Risk Management: Medical Information

Although the medical information rules are placed under the umbrella of the Fair Credit Reporting Act, the necessary steps for compliance are not as straightforward as those traditionally used for the old FCRA. By old FCRA, we mean the FCRA before it was revised and altered by the FACT Act. The old FCRA involved tracking the use of consumer information reports, the reporting of information to credit bureaus, and the management of contracts with credit bureaus. Who was responsible for what was fairly clear. It only got complicated if an information user or furnisher used prescreened lists for marketing purposes.

With the medical information rules, all this changes - no matter what use the creditor makes of credit bureau reports. The sources of medical information reach far beyond the use of a consumer's credit report. Information covered by this rule can arrive in the institution through a credit report. But it can also arrive through payment processing, check clearing and even from third parties.

This rule must be understood throughout the institution. You will need training for staff that performs a variety of tasks and functions. And you will need procedures in places the FCRA hasn't reached before. Thanks to the exceptions carved out in the regulation, the process should be manageable, but it will need a lot of attention. In the charts on pages 4 and 5 of this issue, we have organized the new rule in two different ways. The first chart works from the banking department to identify the portions of the rule that affect it. The second chart tracks the basic provisions of the rule and identifies affected areas. We hope these charts will be useful to your implementation efforts.

Medical Information Rules by Function (Chart 1)

Medical Information Rules to Implement (Chart 2)

Copyright © 2005 Compliance Action. Originally appeared in Compliance Action, Vol. 10, No. 7, 6/05