21.2 Medical information in credit decisions: Regulation FF and V

Identify the FCRA medical-information restriction

The CRCM outline names Regulations V and FF with the Fair Credit Reporting Act. Regulation FF implements the FACT Act’s medical-information restrictions; it is not the name of the bank identity-theft red-flags rule. The current CFPB Regulation V medical-information provisions, including Section 1022.30, provide an important operational starting point. Distinguish these credit-information rules from HIPAA health-service privacy and from a bank’s prudential identity-theft program.

Medical information under FCRA concerns specified information relating to a consumer’s health, treatment or payment for health care. A creditor generally may not obtain or use medical information to determine credit eligibility except as permitted by the statute and regulation. Receipt, use, reporting and affiliate sharing can raise different questions. A bank’s authority to make a credit decision does not mean every health detail is an appropriate underwriting factor.

Financial information versus health judgments

The financial-information exception permits use of qualifying financial information that happens to involve medical debts or expenses under its conditions. The information must be of a type routinely used in credit eligibility, used no less favorably than comparable nonmedical information, and not used to assess the consumer’s physical or mental health, condition, treatment or prognosis. The exception is not permission to predict life expectancy or illness-related employment risk from a treatment record.

For example, the amount of an otherwise permissible financial obligation can be analyzed consistently with similar obligations, subject to current medical-debt restrictions. The lender cannot treat a debt more harshly solely because it arose from a particular diagnosis or treatment. Review both the data field and the decision logic: a financial label can conceal health-based scoring if the model uses provider names or treatment categories to infer prognosis.

Unsolicited information and other exceptions

A consumer can provide information a creditor did not seek. Unsolicited receipt does not authorize unrestricted underwriting use. Route it appropriately, determine whether an exception permits its use and avoid including unnecessary details in broadly accessible credit files. A loan officer should not ask for a diagnosis as a shortcut to assessing whether a consumer can repay.

The rule contains other specific exceptions, including particular consumer requests, certain specialized credit arrangements and other defined circumstances. Apply the actual conditions rather than a blanket waiver obtained in every application. A generic consent to obtain a consumer report is not automatically consent to use all medical information for every purpose. When an exception requires a particular consumer request or authorization, preserve evidence supporting that condition.

Reports, coding and affiliate sharing

FCRA limits disclosure of medical information by consumer reporting agencies, with specified conditions and treatment for appropriately coded financial information. It also restricts certain sharing among affiliates. A bank should understand the source, coding and permitted use of report data. The consumer-report permissible-purpose rule and the medical-information exception are separate gates; passing one does not automatically satisfy the other.

Credit policy should address prohibited inputs, permitted financial treatment, manual overrides and model validation. Medical provider identifiers, free-text notes and documents supplied during a hardship request can be sensitive even when not scored. Control access and retention according to applicable requirements and the legitimate purpose. Do not assume GLBA privacy notices authorize an otherwise prohibited FCRA medical-information practice.

Current rule and litigation status

Medical-debt policy has changed through rulemaking and litigation. The CFPB’s January 2025 medical-debt rule was vacated by a federal court in July 2025. Do not present that vacated rule’s categorical restrictions as the operative federal rule. Conversely, the vacatur did not remove every longstanding FCRA medical-information restriction or any independently applicable state law. Review current Section 1022.30, the relevant court order and applicable state requirements when designing a live process.

For an exam scenario, identify the rule date and facts provided. If a loan officer proposes denying credit because a consumer’s medical record suggests future illness, analyze the health-based use rather than equating it with an ordinary financial ratio. If the problem instead describes permitted financial information, apply the exception’s equal-treatment and no-health-inference conditions. These cases can look similar but have different legal outcomes.

Design a focused review

A monitoring scope can compare approved data inputs with actual applications, underwriting notes, model features and adverse-action reasons. Interview staff handling hardship and accommodation requests, since those files can contain unsolicited health information. Validate exceptions with the business unit, document the applicable authority and assess the affected population before determining remediation.

Training should teach employees to distinguish financial capacity, prohibited health inference and permissible accommodation processes. A bank can work with a customer’s request without turning every disclosed disability into an underwriting penalty. Coordinate FCRA, fair lending, privacy and information security rather than reducing the issue to a single form.

Federal Reserve Regulation FF summary and CFPB Section 1022.30 provide the primary concepts and current regulatory text.