-questions?id=511
(last visited Dec. 2, 2024).

Medical Debt and Consumer Reporting

Information about medical debt is used in different ways in the financial system. Consumer reporting agencies play a key role in assembling and evaluating consumer credit and other information on consumers
24

—including information about a consumer's medical debt—and in providing consumer reports to other companies for employment, housing, insurance, and other decisions.
25

Medical debt information on a consumer report can increase the cost and reduce the availability of credit, and can even reduce access to employment and housing.
26

24

See
15 U.S.C. 1681(a)(3).

25

See
Consumer Fin. Prot. Bureau,
Medical Debt Burden in the United States,
at 26 n.117 (Feb. 2022),
https://files.consumerfinance.gov/f/documents/cfpb_medical-debt-burden-in-the-united-states_report_2022-03.pdf.

26

See
Consumer Fin. Prot. Bureau,
Data Point: Consumer Credit and the Removal of Medical Collections from Credit Reports,
at 2 (Apr. 2023),
https://files.consumerfinance.gov/f/documents/cfpb_consumer-credit-removal-medical-collections-from-credit-reports_2023-04.pdf.

Generally, information about a medical debt on a consumer report appears as a collection tradeline. After a medical debt has been placed by the creditor in collections status because the debt has been unpaid for a period of time, the medical debt may be furnished as a collections tradeline to consumer reporting agencies by a debt collector, including a debt collector who collects on behalf of the original creditor for a fee, as well as a debt collector who purchases overdue accounts outright from the original creditor (also known as a debt buyer).
27

Such tradelines are referred to as medical collections or medical collections tradelines. Research by the CFPB has found that nearly all medical collections furnishing is performed by debt collectors, rather than by health care providers (as original creditors) themselves.
28

However, a debt collector may have limited access to an original creditor's system of records, which may contribute to higher dispute rates for collections tradelines compared to other components of consumer reports.
29

When debt collectors furnish to consumer reporting agencies, they generally report to one or more of the three largest nationwide consumer reporting agencies (NCRAs). Debt collections tradelines may persist on consumer reports for up to seven years;
30

however, many collections tradelines are removed well in advance of seven years.
31

27
Payments made to medical balances not yet sent to collections generally are not furnished to consumer reporting agencies.

28
Consumer Fin. Prot. Bureau,
Market Snapshot: An Update on Third Party Debt Collections Tradelines Reporting,
at 5 (Feb. 2023),
https://files.consumerfinance.gov/f/documents/cfpb_market-snapshot-third-party-debt-collections-tradelines-reporting_2023-02.pdf.

29

Id.

30
15 U.S.C. 1681c(a)(4).

31
Consumer Fin. Prot. Bureau,
Consumer credit reports: A study of medical and non-medical collections,
at 27 (Dec. 2014),
https://files.consumerfinance.gov/f/201412_cfpb_reports_consumer-credit-medical-and-non-medical-collections.pdf.

Historically, medical debts have been the most common type of debt on consumer reports at both the consumer-report and individual collections tradeline level. The CFPB estimated that medical collections accounted for 57 percent of all collections tradelines in Q1 2022 and 58 percent in Q2 2018.
32

When debt collectors acting as agents or assignees of health care providers furnish information about medical collections, they must notify the consumer reporting agency that they are furnishing medical information.
33

The FCRA generally prohibits consumer reporting agencies from reporting to third parties the name, address, and telephone number of the health care provider for any account identified as from a medical information furnisher that has notified the consumer reporting agency of its status, unless that information is restricted or coded such that persons other than the consumer cannot identify or infer the specific provider or the nature of the medical services provided.
34

Nevertheless, despite the coding of information on the consumer reports, a consumer report user could infer from the coding that certain debts relate to the provision of health care. Like with medical bills, consumers often find errors with medical collections tradeline information on their consumer reports. A CFPB analysis found that almost 6 percent of medical collections in its data were flagged as having been disputed at some point, almost three times higher than the rate of dispute flags on credit cards and seven times the rate of dispute flags on student loans.
35

32
Consumer Fin. Prot. Bureau,
Market Snapshot: An Update on Third Party Debt Collections Tradelines Reporting,
at 16-17 (Feb. 2023),
https://files.consumerfinance.gov/f/documents/cfpb_market-snapshot-third-party-debt-collections-tradelines-reporting_2023-02.pdf.

33

See
15 U.S.C. 1681s-2(a)(9).

34
15 U.S.C. 1681c(a)(6);
see
15 U.S.C. 1681s-2(a)(9) (requiring medical information furnishers to notify consumer reporting agencies of such status).

35
Consumer Fin. Prot. Bureau,
Paid and Low-Balance Medical Collections on Consumer Credit Reports
(July 27, 2022),
https://www.consumerfinance.gov/data-research/research-reports/paid-and-low-balance-medical-collections-on-consumer-credit-reports/.

A 2022 review of consumer complaints submitted to the CFPB found that many consumers complaining of disputed debt collection attempts reported first learning of the debt from viewing their consumer report. Consumers expressed concern with inaccurate information leading to a decrease in their credit score. Some consumers reported paying debt they did not believe they owed in order to have the tradeline removed from their consumer report.
36

A 2024 review of consumer complaints found that consumers complain that debt collectors

continue to collect on and report medical bills to credit reporting agencies even after the consumer has shown that they do not owe the amount.
37

36
Consumer Fin. Prot. Bureau,
Complaint Bulletin: Medical billing and collection issues described in consumer complaints
(Apr. 2022),
https://files.consumerfinance.gov/f/documents/cfpb_complaint-bulletin-medical-billing_report_2022-04.pdf.

37
Consumer Fin. Prot. Bureau,
Fair Debt Collection Practices Act: CFPB Annual Report 2024
(Sept. 2024),
https://files.consumerfinance.gov/f/documents/cfpb_fdcpa-2024-annual-report_2024-09.pdf.

Some of the errors in medical collections tradelines could be due to debt collection furnishing practices. Some medical debt collectors previously used debt collection furnishing to engage in a practice known as “debt parking,” or “passive collection.” Debt collectors would report a debt to a consumer reporting agency, then wait for the consumer to notice the tradeline when, for example, applying for credit. The consumer may then pay the debt, possibly without raising any dispute as to any errors in order to access needed credit. The CFPB issued final rules on debt collection, which took effect November 30, 2021, that addressed this practice by requiring a debt collector to take certain actions intended to convey information about the debt to the consumer before furnishing information on that debt to a consumer reporting agency.
38

Despite the protections offered by these rules, CFPB investigations indicate that some medical debt collectors may still be attempting to collect on medical debts that were not substantiated after consumers disputed the validity of the debts.
39

38

See
12 CFR 1006.30(a).

39

See
Consumer Fin. Prot. Bureau,
CFPB Takes Action Against Phoenix Financial Services for Illegal Medical Debt Collection and Credit Reporting Practices
(June 8, 2023),
https://www.consumerfinance.gov/about-us/newsroom/cfpb-takes-action-against-phoenix-financial-services-for-illegal-medical-debt-collection-and-credit-reporting-practices/
; Consumer Fin. Prot. Bureau,
CFPB Shuts Down Commonwealth Financial Systems for Illegal Debt Collection Practices
(Dec. 15, 2023),
https://www.consumerfinance.gov/about-us/newsroom/cfpb-shuts-down-commonwealth-financial-systems-for-illegal-debt-collection-practices/.

Recent reporting changes announced by the NCRAs in 2022 and 2023 have begun to reduce the amount of medical debt reported on consumer reports and benefit some consumers. Specifically, the NCRAs announced that, starting on July 1, 2022, unpaid medical collections will not appear on a consumer's report for up to one year (an increase from 180 days), and paid medical collections will no longer be on consumer reports.
40

In April 2023, the NCRAs also announced that medical collections with initial balances below $500 had been removed from consumer reports.
41

40
Equifax,
First Changes to Reporting of Medical Collection Debt Roll Out July 1, 2022
(July 1, 2022),
https://www.equifax.com/newsroom/all-news/-/story/first-changes-to-reporting-of-medical-collection-debt-roll-out-july-1-2022
; Experian,
First Changes to Reporting of Medical Collection Debt Roll Out July 1, 2022
(July 1, 2022),
https://www.experianplc.com/newsroom/press-releases/2022/first-changes-to-reporting-of-medical-collection-debt-roll-out-july-1-2022
; TransUnion,
First Changes to Reporting of Medical Collection Debt Roll Out July 1, 2022
(July 1, 2022),
https://newsroom.transunion.com/first-changes-to-reporting-of-medical-collection-debt-roll-out-july-1-2022/.

41
PR Newswire,
Equifax, Experian and TransUnion Remove Medical Collections Debt Under $500 From U.S. Credit Reports
(Apr. 11, 2023),
https://www.prnewswire.com/news-releases/equifax-experian-and-transunion-remove-medical-collections-debt-under-500-from-us-credit-reports-301793769.html.

The CFPB conducted an analysis of the impacts of the NCRAs' medical debt reporting changes through June 2023.
42

The CFPB found that after these changes, 15 million Americans still have $49 billion in medical bills on their consumer reports. Because the medical collections tradelines removed by the NCRAs were those with low balances, the total dollar balances of medical collections on consumer reports fell by only 38 percent nationwide.

42
Ryan Sandler & Zachary Blizard, Consumer Fin. Prot. Bureau,
Recent Changes in Medical Collections on Consumer Credit Records Data Point,
at 3-4, 17 (Mar. 2024),
https://files.consumerfinance.gov/f/documents/cfpb_recent-changes-medical-collections-on-consumer-credit-reports_2024-03.pdf.

