CUNA Comment Letter

CUNA Letter on Proposed Rule – Obtaining and Using Medical Information

May 27, 2004

Ms. Becky Baker
Secretary of the Board
National Credit Union Administration
1775 Duke Street
Alexandria, Virginia 22314-3428

Dear Ms. Baker:

The Credit Union National Association (CUNA) appreciates the opportunity to comment on an interagency proposal that will provide exceptions to the restrictions on obtaining and using medical information that were included in the Fair and Accurate Credit Transactions (FACT) Act that was passed last year. CUNA represents more than 90 percent of our nation’s 9,800 federal and state-chartered credit unions. The following comments were developed by CUNA with input from credit unions, credit union leagues, and CUNA’s Consumer Protection Subcommittee, chaired by Kris Mecham, CEO of Deseret First Credit Union, Salt Lake City, Utah.

Summary of CUNA's Position

NCUA’s Rule Should Cover State-chartered Credit Unions

The significant issue with this proposal is that the rule will only apply to federal credit unions, not to state-chartered credit unions. This is because the FACT Act gives NCUA direct rulemaking authority over federal credit unions and is silent regarding state-chartered credit unions. Although other agencies also have rulemaking authority with regard to the use of medical information, none of those rules would apply to state-chartered credit unions.

This is very important because the medical information provisions in the FACT Act severely restrict the ability of creditors to obtain and use medical information, but allows NCUA and the federal banking agencies to issue rules providing exceptions that are necessary and appropriate. The rulemaking provisions of the FACT Act are clearly intended to provide creditors with the ability to continue to obtain and use medical information consistent with the intent of the FACT Act, which is to ensure that such information is used for appropriate purposes.

State-chartered credit unions will be at a significant competitive disadvantage to federal credit unions, banks, and thrifts if they do not receive the benefits of these exceptions. The information they can obtain and use with regard to transactions related to medical issues will be severely limited, as compared to federal credit unions. Under our system of credit, the more information the creditor has, the better able it is to assess the risks involved, resulting in rates and fees that accurately reflect this risk. If the information is limited, then this assessment will not be accurate.

If state-chartered credit unions do not have access to the same information regarding financial transactions related to medical issues, then they may be forced to charge higher rates and fees than those charged by federal credit unions, banks, and thrifts in order to cover the unknown risks, which may place the state-chartered credit unions at a competitive disadvantage with regard to these transactions. This competitive disadvantage clearly raises safety and soundness concerns, which would provide NCUA with the authority to extend the rule to state-chartered credit unions.

We realize that, without the necessary restrictions, medical information can be used against consumers when they seek financial services and recognize that the intent of the FACT Act provisions on medical information is intended to prevent these situations. However, credit unions may have a need to obtain and use medical information in a number of situations that are appropriate and would benefit their members. An open discussion between the credit union and member, that may include medical information, helps the member qualify for the loan he or she needs. Although it is not possible to provide an exhaustive list, possible examples may include the following:

There are a number of means by which NCUA can help alleviate this competitive disadvantage, including the following:

The FACT Act should be interpreted to allow NCUA to extend its rule to state-chartered credit unions

Title IV of the FACT Act amends the FCRA and imposes the restrictions with regard to obtaining and using medical information and refers to rulemaking in two contexts. The first context applies to medical information shared with affiliates, which will be subject to the reporting requirements under the FACT Act that apply to consumer reports. Here, Section 411 of the FACT Act amends Section 604(g) of the FCRA and permits NCUA and other regulators to issue rules, as necessary and appropriate, to allow the sharing of medical information with affiliates under the standard FCRA exceptions, such as the sharing of transactional or experience information among affiliates or the sharing of certain other information after providing consumers with the opportunity to "opt-out."

These provisions clearly state that the agencies may only issue rules with regard to the financial institutions subject to their jurisdiction under Section 621(b) of the FCRA. Specifically, Section 621(b) addresses the agencies authority (other than FTC) to enforce provisions of the FCRA. For NCUA, the institutions under its jurisdiction under Section 621(b) only includes federal credit unions and, therefore, any such rules issued under these FACT Act provisions would clearly only cover federal credit unions.