Several States and at least one Federal agency have also enacted policies that limit the inclusion of medical debt on consumer reports.
43

For example, Colorado
44

and New York
45

each passed laws in 2023 prohibiting medical debts from appearing on consumer reports. California, Connecticut, Minnesota, New Jersey, Illinois, and Virginia followed suit earlier this year.
46

Maine, in 2019, passed a law requiring consumer reporting agencies to remove medical debt upon receiving reasonable evidence that the debt has been settled or paid.
47

In 2022, the U.S. Department of Veterans Affairs (VA) finalized a rule providing that the VA will report medical debt to consumer reporting agencies only if all other debt collection efforts have been exhausted, the individual is not catastrophically disabled or entitled to free medical care from the VA, and the outstanding debt is over $25.
48

43
In 2022, the CFPB issued an interpretive rule clarifying that because FCRA's express preemption provisions have a narrow and targeted scope, States retain substantial flexibility to pass laws involving consumer reporting to reflect emerging problems affecting their local economies and citizens, including problems related to medical debt. Consumer Fin. Prot. Bureau,
The Fair Credit Reporting Act's Limited Preemption of State Laws,
87 FR 41042 (July 11, 2022).

44
Colo. Rev. Stat. section 5-18-109.

45
N.Y. Pub. Health Law art. 49-A.

46
2024 Calif. SB 1061; 2024 Conn. Act 24-6; 2024 Minn. Ch. 332C; 2024 New Jersey A3681; 2024 Ill. Pub. Act 103-0648; 2024 Va. Acts ch. 751.

47

Consumer Data Indus. Ass'n
v.
Frey,
26 F.4th 1 (1st Cir. 2022), cert. denied, 143 S. Ct. 777 (2023).

48
U.S. Dep't of Veterans Affairs,
Threshold for Reporting VA Debts to Consumer Reporting Agencies,
87 FR 5693 (Feb. 2, 2022).

Current Use of Medical Debt in Credit Scoring and Underwriting

Collections tradelines are considered negative information and can lower consumers' credit scores. A 2014 CFPB analysis found that the presence of medical collections tradelines on consumer reports is less predictive of future defaults or serious delinquencies than the presence of nonmedical collections tradelines, and that consumers with paid medical debts have delinquency rates well below those of consumers with the same credit scores whose medical debts were mostly unpaid.
49

Following the CFPB's publication of its research and in recognition of the limited predictive value of medical bills, major credit score providers FICO and VantageScore made changes so that newer versions of their credit scoring models differentiate between medical and nonmedical collections tradelines, give less weight to unpaid medical collections tradelines than to other collections tradelines, and ignore paid medical collections of any kind.
50

In January 2023, VantageScore implemented changes to VantageScore models 3.0 and 4.0 to ignore all medical collections tradelines.
51

49
Kenneth P. Brevoort & Michelle Kambara, Consumer Fin. Prot. Bureau,
Data point: Medical debt and credit scores
(May 2014),
https://files.consumerfinance.gov/f/201405_cfpb_report_data-point_medical-debt-credit-scores.pdf.

50

See
Ethan Dornhelm,
The Impact of Medical Debt on FICO Scores,
FICO Blog (July 13, 2015),
https://www.fico.com/blogs/impact-medical-debt-ficor-scores
; VantageScore,
How will changes in how medical collection accounts get reported impact credit scores?
(July 5, 2022),
https://www.vantagescore.com/how-will-changes-in-how-medical-collection-accounts-get-reported-impact-credit-scores/.

51

See
AnnaMaria Andriotis,
Major Credit-Score Provider to Exclude Medical Debts,
Wall St. J. (Aug. 10, 2022),
https://www.wsj.com/articles/major-credit-score-provider-to-exclude-medical-debts-11660102729
(VantageScore CEO quoted as saying that having medical debt is not necessarily reflective of a consumer's ability to pay back a loan).

Older FICO scoring models that do not differentiate between medical and nonmedical collections tradelines, however, remain common in the market. For example, while the Government-Sponsored Enterprises (GSEs), the Federal National Mortgage Association (Fannie Mae) and the Federal Home Loan Mortgage Corporation (Freddie Mac), and the Federal Housing

Administration generally do not consider medical debt in their credit risk assessments within their respective automated underwriting systems,
52

the GSEs require creditors to provide credit scores derived from the older Classic FICO
53

for each borrower on a loan that the GSEs purchase to assess eligibility for certain loan products and make certain pricing decisions.
54

The GSEs and the Federal Housing Finance Agency (FHFA) announced in 2022 that they had validated and approved two of the new credit score models that lessen the weight of or do not consider medical collections, but that transition is not expected to occur until the fourth quarter of 2025.
55

52

See
Fed. Nat'l Mortg. Ass'n,
Single Family Selling Guide,
B3-2-03 (2021),
https://selling-guide.fanniemae.com/#Public.20Records.2C.20Foreclosures.2C.20and.20Collection.20Accounts
(noting that “[c]ollection accounts reported as medical collections are not used in the DU risk assessment”); Fed. Home Loan Mortg. Corp.,
The Single-Family Seller/Servicer Guide,
5201.1 (2022),
https://guide.freddiemac.com/app/guide/section/5201.1
; U.S. Dep't of Hous. & Urban Dev.,
Single Family Housing Policy Handbook,
4000.1 (2021),
https://www.hud.gov/sites/dfiles/OCHCO/documents/4000.1hsgh-102021.pdf.

53
The Classic FICO score is comprised of the following models: Equifax Beacon® 5.0, Experian/Fair Isaac Risk Model V2SM, and TransUnion FICO® Risk Score, Classic 04.

54

See, e.g.,
Fed. Nat'l Mortg. Ass'n,
Single Family Selling Guide
(Oct. 5, 2022),
https://selling-guide.fanniemae.com/sel/b3-5.1-01/general-requirements-credit-scores.

55
Fed. Hous. Fin. Agency,
FHFA Announces Key Updates for Implementation of Enterprise Credit Score Requirements
(Feb. 29, 2024),
https://www.fhfa.gov/Media/PublicAffairs/Pages/FHFA-Announces-Key-Updates-for-Implementation-of-Enterprise-Credit-Score-Requirements.aspx.

II. The Proposal and Other Procedural Background

A. Small Business Advisory Review Panel

Pursuant to the Small Business Regulatory Enforcement Fairness Act of 1996 (SBREFA),
56

the CFPB issued its Outline of Proposals and Alternatives under Consideration (Outline or SBREFA Outline).
57

The SBREFA Outline addressed a number of consumer reporting topics under the FCRA, including medical debt collections information proposals under consideration. The CFPB convened a SBREFA Panel on October 16, 2023, and held Panel meetings on October 18 and 19, 2023.
58

Representatives from 16 small businesses were selected as small entity representatives for this SBREFA process. These entities represented small businesses that the CFPB determined would likely be directly affected by one or more of the proposals under consideration. On December 15, 2023, the Panel completed the Final Report of the Small Business Review Panel on the CFPB's Proposals and Alternatives Under Consideration for the Consumer Reporting Rulemaking (Panel Report or SBREFA Report).
59

In addition to the SBREFA Panel and Panel Report, the CFPB also invited feedback on the proposals under consideration from other stakeholders, including small stakeholders who were not small entity representatives.
60

The CFPB considered the feedback related to the medical debt collection information proposals from small entity representatives and other stakeholders, as well as the findings and recommendations of the Panel, in preparing the proposed rule and this final rule.

56
Pub. L. 104-121, 110 Stat. 857 (1996).

57
Consumer Fin. Prot. Bureau,
Small Business Advisory Review Panel for Consumer Reporting Rulemaking Outline of Proposals and Alternatives Under Consideration
(Sept. 15, 2023),
https://files.consumerfinance.gov/f/documents/cfpb_consumer-reporting-rule-sbrefa_outline-of-proposals.pdf.

58
The Panel was comprised of a representative from the CFPB, the Chief Counsel for Advocacy of the Small Business Administration (Office of Advocacy), and a representative from the Office of Information and Regulatory Affairs (OIRA) in the Office of Management and Budget.

59
Consumer Fin. Prot. Bureau,
Final Report of the Small Business Review Panel on the CFPB's Proposals and Alternatives Under Consideration for the Consumer Reporting Rulemaking
(Dec. 15, 2023),
https://files.consumerfinance.gov/f/documents/cfpb_sbrefa-final-report_consumer-reporting-rulemaking_2024-01.pdf.
The CFPB considers the Panel's findings in its final regulatory flexibility analysis, as set out in part VIII.B below.

60

See
SBREFA Outline at 5.

B. Other Stakeholder Outreach

The CFPB has long been engaged in outreach and research related to medical debt information in the consumer reporting ecosystem. In 2013, the CFPB and the Federal Trade Commission (FTC) jointly hosted a public roundtable for industry and other stakeholders on the integrity of record keeping by debt collectors, debt buyers, and original creditors. Participants acknowledged that record keeping practices may introduce variability or inaccuracy to the consumer reporting systems.
61

In December 2014, following the CFPB's publication of its research report,
Data Point: Medical Debt and Credit Scores,
62

the CFPB issued a study of medical and nonmedical collections tradelines on consumer reports that assessed the furnishing practices of debt collectors and debt buyers, the incidence and type of collections tradelines on consumer reports, and differences between medical and nonmedical debt reporting.
63

The CFPB has continued to monitor the incidence of medical debt on consumer reports and released several other market analyses and research reports on medical debt collection and consumer reporting between 2019 and 2024.
64

61
Fed. Trade Comm'n & Consumer Fin. Prot. Bureau,
Roundtable on Data Integrity in Debt Collection: Life of a Debt
(2013),
https://www.ftc.gov/news-events/events/2013/06/life-debt-data-integrity-debt-collection.

62

See
Kenneth P. Brevoort & Michelle Kambara, Consumer Fin. Prot. Bureau,
Data point: Medical debt and credit scores
(May 2014),
https://files.consumerfinance.gov/f/201405_cfpb_report_data-point_medical-debt-credit-scores.pdf.

63
Consumer Fin. Prot. Bureau,
Consumer credit reports: A study of medical and non-medical collections
(Dec. 2014),
https://files.consumerfinance.gov/f/201412_cfpb_reports_consumer-credit-medical-and-non-medical-collections.pdf.

64
Consumer Fin. Prot. Bureau,
Market Snapshot: Third-Party Debt Collections Tradeline Reporting
(July 2019),
https://files.consumerfinance.gov/f/documents/201907_cfpb_third-party-debt-collections_report.pdf;
Consumer Fin. Prot. Bureau,
Market Snapshot: An Update on Third-Party Debt Collections Tradeline Reporting
(Feb. 2023),
https://files.consumerfinance.gov/f/documents/cfpb_market-snapshot-third-party-debt-collections-tradelines-reporting_2023-02.pdf;
Ryan Sandler & Zachary Blizard, Consumer Fin. Prot. Bureau,
Recent Changes in Medical Collections on Consumer Credit Records Data Point,
at 3-4, 17 (Mar. 2024),
https://files.consumerfinance.gov/f/documents/cfpb_recent-changes-medical-collections-on-consumer-credit-reports_2024-03.pdf.

In developing this final rule and the proposed rule, the CFPB consulted with staff from various Federal agencies to discuss aspects of its proposal, in accordance with CFPA section 1022(b)(2)(B). Specifically, the CFPB met with staff from the Board of Governors of the Federal Reserve System, the Office of Comptroller of the Currency, the Federal Deposit Insurance Corporation, the National Credit Union Administration (NCUA), the FTC, the Department of Health and Human Services, Department of Housing and Urban Development, the FHFA, the Small Business Administration, the VA, and the Department of Agriculture.

C. Summary of the Proposed Rule

On June 11, 2024, the CFPB issued a notice of proposed rulemaking (NPRM) containing several proposed amendments to Regulation V, which implements the FCRA, concerning medical information.
65

The NPRM was published in the
Federal Register
on June 18, 2024.
66

The CFPB proposed that the final rule, if adopted, would

take effect sixty days after the date it is published in the
Federal Register
.

65
Consumer Fin. Prot. Bureau,
Prohibition on Creditors and Consumer Reporting Agencies Concerning Medical Information (Regulation V)
(June 11, 2024),
https://www.consumerfinance.gov/rules-policy/rules-under-development/prohibition-on-creditors-and-consumer-reporting-agencies-concerning-medical-information-regulation-v/.

66
89 FR 51682 (June 18, 2024).

In the proposed rule, the CFPB discussed how Congress recognized that a consumer's medical information is particularly sensitive, warranting heightened privacy protections. The CFPB explained while Congress did permit the Agencies to create exceptions, Congress mandated that the Agencies determine that any exception be “necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs” and consistent with the congressional intent “to restrict the use of medical information for inappropriate purposes.”
67

Based on the CFPB's understanding of how consumer medical debt differs from other types of consumer debt and its uses in credit underwriting, the CFPB preliminarily determined that creditors' use of medical debt in underwriting does not meet that statutory standard, as a result, does not warrant an exception to the medical information privacy protections established by Congress.

67
15 U.S.C. 1681b(g)(5).

The CFPB proposed targeted amendments to Regulation V that would: (1) remove the financial information exception which broadly permits creditors to obtain and use medical financial information (including information about medical debt) in connection with credit eligibility determinations, while retaining select elements of the exception related to income, benefits, and loan purpose; and (2) limit the circumstances under which consumer reporting agencies are permitted to furnish medical debt information to creditors in connection with credit eligibility determinations.

Under the proposed rule, a creditor would no longer be able to obtain or use medical information related to debts, expenses, assets, or collateral, in connection with a credit eligibility determination, unless a specific exception otherwise applies to the creditor's consideration of the medical information. And a consumer reporting agency generally would be prohibited from furnishing to a creditor a consumer report containing medical debt information in connection with a credit eligibility determination.

The CFPB also explained in the proposed rule that as a result of these changes, consumers' sensitive medical information would be protected, and consumers would no longer be unfairly penalized in the credit market for having medical debt. Consumers with and without medical debt would have equal access to credit at comparable terms and debt collectors would have less leverage over consumers to pressure consumers into paying medical debts that they may not owe.

Comments

The CFPB received over 74,000 comments on the proposal.
68

Around 2,000 of these comments were unique comment letters. These commenters included: consumers; consumer advocacy groups; consumer reporting, debt collection, and banking trade groups; economic research and taxpayer advocacy groups; governmental entities, including members of Congress; medical, dental and hospital practitioner groups; and patient advocacy groups.

68

See https://www.regulations.gov/document/CFPB-2024-0023-0001/comment.

The remaining comments included some duplicate submissions (
i.e.,
letters with the same content from the same commenter submitted through multiple channels, or letters with the same content submitted by multiple people on behalf of the same commenting organization) as well as comments that appeared to be part of several comment submission campaigns. Such comment campaigns typically advocated for or against particular provisions in the proposal and urged additional changes.

The CFPB considered all the comments it received regarding the proposal, made certain modifications, and is adopting the final rule as described in part IV below.

III. Legal Authority

A. CFPA Section 1022(b)

Section 1022(b)(1) of the CFPA authorizes the CFPB to prescribe rules “as may be necessary or appropriate to enable the [CFPB] to administer and carry out the purposes and objectives of the Federal consumer financial laws, and to prevent evasions thereof.”
69

The term “Federal consumer financial laws” includes the “enumerated consumer laws,” which include the FCRA.
70

69
12 U.S.C. 5512(b)(1).

70

See
12 U.S.C. 5481(12), (14).

Section 1022(b)(2) of the CFPA prescribes certain standards for rulemaking that the CFPB must follow in issuing rules under Federal consumer financial laws.
71

For a discussion of the CFPB's standards for rulemaking under CFPA section 1022(b)(2), see part VII below.

71

See
12 U.S.C. 5512(b)(2).

B. Fair Credit Reporting Act

The FCRA was enacted in 1970 and was one of the world's first data privacy laws. The law was enacted after growing public concern about the lack of regulation concerning the widespread dissemination of sensitive information about Americans. One of Congress's main purposes in passing the FCRA was a respect for the consumer's right to privacy.
72

The law has been amended several times in the ensuing years, including by the FACT Act.
73

For example, Congress, through the FACT Act, amended the FCRA to include additional protections for consumer privacy, such as restricting the use and transfer of sensitive medical information, enhancing the ability of consumers to combat identity theft, increasing the accuracy of consumer reports, and allowing consumers to exercise greater control regarding the type and amount of marketing solicitations they receive.
74

72
FCRA section 602(a)(4) (15 U.S.C. 1681(a)(4)).

73
Pub. L. 108-159 (Dec. 4, 2003). Congress also enacted specific protections for servicemembers and veterans, including with respect to medical debt and credit monitoring. Economic Growth, Regulatory Relief, and Consumer Protection Act, Pub. L. 115-174, section 302, 132 Stat. 1296, 1333 (2018).

74
H. Rep. No. 108-396, at 1 (2003) (Conf. Rep.); S. Rep. No. 108-166, at 3 (2003) (Conf. Rep.).

The FCRA governs the collection, assembly, and use of consumer report information and provides the framework for the consumer reporting system in the United States. The FCRA regulates the practices of consumer reporting agencies that collect and compile consumer information into consumer reports for use by creditors, insurance companies, employers, landlords, and other entities in making eligibility decisions affecting consumers. The FCRA also limits the circumstances under which persons, such as creditors, may obtain and use consumer report information from consumer reporting agencies.

The FCRA was enacted to (1) prevent the misuse of sensitive consumer information by limiting recipients to those who have a legitimate need for it; (2) improve the accuracy and integrity of consumer reports; and (3) promote the efficiency of the nation's banking and consumer credit systems.
75

An important purpose of the FCRA is to enable creditors to make appropriate credit decisions based on accurate consumer reporting information that truly reflects whether a consumer will repay a loan, while simultaneously

protecting the privacy of consumer data.
76

75

Safeco Ins. Co. of Am.
v.
Burr,
551 U.S. 47, 52 (2007);
see also
15 U.S.C. 1681(a)(4) (recognizing “a need to insure that consumer reporting agencies exercise their grave responsibilities with fairness, impartiality, and a respect for the consumer's right to privacy”).

76
S. Rep. No. 91-517, at 1 (1969);
see also Trans Union Corp.
v.
FTC,
81 F.3d 228, 234 (D.C. Cir. 1996).

FCRA Section 621(e)

Effective July 21, 2011, section 1088 of the CFPA made conforming amendments to the FCRA, transferring rulemaking authority under much of the FCRA, except with respect to sections 615(e) and 628 and with respect to certain motor vehicle dealers, to the CFPB. Section 621(e) of the FCRA authorizes the CFPB to issue regulations as “necessary or appropriate to administer and carry out the purposes and objectives of [the FCRA], and to prevent evasions thereof or to facilitate compliance therewith.”
77

77

See
CFPA section 1088(a)(10)(E) (15 U.S.C. 1681s(e)).