The second context with regard to rulemaking under the FACT Act applies to the rules that NCUA and the federal banking agencies may issue to create exceptions to the general prohibition in the FACT Act on creditors obtaining and using medical information. The agencies may issue such rules as necessary "to protect legitimate operational, transactional, risk, consumer, and other needs."

Section 411 of the FACT Act creates Section 604(g)(5) of the FCRA that specifically addresses the rulemaking authority regarding these exceptions. This Section does not have the language limiting the agencies’ rulemaking authority solely to financial institutions subject to their enforcement jurisdiction. This section simply states that "[e]ach Federal banking agency and the National Credit Union Administration shall . . . prescribe regulations that permit transactions . . . that are determined to be necessary and appropriate to protect legitimate operational, transactional, risk, consumer, and other needs . . ."

We strongly believe that the differences in the rulemaking language for the sections on sharing of medical information with affiliates and the exceptions to the prohibition on creditors obtaining and using medical information can clearly be read to allow NCUA to extend these exceptions to state-chartered credit unions. If the FACT Act intended to restrict NCUA’s rulemaking authority for these exceptions only to federal credit unions, then language would have been added to Section 604(g)(5) to restrict the limitation of these agencies’ rulemaking authority solely to financial institutions subject to their enforcement authority under the FCRA. Since this restriction was not added, we believe Section 604(g)(5) should be read to permit NCUA to extend these exceptions to state-chartered credit unions.

Our interpretation of these rulemaking provisions is also strengthened because FTC has rulemaking authority with regard to the provisions on the sharing of medical information with affiliates but not with regard to the exceptions to the general prohibition on obtaining and using medical information by creditors. This could be interpreted to mean that it was not necessary to include FTC since it was contemplated that all federally insured financial institutions should be included under the rules issued by NCUA and the federal banking agencies. Although we recognize there may be an issue as to the enforcement of these provisions regarding state-chartered credit unions, we would welcome the opportunity to work with NCUA and the FTC to address these and any other issues regarding these provisions.

Amending the FACT Act provisions so that either NCUA, FTC, or state regulators will have rulemaking authority for state-chartered credit unions.

We encourage NCUA to support a legislative solution that would amend the FACT Act provisions to provide either NCUA, the FTC, or state regulators with rulemaking authority that extends to state-chartered credit unions. Because the FACT Act restrictions regarding medical information are scheduled to be effective as of June 4, 2004, it is important that we discuss this option at an appropriate time in the very near future.

A number of the exceptions in the rule should be interpreted as not being covered under the FACT Act provisions, as opposed to being considered an exception to these provisions.

NCUA and the other agencies have requested comment on whether certain exceptions should instead be interpreted as not being covered under the FACT Act restrictions on creditors using and obtaining medical information. These include medical information in connection with triggering coverage under debt cancellation, debt suspension, or credit insurance products, as well as creditors obtaining medical information that is unsolicited if they do not later use the information.

We urge NCUA and the other agencies to interpret these scenarios as not being covered under the FACT Act restrictions. These restrictions only apply to obtaining or using the information "in connection with any determination of the consumer’s eligibility, or continued eligibility, for credit." We do not believe that information in connection with triggering coverage under debt cancellation, debt suspension, or credit insurance products is related to a decision on credit eligibility. We also believe that receiving, but not using, unsolicited medical information is not related to a decision on credit eligibility and would, therefore, not be covered under these FACT Act restrictions.

We agree with NCUA and the other agencies that coded information in a credit report is not covered under the FACT Act restrictions for the following reasons:

Not only is it appropriate to interpret these situations as unreachable under the FACT Act restrictions, as opposed to an exception, such interpretation should allow state-chartered credit unions to access medical information in these situations. Having multiple federal financial institution regulators interpreting these scenarios as not covered under the FACT Act will have great weight if a state-chartered credit union is ever challenged as a result of using the information in this manner. This would not be the case if these scenarios are interpreted as exceptions, in which case they would be interpreted as exceptions that only apply to the financial institutions under the jurisdiction of their respective agency, which for NCUA may only be for federal credit unions. Unfortunately, this approach of treating these situations as interpretations, as opposed to exceptions, will not be optimal because state-chartered credit unions will not achieve complete parity with federal credit unions with regard to these FACT Act restrictions as there are other exceptions included in the rule in addition to the ones outlined above.