FCRA Section 604(g)(2) and (5)

Through the FACT Act, Congress added, in FCRA section 604(g)(2), a broad new limitation on the ability of creditors to obtain or use medical information pertaining to a consumer in connection with any determination of the consumer's eligibility, or continued eligibility, for credit.
78

Congress also limited the circumstances under which consumer reporting agencies could furnish consumer reports containing medical information for credit, employment, or insurance purposes,
79

and generally required consumer reporting agencies providing consumer reports not to furnish contact information for medical information furnishers—who were also required to identify themselves to consumer reporting agencies
80

—without restrictions or coding “that do not identify, or provide information sufficient to infer, the specific provider or the nature of such services, products, or devices to a person other than the consumer.”
81

Congress also broadly defined medical information in FCRA section 603(i) to include “information or data . . . created or derived from a health care provider or the consumer, that relates to . . . the payment for the provision of health care to an individual.”
82

78
FACT Act sections 411(a), 412(f)(2), 117 Stat. 1999-2000, 2003 (15 U.S.C. 1681b(g)(2)). FCRA section 604(g)(2) provides: “Except as permitted pursuant to paragraph (3)(C) or regulations prescribed under paragraph (5)(A), a creditor shall not obtain or use medical information (other than medical information treated in the manner required under section 1681c(a)(6) of this title) pertaining to a consumer in connection with any determination of the consumer's eligibility, or continued eligibility, for credit.” 15 U.S.C. 1681b(g)(2).

79
FACT Act section 411(a), 117 Stat. 2000 (15 U.S.C. 1681b(g)(1)).

80
FACT Act section 412(a), 117 Stat. 2002 (15 U.S.C. 1681s-2(a)(9)).

81
FACT Act section 412(b), 117 Stat. 2002 (15 U.S.C. 1681c(a)(6)).

82
FACT Act section 411(c), 117 Stat. 2001 (15 U.S.C. 1681a(i)).

Congress initially granted rulemaking authority to the Agencies to make exceptions to the limitation on creditors obtaining and using medical information that are necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs (including administrative verification purposes), consistent with congressional intent to restrict the use of medical information for inappropriate purposes.
83

Pursuant to this authority, the Agencies promulgated final rules that, among other things, implemented the statute's general prohibition on creditors obtaining or using medical information pertaining to a consumer in connection with any determination of the consumer's eligibility, or continued eligibility, for credit and created exceptions to the prohibition.
84

83
FACT Act section 411(a), 117 Stat. 2001 (15 U.S.C. 1681b(g)(5)(A)).

84
70 FR 70664 (Nov. 22, 2005).
See also
interim final rules published at 70 FR 33958 (June 10, 2005).

The Agencies' final rules contain the financial information exception for creditors obtaining and using medical information in credit eligibility determinations.
85

The financial information exception consists of a three-part test which allows creditors to use medical information in connection with credit eligibility determinations so long as (1) the information is the type of information routinely used in making credit eligibility determinations; (2) the creditor uses the information in a manner and to an extent no less favorably than comparable nonmedical information; and (3) the creditor does not take the consumer's physical, mental, or behavioral health, condition or history, type of treatment, or prognosis into account when making the determination. The Agencies stated that the “three-part test strikes a balance between permitting creditors to obtain and use certain medical information about consumers when necessary and appropriate to satisfy prudent underwriting criteria and to ensure that credit is extended in a safe and sound manner, while restricting the use of medical information for inappropriate purposes.”
86

Although the Agencies explained the boundaries of their three-part test, and gave responses to commenters on various examples, they did not provide evidence or reasoning to support the main conclusion that an exception from a congressionally created legal requirement was warranted, other than a single conclusory sentence in the proposed rule stating that “[a] creditor should not be prohibited from obtaining or using information about a debt, for example, in connection with making a credit decision, just because that debt happens to be for medical products or services.”
87

85
70 FR 70664, 70667 (Nov. 22, 2005).

86
69 FR 23380, 23384 (Apr. 28, 2004).

87

Id.

The Agencies' final rules also identified a limited number of other particular purposes for which a creditor may use medical information in connection with any determination of the consumer's eligibility, or continued eligibility, for credit.
88

For example, a creditor may use medical information in credit eligibility determinations to comply with applicable requirements of local, State, or Federal laws.
89

The Agencies found that this exception, and the other enumerated specific exceptions, are necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs (including administrative verification purposes), and are consistent with the congressional intent to restrict the use of medical information for inappropriate purposes.
90

88
70 FR 70664, 70668 (Nov. 22, 2005).

89
This exception is restated at § 1022.30(e)(1)(ii).

90
69 FR 23380, 23382 (Apr. 28, 2004).

Congress (through the CFPA) transferred to the CFPB primary regulatory authority for the FCRA.
91

The CFPB restated the Agencies' regulations as an interim final rule, with request for comment, on December 21, 2011.
92

On April 28, 2016, the CFPB finalized the interim final rule without assessing or otherwise reconsidering the policy decisions and justifications that served as the basis for the regulations.
93

91
Title X of the Dodd-Frank Wall Street Reform and Consumer Protection Act, Pub. L. 111-203, section 1088, 124 Stat. 1376, 1955 (2010).

92
76 FR 79308 (Dec. 21, 2011).

93
81 FR 25323 (Apr. 28, 2016).

As a result of the transfer of authority, FCRA section 604(g)(5) now authorizes the CFPB to prescribe regulations to create exceptions from the statutory prohibition on obtaining or using medical information in connection with determinations of credit eligibility. However, the CFPB must determine that such exceptions to the general prohibition in FCRA section 604(g)(2) are necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs (including administrative verification purposes), consistent with the

congressional intent to restrict the use of medical information for inappropriate purposes.
94

Because the CFPB has determined that a regulatory exception for certain financial information is not necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs (including administrative verification purposes), the CFPB is removing the exception. This ensures that only exceptions that are necessary and appropriate, consistent with the CFPB's rulemaking authority under FCRA section 604(g)(5), remain in § 1022.30.

94
15 U.S.C. 1681b(g)(5).

FCRA Section 604(a) Permissible Purposes and Related Provisions

The FCRA protects consumer privacy in multiple ways, including by clearly prohibiting certain uses of data and limiting the circumstances under which consumer reporting agencies may disclose consumer information. FCRA section 604, entitled
Permissible purposes of consumer reports,
identifies an exclusive list of permissible purposes for which consumer reporting agencies may provide consumer reports.
95

The statute states that a consumer reporting agency may provide consumer reports under these circumstances “and no other.” In addition, FCRA section 607(a) requires that “[e]very consumer reporting agency shall maintain reasonable procedures designed to . . . limit the furnishing of consumer reports to the purposes listed under section 604.”
96

95
15 U.S.C. 1681b(a). Other sections of the FCRA identify additional limited circumstances under which consumer reporting agencies are permitted or required to disclose certain information to government agencies.
See
15 U.S.C. 1681f, 1681u, 1681v;
see also, e.g., FTC
v.
Manager, Retail Credit Co., Miami Beach Branch Off.,
515 F.2d 988, 994-95 (D.C. Cir. 1975) (holding that 15 U.S.C. 1681s(a) authorizes the FTC to obtain consumer reports in FCRA enforcement investigations). Further, the Debt Collection Improvement Act of 1996, Pub. L. 104-134, section 31001(m)(1), 110 Stat. 1321-366, allows the head of an executive, judicial, or legislative agency to obtain a consumer report under certain circumstances relating to debt collection.
See
31 U.S.C. 3711(h).

96
15 U.S.C. 1681e(a).

In addition to imposing permissible purpose limitations on consumer reporting agencies, the FCRA limits the circumstances under which third parties may obtain and use consumer report information from consumer reporting agencies. FCRA section 604(f) provides that a person shall not use or obtain a consumer report unless the consumer report is obtained for a purpose for which the consumer report is authorized to be furnished under FCRA section 604 and the purpose is certified in accordance with FCRA section 607 by a prospective user of the report.
97

97
15 U.S.C. 1681b(f).

The FCRA's permissible purpose provisions are thus a key component to the statute's protection of consumer privacy. Consumers suffer harm when consumer reporting agencies provide consumer reports to persons who are not authorized to receive the information or when recipients of consumer reports obtain or use such reports for purposes other than permissible purposes. These harms include the invasion of consumers' privacy, as well as reputational, emotional, physical, and economic harms.

Because the CFPB is removing the financial information exception, which broadly permitted creditors to obtain and use medical financial information (including information about medical debt) in connection with credit eligibility determinations, creditors generally will no longer have a permissible purpose for consumer reports containing medical debt information.

IV. Discussion of the Final Rule

A. Overview of the CFPB's Approach

As discussed above, the CFPB proposed to amend Regulation V to remove a regulatory exception from the limitation in the FCRA on creditors obtaining or using information on medical debts for credit eligibility determinations. The CFPB also proposed that a consumer reporting agency generally may not furnish to a creditor a consumer report containing information on medical debt that the creditor is prohibited from using.

Congress restricted a creditor's ability to obtain or use a consumer's medical information in connection with any determination of the consumer's eligibility, or continued eligibility, for credit.
98

When the Agencies issued the current regulatory exception to the statutory prohibition, they did so without providing evidence or reasoning to support their main conclusion that an exception from a congressionally created legal requirement was warranted. Research has shown that medical debt has limited predictive value for credit underwriting purposes. Market participants, including in the consumer reporting industry and those most financially incentivized to assess the predictive value of medical debt, have reduced their reliance on medical debt in recognition of its limited utility.

98
15 U.S.C. 1681b(g)(2).

The CFPB proposed this rule to address concerns that the regulatory exception to the medical information privacy protections established by Congress, which allows creditors to use medical debt information for underwriting, is not necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs, nor consistent with the intent to restrict the use of medical information for inappropriate purposes. The CFPB proposed removing the broad regulatory exception—while retaining select elements of the exception related to income, benefits, and loan purpose—and limiting the circumstances under which consumer reporting agencies are permitted to furnish medical debt information to creditors in connection with credit eligibility determinations.

The CFPB is adopting the same general approach in the final rule, with some modifications, as discussed herein.

Comments Received on the CFPB's Proposed Approach Generally

Comments received by the CFPB on the proposal, and responses thereto, are discussed in more detail throughout this notice. The following is a synopsis of comments received on the CFPB's proposed approach generally.

Commenters, including consumer advocate groups and consumers (generally in the form of a comment submission campaign), supported the CFPB's proposal, noting that the rule would align with congressional intent behind the FCRA, as amended by the FACT Act, and agreeing that medical debt information should be treated differently than other debt information. Commenters stated that the proposed rule is within the CFPB's legal authority under FCRA sections 621(e) and 604(g)(5) and will promote the FCRA's objectives as to the accuracy, fairness, and privacy of consumer information—given that medical debt is often inaccurate or error prone, is inconsistently reported, and has limited predictive value for credit underwriting. Commenters also stated that medical debt disproportionately impacts vulnerable populations and the CFPB's proposal would mitigate medical debt's negative impacts on consumers' health decisions and financial well-being, including by increasing consumers' access to credit.

Other commenters including industry commenters and consumers opposed the CFPB's proposal, asserting that it is arbitrary and capricious, exceeds the CFPB's legal authority, and conflicts with FCRA, as amended by the FACT

Act, and other laws. Commenters disagreed with the proposal's evidence that medical debt information has limited predictive value and asserted it is necessary for credit underwriting purposes and should not be treated differently than other debt information. Commenters stated that the CFPB's proposal would undermine the fairness and accuracy of credit reports and have negative impacts on consumers' ability to repair credit scores by making payments on collection tradelines and on creditors' ability to accurately assess creditworthiness—resulting in less-qualified consumers becoming overleveraged and well-qualified consumers experiencing decreased access to credit. Commenters also contended that the CFPB's proposal could result in lost income for medical providers, higher healthcare costs for consumers, and increased debt collection litigation.

B. Removal of the Financial Information Exception to the Creditor Prohibition on Obtaining or Using Medical Information

The creditor prohibition in section 604(g)(2) of the FCRA,
99

incorporated at Regulation V § 1022.30(b), restricts creditors from obtaining or using (
i.e.,
considering) medical information pertaining to a consumer in connection with any determination of the consumer's eligibility, or continued eligibility, for credit. Regulatory exceptions to this prohibition are at current § 1022.30(d) and (e), which are respectively titled “Financial information exception for obtaining and using medical information” (financial information exception) and “Specific exceptions for obtaining and using medical information”.

99
FCRA section 604(g)(2) (15 U.S.C. 1681b(g)(2)).

The CFPB proposed removing the financial information exception at § 1022.30(d). For the reasons discussed in part IV.B.1,
Medical Information Related to Debts,
and part IV.B.2,
Medical Information Related to Expenses, Assets, and Collateral,
the CFPB is finalizing this change as proposed. The CFPB also proposed retaining certain elements of the financial information exception related to income, benefits, and purpose of the loan by moving relevant provisions to the list of specific exceptions to the creditor prohibition at § 1022.30(e). For reasons discussed in part IV.B.3,
Medical Information Related to Income, Benefits, or the Purpose of the Loan,
the CFPB is finalizing its proposal to retain elements of the financial information exception as to income, benefits, and the purpose of the loan. The CFPB has also revised the proposed text for the revised exception to include medical information contained in the transaction information of an account for a consumer financial product or service described in 12 CFR 1033.111(b)(1) through (3), and accessed with the consumer's authorization, as discussed in part VI.A,
Consumer-Authorized Transaction History.

Additionally, the CFPB proposed adding a definition for “medical debt information” at § 1022.3(j). The CFPB is finalizing the definition as proposed for the reasons discussed in the relevant portion of the discussion in part IV.B.1,
Medical Information Related to Debts.
The CFPB also proposed and is finalizing conforming amendments to § 1022.30(c) to remove the reference to the financial information exception in § 1022.30(d), because the exception is removed under the final rule. Further, the CFPB proposed and is finalizing the removal of an example at existing § 1022.30(c)(3)(iii), which the CFPB discusses further in part IV.C,
Limits on a Consumer Reporting Agency's Disclosure of Medical Debt Information.

In the NPRM, the CFPB explained that Congress had put in place strong privacy protections for consumers' medical information in the FCRA, including by enacting the creditor prohibition through FCRA section 604(g)(2).
100

Congress also provided additional protections by stipulating that the CFPB may permit exceptions to the creditor prohibition only when the CFPB has determined the exceptions to be “necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs . . . consistent with the intent of [FCRA section 604(g)(2)] to restrict the use of medical information for inappropriate purposes.”
101

100
As described above, Congress also limited the circumstances under which consumer reporting agencies can provide consumer reports containing medical information for credit, employment, or insurance purposes, and required consumer reporting agencies to restrict or code contact information for medical information furnishers. 15 U.S.C. 1681b(g)(1), 1681c(a)(6).

101
15 U.S.C. 1681b(g)(5).

The CFPB further explained that, consistent with the general creditor prohibition in FCRA section 604(g)(2), current § 1022.30(b)(1) states: “A creditor may not obtain or use medical information pertaining to a consumer in connection with any determination of the consumer's eligibility, or continued eligibility, for credit, except as provided in this section.” The CFPB also noted that in 2005, before the CFPA transferred primary regulatory authority for the FCRA to the CFPB, the Agencies adopted the exceptions to this prohibition that are now codified in the financial information exception at § 1022.30(d) and the list of specific exception at § 1022.30(e) (listing specific exceptions).

The CFPB also explained that the financial information exception allows a creditor to consider medical information pertaining to a consumer in connection with any determination of the consumer's eligibility, or continued eligibility, for credit if the conditions of the following three-part test are met: (1) the information is the type routinely used in making credit eligibility determinations, such as information relating to debts, expenses, income, benefits, assets, collateral, or the purpose of the loan, including the use of proceeds; (2) the creditor uses the medical information in a manner and to an extent no less favorable than it would use comparable information that is not medical information; and (3) the creditor does not take the consumer's physical, mental, or behavioral health, condition or history, type of treatment, or prognosis into account as part of the credit eligibility determination.
102

102
12 CFR 1022.30(d)(1).

The CFPB observed that the predecessor Agencies had stated that it was their belief that the financial information exception struck a balance between permitting creditors to obtain and use certain medical information about consumers when necessary and appropriate to satisfy prudent underwriting criteria and ensuring that credit is extended in a safe and sound manner, while restricting the use of medical information for inappropriate purposes.
103

However, the CFPB noted that the Agencies had not cited evidence or provided analysis in support of this statement of their conclusion.

103
Fair Credit Reporting Medical Information Regulations (2004 NPRM), 69 FR 23380, 23384 (Apr. 28, 2004).

Comments received in response to specific aspects of the CFPB's proposal to remove the financial information exception, and the CFPB's reasons for finalizing its proposed removal of the exception with regard to each such aspect, are discussed separately below in this part IV.B,
Removal of the Financial Information Exception to the Creditor Prohibition on Obtaining or Using Medical Information.

1. Medical Information Related to Debts

In its proposal, the CFPB explained that by proposing to eliminate the financial information exception, the CFPB was generally proposing to prohibit creditors from considering, in

connection with credit eligibility determinations, certain financial information related to consumers' medical debts.

The financial information exception currently permits a creditor to consider certain medical information related to a consumer's debts in connection with any determination of the consumer's eligibility, or continued eligibility, for credit.
104

Such medical information related to medical debt includes, for example, “[t]he dollar amount, repayment terms, repayment history, and similar information regarding medical debts to calculate, measure, or verify the repayment ability of the consumer, the use of proceeds, or the terms for granting credit”
105

and “[t]he identity of creditors to whom outstanding medical debts are owed in connection with an application for credit, including but not limited to, a transaction involving the consolidation of medical debts”
106

(collectively referred to herein as financial information).

104
12 CFR 1022.30(d)(1)(i).

105
12 CFR 1022.30(d)(2)(i)(A).

106
12 CFR 1022.30(d)(2)(i)(D).

Thus, under the CFPB's proposal, which the CFPB is finalizing as proposed for the reasons discussed in this part IV.B.1, a creditor would no longer be able to consider such medical information related to a consumer's medical debt, unless one of the specific exceptions in final § 1022.30(e) applies. Specifically, as discussed in further detail below, the CFPB is finalizing its interpretation as set forth in the proposed rule that for information about a consumer's debt to be “medical information” under FCRA section 603(i), the information must relate to a debt the consumer owes, or at one time owed, directly to a health care provider or to the health care provider's agent or assignee for the provision of the health care underlying the payment obligation. The CFPB is also finalizing its definition of medical debt information in final § 1022.3(j), as medical information that pertains to a debt owed by a consumer to a person whose primary business is providing medical services, products, or devices (also referred to herein as a health care provider), or to the person's agent or assignee, for the provision of such medical services, products, or devices. The definition also provides that medical debt information includes, but is not limited to, medical bills that are not past due or that have been paid. Further, the CFPB has concluded that it generally is neither “necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs,” nor consistent with Congress's intent “to restrict the use of medical information for inappropriate purposes,” for creditors to consider sensitive financial information concerning a consumer's medical debt in underwriting.