The Need to Delay the Effective Date of the Proposed Rule

NCUA and the other agencies have requested comment as to whether the June 4, 2004 effective date is appropriate or whether a different date should be established. We urge NCUA and the other agencies to delay the effective date of the rule, both because of the need to allow credit unions time to prepare and implement the FACT Act restrictions, along with the exceptions outlined in the proposed rule, and to ensure that state-chartered credit unions will be able to use the exceptions provided in the proposed rule.

Based on these two important factors, we suggest that the effective date should be six months from the date that the issue is resolved regarding the applicability of the proposed rule to state-chartered credit unions, as well as other financial service providers that also may not be covered under the proposed rule. The delay in the effective date is important because the FACT Act restrictions will not be effective until the proposed rule is finalized. Postponing the effective date will, therefore, delay the date that these restrictions will become effective for all credit unions until this issue is resolved.

Comments Regarding the Proposed Rule

CUNA believes that the proposed rule in most situations strikes the correct balance between appropriate and inappropriate use of medical information. We do, however, offer suggestions that would further achieve this goal.

In general, the definition of "medical information" needs to be interpreted more narrowly. The definition of "medical information" under Section 411 of the FACT Act includes the "past, present, or future physical, mental, or behavioral health or condition of an individual." Although the statute includes some limitations, the definition in its current form is very broad. For example, "behavioral health" can be interpreted to include almost any aspect of member information. The Webster’s II University Dictionary defines "behavior" as "the manner in which one behaves" and "one’s actions and reaction under specified circumstance." The term "health" is defined as "the overall condition of an organism at a given time." Taken together, the term "behavioral health" can conceivably include almost any actions of an individual.

We urge NCUA to provide additional, detailed information and examples that would provide a more complete and exhaustive definition of "medical information." We suggest the term "medical information" be limited to information resulting from or related to the determination of a properly certified healthcare professional.

Under one of the proposed exceptions, a creditor may obtain and use medical information in determining credit eligibility if the following three requirements are met:

We generally support this exception, although we believe the scope should be expanded. Instead of the requirement that the information relate to debts, expenses, income, benefits, collateral, or the purpose of the loan, the scope should be expanded to include other types of information routinely used in credit underwriting decisions, such as assets. Although "collateral" is included, that only pertains to assets used as a security interest. Allowing other assets to be considered will give credit unions additional information to more completely address a member’s financial condition. We suggest that the first requirement above be changed to state that "the information is of the type routinely used in credit eligibility determinations."

One of the proposed exceptions is if the consumer or the consumer’s legal representative requests in writing, on a separate form signed by the consumer or legal representative, that the creditor use specific medical information in determining credit eligibility to accommodate the consumer’s particular circumstances. The request must describe the specific medical information and the specific purpose for which it will be used.

We believe the requirements that the consumer request be in writing on a separate form may hinder a credit union’s ability to use and obtain medical information for appropriate purposes. For example, many credit union members apply for loans by telephone. The requirement that the consumer request be in writing will require additional measures to provide the consent after the telephone application process is complete. We suggest that additional flexibility be provided with regard to this exception so that members may make the request by telephone or through other means that may not be considered a writing. The requirement for a writing signed by the member to allow the use of medical information in a credit determination can be eliminated as it is not required by the statute.

NCUA and the other agencies have requested specific comment as to the extent it is necessary to obtain and use medical information for purposes of fraud prevention and detection in connection with credit eligibility determinations.

Comments we received from credit unions on this issue indicate that verifying disability income is one common situation in which it may be necessary to obtain medical information for such purposes.

Also, on a case-by-case basis, credit unions may conduct investigations to determine if a member has been a victim of fraud or identity theft. The information acquired may include medical information. For this reason, we encourage NCUA to grant the broadest exception possible with regard to fraud prevention and detection.

Thank you for the opportunity to comment on the interagency proposal that will provide exceptions to the FACT Act restrictions on obtaining and using medical information. If Board members or agency staff have questions about our comments, please contact Associate General Counsel Mary Dunn or me at (202) 638-5777.

Sincerely,

Jeffrey Bloch
Assistant General Counsel