Preliminary Interpretation—Owes or Owed to a Health Care Provider

FCRA section 603(i)'s definition of “medical information,” incorporated in Regulation V at § 1022.3(k), informs the types of medical debt that creditors are generally prohibited from considering, but for which the financial information exception currently applies. Medical information is defined as “[i]nformation or data, whether oral or recorded, in any form or medium, created by or derived from a health care provider or the consumer” that relates to, among other things, “[t]he payment for the provision of health care to an individual.”

In its proposal, the CFPB explained that with regard to “[t]he payment for the provision of health care to an individual”—
i.e.,
the subset of “medical information” concerning debt—the CFPB proposed to interpret FCRA section 603(i) to mean that medical information about a consumer's debt must relate to a debt the consumer owes, or at one time owed (for example, in the case of paid medical debt), directly to a health care provider or to the health care provider's agent or assignee.
107

Specifically, the CFPB stated that the statute provides that medical information is information or data “created by or derived from a health care provider or the consumer” that relates to “the payment for the provision of health care to an individual.” And, as a result, the CFPB preliminarily interpreted the statute's use of the phrase “provision of health care,” following the requirement that the medical information must be “created by or derived from a health care provider or the consumer,” to mean that for information on a debt to be medical information under the FCRA, the information must relate to a debt arising from a payment obligation that the consumer owes (or at one time owed) directly to a health care provider for the provision of the health care underlying the payment obligation.

107
The CFPB explained that its use of the word “owed” referred to the characterization of the debt by the health care provider or its agent or assignee.

The CFPB also stated that its preliminary interpretation would include medical debt that had been sold or resold to a debt buyer, who had become the health provider's assignee for the debt, because the payment obligation that was sold was created by a health care provider and at one time was owed to the health care provider. It would also include medical debt that had been assigned to a third-party debt collector, who was acting as an agent on behalf of the health care provider, or debt buyer to whom the debt was owed.
108

Further, it would include medical information in the form of a civil judgment arising from a debt collection action as to a medical debt directly owed to a health care provider or debt buyer, whether provided on a consumer report, by the consumer on a credit application, or if the creditor learned of the civil judgment through other means; a credit score that had weighed medical debt information; and debts arising from medical care that is elective, or otherwise not medically necessary (
e.g.,
some cosmetic surgeries).

108

Cf.
15 U.S.C. 1681s-2(a)(9) (providing that the term “medical information furnisher” includes the “agent or assignee” of a medical provider).

The CFPB further explained that because medical information on a consumer's debt must relate to a debt the consumer owes (or owed) directly to a health care provider under the CFPB's preliminary interpretation, medical debt would not include a debt owed to a third-party lender (including a medical credit card issuer whose products are offered specifically for the payment of medical services or general purpose credit card issuer), from whom a consumer took out a loan to pay medical expenses or bills. The CFPB noted that such loans would be new debt obligations used to pay the medical debt obligation owed to a health care provider. Moreover, the CFPB also preliminarily concluded that debts owed to such third-party lenders are distinguishable from debts that health care providers have sold to debt buyers because medical debts are assigned to such debt buyers, but not to third-party lenders.

The CFPB sought comment on its approach and on whether, in the alternative, information about debts generally incurred to pay for medical bills and expenses should be considered to be “medical information” that is “derived” from a health care provider or consumer. The CFPB also sought comment on the feasibility of furnishing such medical debt information under this latter approach to consumer reporting agencies and reporting to creditors in a way that distinguishes between loan obligations and disbursements that pay for medical expenses and those that do not.

In consideration of its preliminary interpretation of FCRA section 603(i), the CFPB also proposed adding a definition for medical debt information at § 1022.3(j) to facilitate compliance with various aspects of the proposed rule. As explained in the NPRM, the CFPB's intent was for the definition of medical debt information under proposed § 1022.3(j) to align with the scope of information about medical debt (also referred to herein as medical debt information) that creditors would be prohibited from considering if the financial information exception is removed.

The CFPB's proposed medical debt definition, comments received in response to the proposed definition, and the CFPB's responses are generally discussed later in this part. To the extent commenters raised issues related to and about the CFPB's preliminary interpretation of medical debt information under FCRA section 603(i) in the context of their discussion of other aspects of the CFPB's proposal, including of the proposed definition at § 1022.3(j), such issues are generally addressed immediately below.

Comments—Preliminary Interpretation: Owes or Owed to a Health Care Provider

The CFPB received a number of comments related to and about its preliminary interpretation of medical information under FCRA section 603(i), that medical information about a consumer's debt must relate to a debt the consumer owes, or at one time owed, directly to a health care provider or to the health care provider's agent or assignee. Comments also discussed the corresponding scope of the proposed medical debt information definition at § 1022.3(j) in relation to medical debt owed to third-party lenders, information about civil judgments arising from medical debt collection litigation, and credit scores that weighed medical debt information.
109

109
The CFPB also received comments addressing its preliminary interpretation that information about a debt originally owed to a health care provider that has been sold and resold to a debt buyer or assigned to a third-party debt collector is generally medical information. These comments are discussed with comments about the CFPB's proposed medical debt information definition (§ 1022.3(j)) later in this part.

Third-Party Lenders

A number of commenters agreed with the CFPB's position that medical debt directly owed to a health care provider, or to their agent or assignee, should be information about medical debt that is subject to the creditor prohibition. One such commenter, who generally supported the CFPB's proposal, stated that the CFPB's interpretation of FCRA section 603(i) would protect consumers' sensitive medical information and prevent the mischaracterization or improper assignments of debts arising from services directly provided by health care professionals. However, the commenter, and many others that also substantially supported the CFPB's proposal, expressed concern that the CFPB's proposed interpretation and proposed medical debt information definition did not also include information about medical debts incurred by a consumer that had been paid for with third-party lender payment products. Some of these commenters urged the CFPB to revise its preliminary interpretation as to medical debt information under FCRA section 603(i) and/or its proposed definition under § 1022.3(j) to include information about such debts owed to third-party lenders.

Specifically, commenters stated that the CFPB should include other sources of medical debt, such as general purpose credit cards, medical credit cards, medical installment loans, loans owed to friends and family, and loans owed to third-party lenders, within the scope of the rulemaking. While some commenters urged the CFPB to include all types of third-party loan products, many commenters specifically emphasized that medical debt incurred through medical credit cards and general purpose credit cards should be included. Others requested that the CFPB include medical credit cards without mention of general purpose credit cards. Some commenters urged the CFPB to more broadly include third-party medical payment or lending products specifically meant to pay for medical care, such as medical credit cards (including those used to pay dental expenses) or medical financing plans.

With regard to credit cards, commenters stated that credit cards are a significant source of medical debt, with some commenters flagging that they are prevalently used by specific populations like older Americans or patients with chronic conditions or cancer. These commenters also stated that the same reasons that make information about medical debt unfair and unreliable indicators of a consumer's creditworthiness (
i.e.,
that the debts are often incurred on an involuntary and unexpected basis so that consumers have little ability to compare and negotiate prices) also apply to medical debt paid for with these kinds of third-party lending products. The commenters expressed concern that not including medical debt from these types of products within the scope of the CFPB's final rule would leave consumers with such debt without the protections of the rule. One commenter stated that a broad interpretation of the term medical information and medical debt information definition would provide flexibility to capture future types of medical financing.

With regard to medical payment products, commenters stated that if the CFPB's final rule does not apply to debts owed to issuers of medical payment products, such debts could become a loophole that would result in more medical providers promoting or requiring the use of these products, particularly if there is general shift towards requiring upfront payment for medical services. One commenter cited Arizona's Predatory Debt Collection Protection Act as an example of the importance of ensuring that such types of debt are included in the final definition. The commenter stated that although the Arizona law limits the maximum interest rate on medical debt to 3 percent, the law does not consider credit cards or loans taken out to pay for medical debt to be subject to the interest rate ceiling. And, as a result, there are medical credit cards charging Arizona residents significantly more than 3 percent interest.

With regard to medical credit cards, some commenters stated that medical credit cards can be more expensive than other forms of payment, may be advertised with low promotional interest rates but later have much higher interest rates, and may be used to pay for expenses that the consumer never incurred. Other commenters stated that consumers may be misled or not fully informed about such cards by their medical providers and in some instances may not even be aware that they are opening up a credit account. Commenters also noted that the use of medical credit cards is increasing, citing factors such as how they are being used to finance a growing array of medical services that may or may not be covered by health insurance, the trend of health insurance practices shifting costs to patients through high deductible and limited network plans, and that medical providers may be motivated to promote medical credit cards' use to reduce administrative billing costs and improve the timeliness of consumer payments. A couple of commenters also noted that some states, like Connecticut and New York, already restrict the medical debt from being on credit reports, including if charged to a medical credit card.

Several commenters stated that expanding the CFPB's preliminary

interpretation of medical debt information and proposed definition would be consistent with the FCRA. A couple of commenters stated that the CFPB should consider information about debts generally incurred to pay for medical bills and expenses to be “medical information” that is “derived” from a health care provider or consumer under FCRA section 603(i). Another commenter made a similar argument, specifically as to medical credit cards. One commenter suggesting that the interpretation and proposed definition should include all purchases for medical services, products and devices, irrespective of the type of financing, stated that these changes would be consistent with the FCRA, because a consumer creates medical information by seeking out and obtaining medical services, products or devices and creates a payment obligation through intermediary payment methods by opening up a credit card or medical payment product where they bear the financial obligation. The commenter cited, as an example, a definition for “medical debt” in legislation under consideration in Congress, which provides that a medical debt is a debt related to, in whole or in part, transactions, accounts, or balances arising from the receipt of medical services, products, or devices.
110

Another commenter urging the CFPB to include medical credit cards within the final rule's scope stated that medical credit cards are lending products, which the CFPB has broad authority over.

110
Medical Debt Relief Act, H.R. 6003, 118th Cong. (2023).

Some commenters stated that they agree with the CFPB's interpretation, and its proposed definition for medical debt information aligning with that interpretation, because they said it reflects the most reasonable interpretation of the statute. Consequently, these commenters stated that the CFPB should not revise the CFPB's interpretation of medical information under FCRA section 603(i) and the CFPB's proposed medical debt definition to include medical debts paid for with payment products from third-party lenders and creditors, such as general purpose credit card issuers, specialty credit card issuers, issuers of medical payment products, and home equity lenders. The commenters stated that the distinction was important, with several urging the CFPB to affirmatively exclude medical debt owed to third-party lenders and creditors in the final medical debt information definition. Several of the commenters, who also generally opposed the CFPB's proposal, stated that an expansion of the medical debt information definition would remove more types of debt information from creditors' consideration when underwriting credit and affect creditors' ability to make risk-based lending decisions, leading to overleveraged consumers or causing lenders to tighten their underwriting standards and increase the cost of credit to offset anticipated increases in a consumer's repayment risk.

One commenter stated that the CFPB's preliminary interpretation of FCRA section 603(i) is arbitrary and capricious, because it distinguishes between creditors who are health care providers (and their agents or assignees) and credit card issuers. The commenter stated that such a distinction is arbitrary because whether a consumer pays a healthcare provider by credit card or if the healthcare provider sends a consumer a bill is the result of the consumer's choice of payment and individual health provider billing practices. Yet, under the CFPB's preliminary interpretation and its proposed rule, in the former scenario information about the debt could be on a consumer report and in the latter it could not be, even though the consumer has the same credit risk and the same amount of debt. The commenter stated the proposed approach could give consumers the ability to manipulate their credit scores. The commenter stated that the CFPB did not address this issue in the NPRM, which it says is arbitrary and capricious. The commenter also characterized the CFPB's interpretation as a departure from the position it states was taken by the CFPB's predecessor Agencies and accepted by the CFPB in restating Regulation V after primary regulatory authority for the FCRA was transferred to it. Specifically, the commenter cited the Agencies' interim final rule implementing section 411 of the FACT Act. The commenter pointed to language where the Agencies stated that the creditor prohibition at FCRA section 604(g)(2) applies to all creditors and that the scope of the exceptions to the prohibition adopted pursuant to FCRA section 604(g)(5) is as broad as the prohibition and applies to all creditors.
111

The commenter started that the CFPB did not address what the commenter characterized as a change in interpretation as to the statutory text.

111
70 FR 33958, 33963 (June 10, 2005).

In the NPRM, the CFPB asked for public comment on the feasibility of furnishing medical debt information to consumer reporting agencies and reporting to creditors in a way that distinguishes between loan obligations and disbursements that pay for medical expenses and those that do not, if the CFPB were to consider information about debts generally incurred to pay for medical bills and expenses to be “medical information” that is “derived” from a health care provider or consumer. One commenter who supported expanding the CFPB's proposed definition of medical debt information (and interpretation of medical information under the FCRA) suggested that for medical expenses charged to general purpose credit cards, a furnisher or lender providing information to the credit reporting agencies would merely need to designate that the debt is medical debt. Other commenters stated that they believed medical expenses on credit cards could be identified by using Merchant Category Codes (MCC). One commenter stated that the CFPB should require credit card issuers to have medical providers identify themselves using the MCCs for medical services and supplies. Another commenter noted, for example, that flexible spending account credit cards use MCCs to automatically substantiate qualified expenses and suggested that a similar technology applied under the CFPB's final rule.

Some commenters suggested that the CFPB require credit card issuers to exclude negative information about debts from merchants who are coded under the MCCs as medical providers. One such commenter stated that, under this approach, the CFPB would be required to establish rules for payment application and allocation of interest for mixed medical and non-medical credit card balances through a separate rulemaking, which it anticipated would not be more complicated than the rules for payment allocation and calculation of interest on balances with different annual percentage rates (APRs) under Regulation Z, to make clear to what portions of a consumer's credit card debt could be provided to consumer reporting agencies and creditors. Another commenter said that the CFPB should additionally develop mechanisms for identifying and tracking when loan disbursements or payments from other general purpose lending products are used to pay for medical expenses. A different commenter suggested that the CFPB require creditors to expand their categorization system to flag medical expenses at the point of transaction or through subsequent verification processes. The commenter stated that a new merchant code could be created to flag healthcare provider payments or existing medical

merchant codes would be flagged as part of a broader medical expense category.

In contrast, commenters supporting the current scope of the proposed medical debt information definition stated that it is not feasible to implement an expansion of the medical debt information definition and interpretation of medical information under the FCRA to include products from third-party lenders. Specifically, the commenters stated third-party lenders like credit card issuers or home equity lenders would need to be able to identify medical charges or expenses and recalculate fields such as the consumer's current balance, credit limit, amount past due, and actual payment amount. One commenter also stated that, unlike credit card issuers who may be able to identify which merchant a consumer has shopped with, banks that offer unsecured credit generally do not know how a consumer spends loan proceeds and if any of the loan was used to pay for medical expenses. A couple of commenters stated that even if a third-party lender or creditor were able to identify such charges using merchant category codes or some other information, it would need to maintain two sets of records, one with medical debt information and one without, which may lead to consumer confusion and other operational risks.

Several commenters asked that if the CFPB does not include debts owed to third-party lenders or creditors such as credit card issuers within the scope of the final rule, that the CFPB continue to evaluate the impacts of such debt, such as for specific populations like family caregivers and persons in their care who may not understand the scope of the CFPB's final rule, and to ascertain the impact of the final rule. Other commenters asked the CFPB to actively regulate and implement consumer protections related to medical lending products.

Civil Judgments

The CFPB also received several comments about its interpretation of FCRA section 603(i) that medical debt information includes civil judgments arising from medical debt collection actions, where the debt is directly owed to a health care provider, or to their agent or assignee. One commenter supported the CFPB's proposed approach, stating that the CFPB's interpretation is important considering that there are credit reporting agencies that specialize in providing consumer reports consisting of public records information, including about civil judgments. This commenter recommended that the CFPB include its interpretation about civil judgments in the final regulatory text or in official commentary. A couple of commenters opposed the CFPB's interpretation about civil judgments. The commenters generally stated that it is not apparent from public record information whether a debt underlying a civil judgment is owed or was once owed directly to a health care provider for the provision of health care, particularly if the legal action was brought by a debt buyer whose name does not reference health care. In such cases, the commenters stated creditors would need to engage in burdensome individualized investigations to determine if a civil judgment is medical debt information. The commenters suggested that the CFPB revise its interpretation so that information about a civil judgment arising from a medical debt collection action is not considered medical information under the FCRA. In the alternative, one of the commenters suggested that the CFPB revise its interpretation of what constitutes medical information about a debt, so that it includes, other than the name of the judgment creditor, publicly available information that the civil judgment arises from a debt collection action as to a medical debt directly owed to a health care provider or to such person's assignee (as opposed to debt buyer, as referenced in the CFPB's NPRM).

This commenter also stated that the CFPB's discussion of its preliminary interpretation in the NPRM was inconsistent with its proposed definition for medical debt information. According to the commenter, while the proposed definition is clear that the debt at issue must be owed to health care provider or to their agent or assignee, in the NPRM the CFPB stated that medical information in the form of a civil judgment arising from a debt collection action as to a medical debt “directly owed to a health care provider or debt buyer” would be considered information about a debt that is medical information under FCRA section 603(i).
112

The commenter stated that this statement in the preamble of the NPRM could be read as meaning that the CFPB's proposal includes medical debt owed to a debt buyer even if the debt had not been originally owed to a health care provider.

112
79 FR 51682, 51690 (June 18, 2024).

Credit Scores

Several commenters generally opposing the CFPB's proposed rule also disagreed that credit scores that have weighed medical debt information should be medical debt information under the CFPB's preliminary interpretation. One commenter stated that the final rule should provide that a creditor that considers a credit score that could have weighed medical debt information does not violate the creditor prohibition. Another commenter, a financial institution, stated that credit scores are essential for lenders to determine a consumer's creditworthiness. The commenter argued that removing medical debt information from the data used to calculate credit scores would lead to the inflation of those scores, affect lenders' ability to accurately make credit risk assessments, and lead to loan defaults. The commenter stated that CFPB should consider establishing a safe harbor for financial institutions that inadvertently rely on a credit score that weighed medical debt information, because a lender would have difficulty recalculating a credit score due to the proprietary nature of the credit score algorithms used by consumer reporting agencies.

Final Rule—Owes or Owed to a Health Care Provider

For the reasons set forth herein, the CFPB is finalizing its interpretation as set forth in the proposed rule that for information about a consumer's debt to be “medical information” under FCRA section 603(i), the information must relate to a debt the consumer owes, or at one time owed, directly to a health care provider or to the health care provider's agent or assignee for the provision of the health care underlying the payment obligation. The CFPB's interpretation includes medical information in the form of a civil judgment arising from a debt collection action as to a medical debt directly owed to a health care provider or their assignee (
i.e.,
a debt buyer), whether provided on a consumer report, by the consumer on a credit application, or if the creditor learns of the civil judgment through other means; a credit score that had weighed medical debt information; and debts arising from medical care that is elective, or otherwise not medically necessary (
e.g.,
some cosmetic surgeries).

As discussed later in this part with regard to the definition of medical debt information under proposed and final § 1022.3(j), the CFPB also finalizes its approach that its interpretation includes medical debt that has been sold or resold to a debt buyer—who has become the health provider's assignee for the debt, because the payment obligation that was sold was created by a health care provider and at one time was owed

to the health care provider—as well as medical debt that has been assigned to a third-party debt collector, who is acting as an agent on behalf of the health care provider or debt buyer to whom the debt is owed. The CFPB also addresses comments regarding the CFPB's approach as to medical information about debts arising from elective versus non-elective care with the other comments about the CFPB's proposed medical debt information definition.

Third-Party Lenders

FCRA section 603(i) defines “medical information” as “[i]nformation or data, whether oral or recorded, in any form or medium,
created by or derived from a health care provider
or the consumer” that relates to, among other things, “[t]he payment for the
provision of health care
to an individual” (emphasis added). As set forth in its proposal, the CFPB believes that it is consistent with the text of FCRA section 603(i) to interpret the statute's use of these two phrases to mean that for information on a debt to be medical information under the FCRA, the information must relate to a debt arising from a payment obligation that the consumer owes (or at one time owed) directly to a health care provider for the provision of the health care underlying the payment obligation.

The CFPB also finds that the manner in which the final rule implements FCRA section 603(i) is appropriate at this time given operational difficulties for information furnishers, creditors, and consumer reporting agencies in distinguishing between third-party loan obligations and disbursements that pay for medical expenses and those that do not. To implement the rule, entities furnishing information on consumer debts, consumer reporting agencies receiving such information and providing consumer reports to creditors, and creditors receiving information about the consumer's debt obligations must be able to identify the specific information subject to the rule's requirements. Logically, a debt owed directly to a health care provider for the provision of health care to an individual is generally understood by consumers and the health care providers (and their agents and assignees) that are furnishing information to consumer reporting agencies to be medical debt. And, because of medical information furnisher obligations under FCRA section 623(a)(9), information about such debts that is furnished by health care providers (or their agents or assignees) already is and can be easily labeled as medical information by consumer reporting agencies so that they may comply with their medical debt information disclosure obligations under final § 1022.38.
113

The CFPB also notes that it did not receive any comments disagreeing that information about debts owed directly to a health care provider for the provision of health care to an individual is medical information under the statute, even if some commenters urged the CFPB to expand its interpretation.

113

See
15 U.S.C. 1681c(a)(6), 1681s-2(a)(9).

In contrast, currently medical information is generally not easily identifiable when a consumer uses a credit card or the proceeds of a loan from a third-party lender to pay, for example, a medical bill. When a consumer owes a debt to a third-party lender, the amount of that debt may consist of a mix of both medical and non-medical debt.

In the context of credit and debit cards, the CFPB does not believe that the problem of identifying medical debt can be resolved with existing MCCs
114

used by credit card issuers to categorize businesses by the type of services or goods the business provides or existing systems in place for health-related tax-advantaged accounts or arrangements, including health savings accounts (HSAs), flexible spending accounts (FSAs), and health reimbursement accounts (HRAs) pursuant to guidelines set by the Internal Revenue Service (IRS).
115

With respect to MCCs, some commenters suggested that the CFPB simply require credit card issuers to exclude negative information about debts from merchants coded as some sort of health care provider under the MCCs when furnishing information to consumer reporting agencies. However, it is not clear that all credit card transactions at businesses that could reasonably be said to provide health care services, products, or devices would be related to a “payment for the provision of health care” as required for medical information under FCRA section 603(i). For example, as raised by other commenters, in addition to selling prescription medicine, a pharmacy may also sell household or grocery items. Medical credit cards are also currently used to pay for some expenses that are not clearly medical in nature, such as for funeral services.
116

114

See, e.g.,
Visa,
Visa Merchant Data Standards Manual—Visa Supplemental Requirements
(Apr. 2023),
https://usa.visa.com/content/dam/VCOM/download/merchants/visa-merchant-data-standards-manual.pdf;
Mastercard,
Quick Reference Booklet—Merchant Edition
(Apr. 16, 2024),
https://www.mastercard.us/content/dam/public/mastercardcom/na/global-site/documents/quick-reference-booklet-merchant.pdf.

115
With these accounts or arrangements, consumers can use their cards to pay for certain medical care expenses that are deemed qualified under guidelines set by the Internal Revenue Service (IRS).
See
Consumer Fin. Prot. Bureau,
What is a flexible spending account (FSA) card or health savings account card (HSA)?, https://www.consumerfinance.gov/ask-cfpb/what-is-a-flexible-spending-account-fsa-card-health-savings-account-card-hsa-en-417/
(last reviewed Sept. 6, 2024); Ryan J. Rosso, Cong. Rsch. Serv., R45277,
Health Savings Accounts (HSAs)
(2022),
https://crsreports.congress.gov/product/pdf/R/R45277. See also
Ryan J. Rosso, Cong. Rsch. Serv., R46782,
A Comparison of Tax-Advantaged Accounts for Health Care Expenses
5 (2021) (explaining qualified medical expenses under the Internal Revenue Code, 26 U.S.C. 213(d)),
https://crsreports.congress.gov/product/pdf/R/R46782.

116

See, e.g.,
CareCredit,
Ways to use your health and wellness credit card, https://www.carecredit.com/procedures/
(listing categories of procedures a CareCredit medical credit card can be used for) (last visited Nov. 15, 2024).

Similarly, one commenter suggested that technology similar to the inventory information approval system used for FSA cards could be adapted to identify specific medical expenses charged to credit or debit cards. But not all businesses participate in inventory approval systems and/or accept FSA and HSA cards, even if some system was developed to specifically identify expenses that would be medical information under FCRA section 603(i), as opposed to identification as medical expenses under other law. Furthermore, this system is complex; the IRS has issued detailed guidance with regard to the substantiation of eligible medical care expenses paid for with such cards, even at certain businesses with non-health care related MCCs if the business meets conditions such as participation in an inventory information approval system.
117

117

See, e.g.,
Internal Revenue Serv.,
Notice 2007-2
(addressing the use of debit cards for medical expense reimbursements at merchants with non-health care related MCCs),
https://www.irs.gov/pub/irs-drop/n-07-02.pdf
and
Notice 2006-69 Debit cards used to reimburse participants in self-insured medical reimbursement plans and dependent care assistance programs
(describing inventory information approval system requirements),
https://www.irs.gov/pub/irs-drop/n-06-69.pdf
(both last visited Dec. 5, 2024).

Some commenters suggested that the CFPB itself develop or require industry to develop and use transaction-level classification codes to identify what would be medical information at the transactional level under FCRA section 603(i). However, such work or any such requirements would require further input and consultation with industry experts and impose more burden on creditors, information furnishers, and consumer reporting agencies than have been contemplated for this rulemaking. As a result, the CFPB declines to impose such a requirement or itself develop such rules at this time.

Identification of medical debt information could also be problematic

in the case of third-party loans. For example, a home equity lender would not know whether and how much of the proceeds of the loan were used to pay for a medical expense and thus whether it should furnish the loan to consumer reporting agencies as being for medical purposes. As a result, the CFPB also declines to impose such a requirement or itself develop such rules at this time.

The CFPB appreciates, as raised by many commenters, that many Americans use credit products offered by third-party lenders to pay their medical bills. However, as described in more detail in part VII,
CFPA Section 1022(b) Analysis,
the CFPB has also determined that there is not yet substantial evidence that the inclusion of information related to medical debt owed to third-party lenders on consumer reports, or its use in underwriting, leads to consumer harm.

While including information about medical debts owed to third-party lenders might have additional benefits for consumers, the CFPB has determined that such information is beyond the scope of this rulemaking and for the reasons stated above, the CFPB declines to change its approach at this time.

One commenter stated that the CFPB's approach is arbitrary and capricious, because it would generally provide that information about a debt owed directly to a health care provider, or its agent or assignee, for the payment of the provider's provision of health care is medical information about a debt under the FCRA and the CFPB's proposed rule, whereas a debt owed to a third-party lender would not be, even though the consumer (and their creditworthiness) is the same in either instance. However, as stated above, the CFPB believes that its approach aligns with the definition of medical information under FCRA section 603(i). Further, as noted, the operational difficulties and likely compliance burdens further justify its approach.

The CFPB also disagrees with the commenter's statement that the CFPB's interpretation was an arbitrary and capricious deviation from the predecessor Agencies' interpretation of the FCRA in the 2005 interim final rule implementing section 411 of the FACT Act. The language cited by the commenter from the 2005 interim final rule rela

[Text truncated at 120,000 characters. The full text is on the page linked above.]

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2024-30824. Public record. Not legal advice.